March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1059-1: moderate: Security update for lftp
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for lftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1059-1 Rating: moderate References: #1103367 #1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for lftp fixes the following issues: Security issue fixed: - CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed: - The SSH login handling code detects password prompts more reliably (bsc#1120946). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1059=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): lftp-4.7.4-2.6.1 lftp-debuginfo-4.7.4-2.6.1 lftp-debugsource-4.7.4-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-10916.html https://bugzilla.suse.com/1103367 https://bugzilla.suse.com/1120946

1 0

openSUSE-RU-2019:1061-1: Recommended update for gcompris-qt
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for gcompris-qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1061-1 Rating: low References: #1093988 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for gcompris-qt fixes the following issue (boo#1093988): - text corrections and translation updates - UI position and element interaction corrections - fixes to audio in several activities - corrections and improvements to multiple activities gcompris-qt-voices was updated to match. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1061=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): gcompris-qt-0.91-bp150.2.3.1 gcompris-qt-debuginfo-0.91-bp150.2.3.1 gcompris-qt-debugsource-0.91-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gcompris-qt-activities-0.91-bp150.2.3.1 gcompris-qt-lang-0.91-bp150.2.3.1 gcompris-qt-voices-0~20180517-bp150.2.3.1 References: https://bugzilla.suse.com/1093988

1 0

openSUSE-SU-2019:1056-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 27 Mar '19

27 Mar '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1056-1 Rating: important References: #1129821 #1130262 Cross-References: CVE-2018-18506 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9810 CVE-2019-9813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 60.6.1esr (MFSA 2019-10 boo#1130262) * CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations Mozilla Firefox was updated to 60.6.0esr (MFSA 2019-08 boo#1129821) * CVE-2019-9790: Use-after-free when removing in-use DOM elements * CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey * CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script * CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled * CVE-2019-9794: Command line arguments not discarded during execution * CVE-2019-9795: Type-confusion in IonMonkey JIT compiler * CVE-2019-9796: Use-after-free with SMIL animation controller * CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied * CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla Firefox was updated to 60.5.2esr: * Fix a frequent crash when reading various Reuters news articles Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1056=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.6.1-135.1 MozillaFirefox-branding-upstream-60.6.1-135.1 MozillaFirefox-buildsymbols-60.6.1-135.1 MozillaFirefox-debuginfo-60.6.1-135.1 MozillaFirefox-debugsource-60.6.1-135.1 MozillaFirefox-devel-60.6.1-135.1 MozillaFirefox-translations-common-60.6.1-135.1 MozillaFirefox-translations-other-60.6.1-135.1 References: https://www.suse.com/security/cve/CVE-2018-18506.html https://www.suse.com/security/cve/CVE-2019-9788.html https://www.suse.com/security/cve/CVE-2019-9790.html https://www.suse.com/security/cve/CVE-2019-9791.html https://www.suse.com/security/cve/CVE-2019-9792.html https://www.suse.com/security/cve/CVE-2019-9793.html https://www.suse.com/security/cve/CVE-2019-9794.html https://www.suse.com/security/cve/CVE-2019-9795.html https://www.suse.com/security/cve/CVE-2019-9796.html https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262

1 0

openSUSE-OU-2019:1057-1: moderate: Optional update for Chromium dependencies
by maintenance＠opensuse.org 27 Mar '19

