March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0343-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0343-1 Rating: important References: #1129059 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for chromium to version 73.0.3683.75 fixes the following issues: Security issues fixed (bsc#1129059): - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap buffer overflow in V8. - CVE-2019-5791: Fixed a type confusion in V8. - CVE-2019-5792: Fixed an integer overflow in PDFium. - CVE-2019-5793: Fixed excessive permissions for private API in Extensions. - CVE-2019-5794: Fixed security UI spoofing. - CVE-2019-5795: Fixed an integer overflow in PDFium. - CVE-2019-5796: Fixed a race condition in Extensions. - CVE-2019-5797: Fixed a race condition in DOMStorage. - CVE-2019-5798: Fixed an out of bounds read in Skia. - CVE-2019-5799: Fixed a CSP bypass with blob URL. - CVE-2019-5800: Fixed a CSP bypass with blob URL. - CVE-2019-5801: Fixed an incorrect Omnibox display on iOS. - CVE-2019-5802: Fixed security UI spoofing. - CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'. - CVE-2019-5804: Fixed a command line injection on Windows. Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des ktop_12.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-343=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-73.0.3683.75-205.1 chromedriver-debuginfo-73.0.3683.75-205.1 chromium-73.0.3683.75-205.1 chromium-debuginfo-73.0.3683.75-205.1 chromium-debugsource-73.0.3683.75-205.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://bugzilla.suse.com/1129059

1 0

openSUSE-RU-2019:0342-1: Recommended update for gnome-settings-daemon
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for gnome-settings-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0342-1 Rating: low References: #1029083 #1056289 #1063826 #1067288 #1077412 #1086496 #990470 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for gnome-settings-daemon provides the following fixes: - Fix update notification not showing when patches have conflicts. (bsc#1063826) - Switch new user's default input engine from "anthy" to "mozc" in gnome-desktop with Japanese language and ibus input framework. (bsc#1056289, bsc#1067288, bsc#1029083) - Make it possible to wake up the screen using a touch screen input. (bsc#1086496) - Fix two finger scroll gesture support. (bsc#1077412, bsc#990470) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-342=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnome-settings-daemon-3.20.1-20.2 gnome-settings-daemon-debuginfo-3.20.1-20.2 gnome-settings-daemon-debugsource-3.20.1-20.2 gnome-settings-daemon-devel-3.20.1-20.2 - openSUSE Leap 42.3 (noarch): gnome-settings-daemon-lang-3.20.1-20.2 References: https://bugzilla.suse.com/1029083 https://bugzilla.suse.com/1056289 https://bugzilla.suse.com/1063826 https://bugzilla.suse.com/1067288 https://bugzilla.suse.com/1077412 https://bugzilla.suse.com/1086496 https://bugzilla.suse.com/990470

1 0

openSUSE-RU-2019:0341-1: moderate: Recommended update for konsole
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for konsole ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0341-1 Rating: moderate References: #1095022 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for konsole fixes the following issues: - Fixed problems with rendering text in bold (boo#1095022) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-341=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-341=1 Package List: - openSUSE Leap 15.0 (noarch): konsole-part-lang-17.12.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): konsole-17.12.3-lp150.2.3.1 konsole-debuginfo-17.12.3-lp150.2.3.1 konsole-debugsource-17.12.3-lp150.2.3.1 konsole-part-17.12.3-lp150.2.3.1 konsole-part-debuginfo-17.12.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): konsole-17.12.3-bp150.3.3.1 konsole-part-17.12.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): konsole-part-lang-17.12.3-bp150.3.3.1 References: https://bugzilla.suse.com/1095022

1 0

openSUSE-RU-2019:0339-1: Recommended update for NetworkManager
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0339-1 Rating: low References: #1019813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager fixes the following issues: - Drop previous patch that has side effects when geoclue is not installed. (bsc#1019813) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-339=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): NetworkManager-1.0.12-7.6.1 NetworkManager-debuginfo-1.0.12-7.6.1 NetworkManager-debugsource-1.0.12-7.6.1 NetworkManager-devel-1.0.12-7.6.1 libnm-glib-vpn1-1.0.12-7.6.1 libnm-glib-vpn1-debuginfo-1.0.12-7.6.1 libnm-glib4-1.0.12-7.6.1 libnm-glib4-debuginfo-1.0.12-7.6.1 libnm-util2-1.0.12-7.6.1 libnm-util2-debuginfo-1.0.12-7.6.1 libnm0-1.0.12-7.6.1 libnm0-debuginfo-1.0.12-7.6.1 typelib-1_0-NM-1_0-1.0.12-7.6.1 typelib-1_0-NMClient-1_0-1.0.12-7.6.1 typelib-1_0-NetworkManager-1_0-1.0.12-7.6.1 - openSUSE Leap 42.3 (noarch): NetworkManager-branding-upstream-1.0.12-7.6.1 NetworkManager-lang-1.0.12-7.6.1 - openSUSE Leap 42.3 (x86_64): NetworkManager-devel-32bit-1.0.12-7.6.1 libnm-glib-vpn1-32bit-1.0.12-7.6.1 libnm-glib-vpn1-debuginfo-32bit-1.0.12-7.6.1 libnm-glib4-32bit-1.0.12-7.6.1 libnm-glib4-debuginfo-32bit-1.0.12-7.6.1 libnm-util2-32bit-1.0.12-7.6.1 libnm-util2-debuginfo-32bit-1.0.12-7.6.1 References: https://bugzilla.suse.com/1019813