27 Mar '19

openSUSE Optional Update: Optional update for Chromium dependencies ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:1057-1 Rating: moderate References: #1095545 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update contains a number of updated dependencies for Chromium, including ffmpeg 4. New package ffmpeg-4: - Builds ffmpeg 4 libraries New package ffmpeg-3: - Builds ffmpeg 3 libraries and command line utilities Changes in zeromq, codec2, libsodium: - baselibs.conf changes required for ffmpeg 4 This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1057=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): codec2-0.6-bp150.4.3.1 codec2-debuginfo-0.6-bp150.4.3.1 codec2-debugsource-0.6-bp150.4.3.1 codec2-devel-0.6-bp150.4.3.1 ffmpeg-4-libavcodec-devel-4.0.1-bp150.18.1 ffmpeg-4-libavdevice-devel-4.0.1-bp150.18.1 ffmpeg-4-libavfilter-devel-4.0.1-bp150.18.1 ffmpeg-4-libavformat-devel-4.0.1-bp150.18.1 ffmpeg-4-libavresample-devel-4.0.1-bp150.18.1 ffmpeg-4-libavutil-devel-4.0.1-bp150.18.1 ffmpeg-4-libpostproc-devel-4.0.1-bp150.18.1 ffmpeg-4-libswresample-devel-4.0.1-bp150.18.1 ffmpeg-4-libswscale-devel-4.0.1-bp150.18.1 ffmpeg-4-private-devel-4.0.1-bp150.18.1 libavcodec58-4.0.1-bp150.18.1 libavdevice58-4.0.1-bp150.18.1 libavfilter7-4.0.1-bp150.18.1 libavformat58-4.0.1-bp150.18.1 libavresample4-4.0.1-bp150.18.1 libavutil56-4.0.1-bp150.18.1 libcodec2-0_6-0.6-bp150.4.3.1 libcodec2-0_6-debuginfo-0.6-bp150.4.3.1 libpostproc55-4.0.1-bp150.18.1 libswresample3-4.0.1-bp150.18.1 libswscale5-4.0.1-bp150.18.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libavcodec58-64bit-4.0.1-bp150.18.1 libavdevice58-64bit-4.0.1-bp150.18.1 libavfilter7-64bit-4.0.1-bp150.18.1 libavformat58-64bit-4.0.1-bp150.18.1 libavresample4-64bit-4.0.1-bp150.18.1 libavutil56-64bit-4.0.1-bp150.18.1 libcodec2-0_6-64bit-0.6-bp150.4.3.1 libcodec2-0_6-64bit-debuginfo-0.6-bp150.4.3.1 libpostproc55-64bit-4.0.1-bp150.18.1 libswresample3-64bit-4.0.1-bp150.18.1 libswscale5-64bit-4.0.1-bp150.18.1 - openSUSE Backports SLE-15 (noarch): codec2-examples-0.6-bp150.4.3.1 References: https://bugzilla.suse.com/1095545

1 0

openSUSE-RU-2019:1055-1: moderate: Recommended update for sbd
by maintenance＠opensuse.org 26 Mar '19

26 Mar '19

openSUSE Recommended Update: Recommended update for sbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1055-1 Rating: moderate References: #1102930 #1107321 #1112918 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sbd fixes the following issues: Updated to version 1.4.0+20190123.1829c40: - sbd.sysconfig: watchdog timeout set in the on-disk metadata takes precedence - sbd.8.pod: use the generic term "cluster services" instead of the specific "openais" (bsc#1112918) - make timeout-action executed by sbd configurable - use pacemaker's new pe api with constructors/destructors - sbd-common: avoid statting potential links - sbd-inquisitor: SBD_DELAY_START can be configured with a delay value (bsc#1107321) - sbd-common: don't follow symlinks outside /dev for watchdog This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1055=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): sbd-1.4.0+20190123.1829c40-3.6.1 sbd-debuginfo-1.4.0+20190123.1829c40-3.6.1 sbd-debugsource-1.4.0+20190123.1829c40-3.6.1 References: https://bugzilla.suse.com/1102930 https://bugzilla.suse.com/1107321 https://bugzilla.suse.com/1112918

1 0

openSUSE-RU-2019:1054-1: moderate: Recommended update for pacemaker
by maintenance＠opensuse.org 26 Mar '19

26 Mar '19

openSUSE Recommended Update: Recommended update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1054-1 Rating: moderate References: #1085515 #1090538 #1094208 #1107270 #1114840 #1121272 #1121808 #974108 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for pacemaker provides the following fixes: - cts: Do not require nodes to be specified if only listing tests. (bsc#1114840) - cts: Temporarily disable any enabled cluster services when running remote tests. - cts: Count service as enabled only if it is explicitly enabled. - cts: Ignore monitor failures when testing remote node fencing. - cts: Lower remote connection failure detection time. - cts: Clear constraints on cluster nodes. (bsc#1121272) - cts: Resume any possibly frozen pacemaker_remoted when cleaning up the test. (bsc#1121272) - cts: Simulate failure of pacemaker_remoted by freezing it with SIGSTOP. (bsc#1121272) - cts-exec: Run the tests for the other resource classes even without python systemd bindings. (bsc#1121808) - fenced: Handle fencing requested with nodeid by using the membership cache of known nodes. (bsc#1094208, bsc#1107270, bsc#974108) - controld: Make it possible to manually confirm unseen nodes are down. (bsc#1094208, bsc#1107270) - pengine: "symmetrical" defaults to "false" for serialize orders. (bsc#1085515) - pengine: Avoid potential use of NULL in unpack_simple_rsc_order(). (bsc#1085515) - pengine: Fix swapped warning message arguments leading to segfault. (bsc#1090538) - Pacemaker Explained: "symmetrical" defaults to "false" for serialize orders. (bsc#1085515) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1054=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpacemaker-devel-1.1.16-4.6.1 libpacemaker3-1.1.16-4.6.1 libpacemaker3-debuginfo-1.1.16-4.6.1 pacemaker-1.1.16-4.6.1 pacemaker-cli-1.1.16-4.6.1 pacemaker-cli-debuginfo-1.1.16-4.6.1 pacemaker-cts-1.1.16-4.6.1 pacemaker-cts-debuginfo-1.1.16-4.6.1 pacemaker-debuginfo-1.1.16-4.6.1 pacemaker-debugsource-1.1.16-4.6.1 pacemaker-remote-1.1.16-4.6.1 pacemaker-remote-debuginfo-1.1.16-4.6.1 References: https://bugzilla.suse.com/1085515 https://bugzilla.suse.com/1090538 https://bugzilla.suse.com/1094208 https://bugzilla.suse.com/1107270 https://bugzilla.suse.com/1114840 https://bugzilla.suse.com/1121272 https://bugzilla.suse.com/1121808 https://bugzilla.suse.com/974108

1 0

openSUSE-RU-2019:1053-1: moderate: Recommended update for discord
by maintenance＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Recommended Update: Recommended update for discord ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1053-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for discord fixes the following issues: Discord was updated to version 0.0.9. * No upstream release notes. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2019-1053=1 Package List: - openSUSE Leap 15.0:NonFree (x86_64): discord-0.0.9-lp150.2.6.1 discord-debuginfo-0.0.9-lp150.2.6.1 References:

1 0

openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364

1 0

openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066

1 0

openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066

1 0

openSUSE-RU-2019:1053-1: moderate: Recommended update for discord
by maintenance＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Recommended Update: Recommended update for discord ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1053-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for discord fixes the following issues: Discord was updated to version 0.0.9. * No upstream release notes. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2019-1053=1 Package List: - openSUSE Leap 15.0:NonFree (x86_64): discord-0.0.9-lp150.2.6.1 discord-debuginfo-0.0.9-lp150.2.6.1 References:

1 0

openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364

1 0

openSUSE-SU-2019:1051-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1051-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1051=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.32.0-bp150.3.10.1 kauth-devel-5.32.0-bp150.3.10.1 kcoreaddons-5.32.0-bp150.3.3.1 kcoreaddons-debugsource-5.32.0-bp150.3.3.1 kcoreaddons-devel-5.32.0-bp150.3.3.1 kcoreaddons-devel-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-5.32.0-bp150.3.10.1 libKF5Auth5-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-5.32.0-bp150.3.3.1 libKF5CoreAddons5-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.32.0-bp150.3.10.1 kcoreaddons-devel-64bit-5.32.0-bp150.3.3.1 kcoreaddons-devel-64bit-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-64bit-5.32.0-bp150.3.10.1 libKF5Auth5-64bit-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-64bit-5.32.0-bp150.3.3.1 libKF5CoreAddons5-64bit-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kcoreaddons-lang-5.32.0-bp150.3.3.1 libKF5Auth5-lang-5.32.0-bp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863

1 0

openSUSE-RU-2019:1048-1: moderate: Recommended update for owncloud-client
by maintenance＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Recommended Update: Recommended update for owncloud-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1048-1 Rating: moderate References: #1057832 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for owncloud-client fixes the following issues: - Update to upstream version 2.4.2 (boo#1057832) * Coming with some bugfixes, Changelog: https://owncloud.org/changelog/desktop-client/ * Fix a problem with older Qt versions (https://github.com/owncloud/client/issues/5968) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1048=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libowncloudsync-devel-2.4.2-bp150.2.3.1 libowncloudsync0-2.4.2-bp150.2.3.1 owncloud-client-2.4.2-bp150.2.3.1 owncloud-client-caja-2.4.2-bp150.2.3.1 owncloud-client-doc-2.4.2-bp150.2.3.1 owncloud-client-dolphin-2.4.2-bp150.2.3.1 owncloud-client-l10n-2.4.2-bp150.2.3.1 owncloud-client-nautilus-2.4.2-bp150.2.3.1 owncloud-client-nemo-2.4.2-bp150.2.3.1 References: https://bugzilla.suse.com/1057832

1 0

openSUSE-RU-2019:1052-1: Recommended update for perl-Finance-Quote
by maintenance＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Recommended Update: Recommended update for perl-Finance-Quote ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1052-1 Rating: low References: #1077300 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Finance-Quote fixes the following issues: - GnuCash was unable to retrieve price information if the Perl CGI module was not installed (boo#1077300). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1052=1 Package List: - openSUSE Backports SLE-15 (noarch): perl-Finance-Quote-1.47-bp150.3.3.1 References: https://bugzilla.suse.com/1077300

1 0

openSUSE-RU-2019:0351-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 21 Mar '19

21 Mar '19

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0351-1 Rating: moderate References: #1123991 #1127389 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues: cobbler: - Fix for SUSE distribution detection in ISO building (bsc#1123991) spacecmd: - Add '--force', '-f' option to regenerateYumCache (bsc#1127389) spacewalk-backend: - Make reposync use and append token correctly to the URL - Added 'mgr-sign-metadata-ctl' for repository metadata signing This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-351=1 Package List: - openSUSE Leap 42.3 (noarch): cobbler-2.6.6-23.1 cobbler-tests-2.6.6-23.1 cobbler-web-2.6.6-23.1 koan-2.6.6-23.1 References: https://bugzilla.suse.com/1123991 https://bugzilla.suse.com/1127389

1 0

openSUSE-RU-2019:0349-1: moderate: Recommended update for gcc7
by maintenance＠opensuse.org 21 Mar '19

21 Mar '19

openSUSE Recommended Update: Recommended update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0349-1 Rating: moderate References: #1099119 #1099192 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: GCC 7 was updated to the GCC 7.4 release. - Fix AVR configuration to not use __cxa_atexit or libstdc++ headers. Point to /usr/avr/sys-root/include as system header include directory. - Includes fix for build with ISL 0.20. - Pulls fix for libcpp lexing bug on ppc64le manifesting during build with gcc8. [bsc#1099119] - Pulls fix for forcing compile-time tuning even when building with -march=z13 on s390x. [bsc#1099192] - Fixes support for 32bit ASAN with glibc 2.27+ This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-349=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cpp7-7.4.0+r266845-lp150.3.3.1 cpp7-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-7.4.0+r266845-lp150.3.3.1 gcc7-ada-7.4.0+r266845-lp150.3.3.1 gcc7-ada-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-c++-7.4.0+r266845-lp150.3.3.1 gcc7-c++-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-debugsource-7.4.0+r266845-lp150.3.3.1 gcc7-fortran-7.4.0+r266845-lp150.3.3.1 gcc7-fortran-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-go-7.4.0+r266845-lp150.3.3.1 gcc7-go-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-locale-7.4.0+r266845-lp150.3.3.1 gcc7-obj-c++-7.4.0+r266845-lp150.3.3.1 gcc7-obj-c++-debuginfo-7.4.0+r266845-lp150.3.3.1 gcc7-objc-7.4.0+r266845-lp150.3.3.1 gcc7-objc-debuginfo-7.4.0+r266845-lp150.3.3.1 libada7-7.4.0+r266845-lp150.3.3.1 libada7-debuginfo-7.4.0+r266845-lp150.3.3.1 libasan4-7.4.0+r266845-lp150.3.3.1 libasan4-debuginfo-7.4.0+r266845-lp150.3.3.1 libcilkrts5-7.4.0+r266845-lp150.3.3.1 libcilkrts5-debuginfo-7.4.0+r266845-lp150.3.3.1 libgfortran4-7.4.0+r266845-lp150.3.3.1 libgfortran4-debuginfo-7.4.0+r266845-lp150.3.3.1 libgo11-7.4.0+r266845-lp150.3.3.1 libgo11-debuginfo-7.4.0+r266845-lp150.3.3.1 libobjc4-7.4.0+r266845-lp150.3.3.1 libobjc4-debuginfo-7.4.0+r266845-lp150.3.3.1 libstdc++6-devel-gcc7-7.4.0+r266845-lp150.3.3.1 libubsan0-7.4.0+r266845-lp150.3.3.1 libubsan0-debuginfo-7.4.0+r266845-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gcc7-info-7.4.0+r266845-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): gcc7-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-ada-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-c++-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-fortran-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-go-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-obj-c++-32bit-7.4.0+r266845-lp150.3.3.1 gcc7-objc-32bit-7.4.0+r266845-lp150.3.3.1 libada7-32bit-7.4.0+r266845-lp150.3.3.1 libada7-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libasan4-32bit-7.4.0+r266845-lp150.3.3.1 libasan4-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libcilkrts5-32bit-7.4.0+r266845-lp150.3.3.1 libcilkrts5-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libgfortran4-32bit-7.4.0+r266845-lp150.3.3.1 libgfortran4-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libgo11-32bit-7.4.0+r266845-lp150.3.3.1 libgo11-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libobjc4-32bit-7.4.0+r266845-lp150.3.3.1 libobjc4-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 libstdc++6-devel-gcc7-32bit-7.4.0+r266845-lp150.3.3.1 libubsan0-32bit-7.4.0+r266845-lp150.3.3.1 libubsan0-32bit-debuginfo-7.4.0+r266845-lp150.3.3.1 References: https://bugzilla.suse.com/1099119 https://bugzilla.suse.com/1099192

1 0

openSUSE-RU-2019:0350-1: moderate: Recommended update for gcc7
by maintenance＠opensuse.org 21 Mar '19

21 Mar '19

openSUSE Recommended Update: Recommended update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0350-1 Rating: moderate References: #1099119 #1099192 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: gcc7 was updated to the GCC 7.4 release. Other bugfixes: - Fix AVR configuration to not use __cxa_atexit or libstdc++ headers. Point to /usr/avr/sys-root/include as system header include directory. - Includes fix for build with ISL 0.20. - Pulls fix for libcpp lexing bug on ppc64le manifesting during build with gcc8. [bsc#1099119] - Pulls fix for forcing compile-time tuning even when building with -march=z13 on s390x. [bsc#1099192] - Fixes support for 32bit ASAN with glibc 2.27+ This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-350=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cpp7-7.4.0+r266845-13.1 cpp7-debuginfo-7.4.0+r266845-13.1 gcc7-7.4.0+r266845-13.1 gcc7-ada-7.4.0+r266845-13.1 gcc7-ada-debuginfo-7.4.0+r266845-13.1 gcc7-c++-7.4.0+r266845-13.1 gcc7-c++-debuginfo-7.4.0+r266845-13.1 gcc7-debuginfo-7.4.0+r266845-13.1 gcc7-debugsource-7.4.0+r266845-13.1 gcc7-fortran-7.4.0+r266845-13.1 gcc7-fortran-debuginfo-7.4.0+r266845-13.1 gcc7-go-7.4.0+r266845-13.1 gcc7-go-debuginfo-7.4.0+r266845-13.1 gcc7-locale-7.4.0+r266845-13.1 libada7-7.4.0+r266845-13.1 libada7-debuginfo-7.4.0+r266845-13.1 libasan4-7.4.0+r266845-13.1 libasan4-debuginfo-7.4.0+r266845-13.1 libcilkrts5-7.4.0+r266845-13.1 libcilkrts5-debuginfo-7.4.0+r266845-13.1 libgfortran4-7.4.0+r266845-13.1 libgfortran4-debuginfo-7.4.0+r266845-13.1 libgo11-7.4.0+r266845-13.1 libgo11-debuginfo-7.4.0+r266845-13.1 libstdc++6-devel-gcc7-7.4.0+r266845-13.1 libubsan0-7.4.0+r266845-13.1 libubsan0-debuginfo-7.4.0+r266845-13.1 - openSUSE Leap 42.3 (x86_64): gcc7-32bit-7.4.0+r266845-13.1 gcc7-ada-32bit-7.4.0+r266845-13.1 gcc7-c++-32bit-7.4.0+r266845-13.1 gcc7-fortran-32bit-7.4.0+r266845-13.1 gcc7-go-32bit-7.4.0+r266845-13.1 libada7-32bit-7.4.0+r266845-13.1 libada7-32bit-debuginfo-7.4.0+r266845-13.1 libasan4-32bit-7.4.0+r266845-13.1 libasan4-32bit-debuginfo-7.4.0+r266845-13.1 libcilkrts5-32bit-7.4.0+r266845-13.1 libcilkrts5-32bit-debuginfo-7.4.0+r266845-13.1 libgfortran4-32bit-7.4.0+r266845-13.1 libgfortran4-32bit-debuginfo-7.4.0+r266845-13.1 libgo11-32bit-7.4.0+r266845-13.1 libgo11-32bit-debuginfo-7.4.0+r266845-13.1 libstdc++6-devel-gcc7-32bit-7.4.0+r266845-13.1 libubsan0-32bit-7.4.0+r266845-13.1 libubsan0-32bit-debuginfo-7.4.0+r266845-13.1 - openSUSE Leap 42.3 (noarch): gcc7-info-7.4.0+r266845-13.1 References: https://bugzilla.suse.com/1099119 https://bugzilla.suse.com/1099192

1 0

openSUSE-SU-2019:0348-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 19 Mar '19

19 Mar '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0348-1 Rating: important References: #1127820 #1127821 #1127822 Cross-References: CVE-2018-12178 CVE-2018-12180 CVE-2018-3630 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). - CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet (bsc#1127821). - CVE-2018-3630: Fixed a logic error in FV parsing which could allow a local attacker to bypass the chain of trust checks (bsc#1127822). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-348=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-16.1 ovmf-tools-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-16.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-16.1 References: https://www.suse.com/security/cve/CVE-2018-12178.html https://www.suse.com/security/cve/CVE-2018-12180.html https://www.suse.com/security/cve/CVE-2018-3630.html https://bugzilla.suse.com/1127820 https://bugzilla.suse.com/1127821 https://bugzilla.suse.com/1127822

1 0

openSUSE-RU-2019:0347-1: moderate: Recommended update for qemu
by maintenance＠opensuse.org 19 Mar '19

19 Mar '19

openSUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0347-1 Rating: moderate References: #1100408 #1108474 #1112646 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for qemu fixes the following issues: - Fix a condition when retry logic does not execute in case of data transmit failure or connection hungup (bsc#1108474) - Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646) - fix memory leak in xen_disk (bsc#1100408) - building against xen-devel requires the XC_* compat macros to be set because this version of QEMU will be built against many versions of Xen. configure will decide on the appropriate function names it knows about today. To actually call these functions, future versions of Xen may require XC_* to be set. Furthermore, fix a bug in QEMU: xen_common.h undefines the XC_* macros unconditionally. (bsc#1100408) - Fix a condition when retry logic does not execute in case of data transmit failure or connection hungup (bsc#1108474) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-347=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-53.1 qemu-linux-user-debuginfo-2.9.1-53.1 qemu-linux-user-debugsource-2.9.1-53.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0+-53.1 qemu-seabios-1.10.2-53.1 qemu-sgabios-8-53.1 qemu-vgabios-1.10.2-53.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-53.1 qemu-arm-2.9.1-53.1 qemu-arm-debuginfo-2.9.1-53.1 qemu-block-curl-2.9.1-53.1 qemu-block-curl-debuginfo-2.9.1-53.1 qemu-block-dmg-2.9.1-53.1 qemu-block-dmg-debuginfo-2.9.1-53.1 qemu-block-iscsi-2.9.1-53.1 qemu-block-iscsi-debuginfo-2.9.1-53.1 qemu-block-rbd-2.9.1-53.1 qemu-block-rbd-debuginfo-2.9.1-53.1 qemu-block-ssh-2.9.1-53.1 qemu-block-ssh-debuginfo-2.9.1-53.1 qemu-debugsource-2.9.1-53.1 qemu-extra-2.9.1-53.1 qemu-extra-debuginfo-2.9.1-53.1 qemu-guest-agent-2.9.1-53.1 qemu-guest-agent-debuginfo-2.9.1-53.1 qemu-ksm-2.9.1-53.1 qemu-kvm-2.9.1-53.1 qemu-lang-2.9.1-53.1 qemu-ppc-2.9.1-53.1 qemu-ppc-debuginfo-2.9.1-53.1 qemu-s390-2.9.1-53.1 qemu-s390-debuginfo-2.9.1-53.1 qemu-testsuite-2.9.1-53.1 qemu-tools-2.9.1-53.1 qemu-tools-debuginfo-2.9.1-53.1 qemu-x86-2.9.1-53.1 qemu-x86-debuginfo-2.9.1-53.1 References: https://bugzilla.suse.com/1100408 https://bugzilla.suse.com/1108474 https://bugzilla.suse.com/1112646

1 0

openSUSE-SU-2019:0346-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0346-1 Rating: important References: #1122293 #1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version jdk8u201 (icedtea 3.11.0) fixes the following issues: Security issues fixed: - CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293). - CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299). Complete list of changes: https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2019-March/041223.ht ml This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-346=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-accessibility-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debugsource-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-src-1.8.0.201-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.201-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2019-2422.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299

1 0

openSUSE-SU-2019:0345-1: moderate: Security update for file
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0345-1 Rating: moderate References: #1096974 #1096984 #1126117 #1126118 #1126119 Cross-References: CVE-2018-10360 CVE-2019-8905 CVE-2019-8906 CVE-2019-8907 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for file fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10360: Fixed an out-of-bounds read in the function do_core_note in readelf.c, which allowed remote attackers to cause a denial of service (application crash) via a crafted ELF file (bsc#1096974) - CVE-2019-8905: Fixed a stack-based buffer over-read in do_core_note in readelf.c (bsc#1126118) - CVE-2019-8906: Fixed an out-of-bounds read in do_core_note in readelf. c (bsc#1126119) - CVE-2019-8907: Fixed a stack corruption in do_core_note in readelf.c (bsc#1126117) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-345=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): file-5.32-lp150.6.3.1 file-debuginfo-5.32-lp150.6.3.1 file-debugsource-5.32-lp150.6.3.1 file-devel-5.32-lp150.6.3.1 libmagic1-5.32-lp150.6.3.1 libmagic1-debuginfo-5.32-lp150.6.3.1 python2-magic-5.32-lp150.6.3.1 python3-magic-5.32-lp150.6.3.1 - openSUSE Leap 15.0 (x86_64): file-devel-32bit-5.32-lp150.6.3.1 libmagic1-32bit-5.32-lp150.6.3.1 libmagic1-32bit-debuginfo-5.32-lp150.6.3.1 - openSUSE Leap 15.0 (noarch): file-magic-5.32-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-10360.html https://www.suse.com/security/cve/CVE-2019-8905.html https://www.suse.com/security/cve/CVE-2019-8906.html https://www.suse.com/security/cve/CVE-2019-8907.html https://bugzilla.suse.com/1096974 https://bugzilla.suse.com/1096984 https://bugzilla.suse.com/1126117 https://bugzilla.suse.com/1126118 https://bugzilla.suse.com/1126119

1 0

openSUSE-SU-2019:0344-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0344-1 Rating: moderate References: #1004220 #1087320 #1120852 #1121759 #1125277 Cross-References: CVE-2019-3811 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for sssd fixes the following issues: Security vulnerability addresed: - CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759) Other bug fixes and changes: - Install logrotate configuration (bsc#1004220) - Align systemd service file with upstream, run interactive and change service type to notify (bsc#1120852) - Fix sssd not starting in foreground mode (bsc#1125277) - Strip whitespaces in netgroup triples (bsc#1087320) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-344=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): adcli-0.8.2-lp150.4.1 adcli-debuginfo-0.8.2-lp150.4.1 adcli-debugsource-0.8.2-lp150.4.1 adcli-doc-0.8.2-lp150.4.1 libipa_hbac-devel-1.16.1-lp150.2.9.1 libipa_hbac0-1.16.1-lp150.2.9.1 libipa_hbac0-debuginfo-1.16.1-lp150.2.9.1 libnfsidmap-sss-1.16.1-lp150.2.9.1 libnfsidmap-sss-debuginfo-1.16.1-lp150.2.9.1 libsss_certmap-devel-1.16.1-lp150.2.9.1 libsss_certmap0-1.16.1-lp150.2.9.1 libsss_certmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_idmap-devel-1.16.1-lp150.2.9.1 libsss_idmap0-1.16.1-lp150.2.9.1 libsss_idmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_nss_idmap-devel-1.16.1-lp150.2.9.1 libsss_nss_idmap0-1.16.1-lp150.2.9.1 libsss_nss_idmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_simpleifp-devel-1.16.1-lp150.2.9.1 libsss_simpleifp0-1.16.1-lp150.2.9.1 libsss_simpleifp0-debuginfo-1.16.1-lp150.2.9.1 python3-ipa_hbac-1.16.1-lp150.2.9.1 python3-ipa_hbac-debuginfo-1.16.1-lp150.2.9.1 python3-sss-murmur-1.16.1-lp150.2.9.1 python3-sss-murmur-debuginfo-1.16.1-lp150.2.9.1 python3-sss_nss_idmap-1.16.1-lp150.2.9.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp150.2.9.1 python3-sssd-config-1.16.1-lp150.2.9.1 python3-sssd-config-debuginfo-1.16.1-lp150.2.9.1 sssd-1.16.1-lp150.2.9.1 sssd-ad-1.16.1-lp150.2.9.1 sssd-ad-debuginfo-1.16.1-lp150.2.9.1 sssd-dbus-1.16.1-lp150.2.9.1 sssd-dbus-debuginfo-1.16.1-lp150.2.9.1 sssd-debuginfo-1.16.1-lp150.2.9.1 sssd-debugsource-1.16.1-lp150.2.9.1 sssd-ipa-1.16.1-lp150.2.9.1 sssd-ipa-debuginfo-1.16.1-lp150.2.9.1 sssd-krb5-1.16.1-lp150.2.9.1 sssd-krb5-common-1.16.1-lp150.2.9.1 sssd-krb5-common-debuginfo-1.16.1-lp150.2.9.1 sssd-krb5-debuginfo-1.16.1-lp150.2.9.1 sssd-ldap-1.16.1-lp150.2.9.1 sssd-ldap-debuginfo-1.16.1-lp150.2.9.1 sssd-proxy-1.16.1-lp150.2.9.1 sssd-proxy-debuginfo-1.16.1-lp150.2.9.1 sssd-tools-1.16.1-lp150.2.9.1 sssd-tools-debuginfo-1.16.1-lp150.2.9.1 sssd-wbclient-1.16.1-lp150.2.9.1 sssd-wbclient-debuginfo-1.16.1-lp150.2.9.1 sssd-wbclient-devel-1.16.1-lp150.2.9.1 sssd-winbind-idmap-1.16.1-lp150.2.9.1 sssd-winbind-idmap-debuginfo-1.16.1-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): sssd-32bit-1.16.1-lp150.2.9.1 sssd-32bit-debuginfo-1.16.1-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-3811.html https://bugzilla.suse.com/1004220 https://bugzilla.suse.com/1087320 https://bugzilla.suse.com/1120852 https://bugzilla.suse.com/1121759 https://bugzilla.suse.com/1125277

1 0

openSUSE-RU-2019:0340-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0340-1 Rating: moderate References: #1008352 #1013573 #1053248 #1055834 #1090884 #1098448 #1110519 #1112327 #1113712 #1119499 #1121251 #1124088 #1125327 #937555 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This update for dracut provides the following fixes: - 95iscsi: Handle qedi like bnx2i. (bsc#1113712) - 91zipl: Don't use contents of commented lines (bsc#1119499) - dracut-installkernel: Stop keeping old kernel files as .old. The .old kernel files are confusing grub2 which can't find a matching directory under /lib/modules. Furthermore, there is no guarantee that the new modules are fully compatible with the old kernel. If anything goes wrong with a new self-compiled kernel, the user can always boot back to the distribution kernel, so the .old backup files are not needed in the first place. (bsc#1112327) - 98dracut-systemd: Start systemd-vconsole-setup before dracut-cmdline-ask. (bsc#1055834) - Bring shell and all vital information to all ttys specified as console devices in emergency mode. (fate#325386, bsc#1053248, bsc#937555) - Fix displaying text on emergency consoles. (bsc#1124088) - Remove invalid "FONT_MAP=none" from vconsole.conf. (bsc#1013573) - Fix a missing space in example configs. (bsc#1121251) - Fix saving dumps to zFCP attached SCSI disks. (bsc#1008352) - Mark the DASD udev rules host-only and handle backslashes in paths for hostonly files. (bsc#1090884) - Add nfit module. (bsc#1110519) - Add a fix to override ACPI tables via initrd, a kernel config variable changed name. (bsc#1098448) - purge-kernels: Avoid endless loop when uninstalling kernels that depend on KMPs which in themselves depend on other packages (bsc#1125327) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-340=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dracut-044.1-35.2 dracut-debuginfo-044.1-35.2 dracut-debugsource-044.1-35.2 dracut-fips-044.1-35.2 dracut-tools-044.1-35.2 References: https://bugzilla.suse.com/1008352 https://bugzilla.suse.com/1013573 https://bugzilla.suse.com/1053248 https://bugzilla.suse.com/1055834 https://bugzilla.suse.com/1090884 https://bugzilla.suse.com/1098448 https://bugzilla.suse.com/1110519 https://bugzilla.suse.com/1112327 https://bugzilla.suse.com/1113712 https://bugzilla.suse.com/1119499 https://bugzilla.suse.com/1121251 https://bugzilla.suse.com/1124088 https://bugzilla.suse.com/1125327 https://bugzilla.suse.com/937555

1 0

openSUSE-RU-2019:0338-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0338-1 Rating: moderate References: #1125327 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dracut fixes the following issues: - purge-kernels: Avoid endless loop when uninstalling kernels that depend on KMPs which in themselves depend on other packages (bsc#1125327) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-338=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-044.1-lp150.14.19.1 dracut-debuginfo-044.1-lp150.14.19.1 dracut-debugsource-044.1-lp150.14.19.1 dracut-fips-044.1-lp150.14.19.1 dracut-ima-044.1-lp150.14.19.1 dracut-tools-044.1-lp150.14.19.1 References: https://bugzilla.suse.com/1125327

1 0