1 0

openSUSE-RU-2019:0333-1: moderate: Recommended update for arpwatch
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for arpwatch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0333-1 Rating: moderate References: #1119851 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for arpwatch provides the following fix: - Prevent a memory leak in gethname. (bsc#1119851) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-333=1 Package List: - openSUSE Leap 15.0 (x86_64): arpwatch-2.1a15-lp150.3.3.1 arpwatch-debuginfo-2.1a15-lp150.3.3.1 arpwatch-debugsource-2.1a15-lp150.3.3.1 arpwatch-ethercodes-build-2.1a15-lp150.3.3.1 References: https://bugzilla.suse.com/1119851

1 0

openSUSE-RU-2019:0336-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0336-1 Rating: moderate References: #1084379 #1103354 #1111286 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for nvme-cli fixes the following issues: - fabrics: allow nr_io/write/poll_queues and queue size to discovery (bsc#1084379) - fabrics: do not use 'queue_size' and 'nr_io_queues' for discovery controller (bsc#1111286) - fabrics: mask out invalid options during discovery (bsc#1111286) - nvme: Document '-Q' and '-i' for discovery and connect-all - Add 71-nvme-iopolicy-netapp.rules (bsc1124564) - Add FC-NVMe autoconnect scripts (bsc#1103354) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-336=1 Package List: - openSUSE Leap 15.0 (x86_64): nvme-cli-1.5-lp150.6.9.1 nvme-cli-debuginfo-1.5-lp150.6.9.1 nvme-cli-debugsource-1.5-lp150.6.9.1 References: https://bugzilla.suse.com/1084379 https://bugzilla.suse.com/1103354 https://bugzilla.suse.com/1111286

1 0

openSUSE-RU-2019:0330-1: moderate: Recommended update for supportutils
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0330-1 Rating: moderate References: #1094225 #1109664 #1120049 #1121043 #1127063 #1127069 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Dont show error if /proc/fb is not present (bsc#1127069) - Fixed issue where dasdview got called with wrong arguments (bsc#1109664) - Clarified -t argument description in help output (bsc#1121043) - Fixed grep error in NTP when /etc/cron.d is empty (bsc#1127063) - Collect systemd journal logs with minimum installation (bsc#1094225) - Fixed tar file generation (bsc#1120049) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-330=1 Package List: - openSUSE Leap 15.0 (noarch): supportutils-3.1.1-lp150.4.6.1 References: https://bugzilla.suse.com/1094225 https://bugzilla.suse.com/1109664 https://bugzilla.suse.com/1120049 https://bugzilla.suse.com/1121043 https://bugzilla.suse.com/1127063 https://bugzilla.suse.com/1127069

1 0

openSUSE-RU-2019:0331-1: moderate: Recommended update for python-boto
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for python-boto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0331-1 Rating: moderate References: #1116204 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-boto fixes the following issues: python-boto was updated to version 2.49.0: * Import the latest CA Bundle from certifi (:issue:`3818`, :sha:`e4699cba`) * Fix to support uploads to KMS-encrypted buckets. (:issue:`3800`, :sha:`0a1d9040`) * Support fetching GCS bucket encryption metadata. (:issue:`3799`, :sha:`132b64d2`) * Update layer1.py (:issue:`3765`, :sha:`53340159`) * Fix tests/unit/glacier/test_writer.py to make work with pypy. (:issue:`3762`, :sha:`8402c5d6`) * Removed the upstream builtin root certificate data for trusted CAs, as SUSE ships them seperately. (bsc#1116204) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-331=1 Package List: - openSUSE Leap 15.0 (noarch): python2-boto-2.49.0-lp150.3.3.1 python3-boto-2.49.0-lp150.3.3.1 References: https://bugzilla.suse.com/1116204

1 0

openSUSE-RU-2019:0337-1: moderate: Recommended update for unar
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for unar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0337-1 Rating: moderate References: #1110754 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for unar provides the following fix: - Add support for RAR self-extracting (SFX) archives. (bsc#1110754) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-337=1 Package List: - openSUSE Leap 15.0 (x86_64): unar-1.10.1-lp150.4.3.1 unar-debuginfo-1.10.1-lp150.4.3.1 unar-debugsource-1.10.1-lp150.4.3.1 References: https://bugzilla.suse.com/1110754

1 0

openSUSE-RU-2019:0332-1: moderate: Recommended update for bind
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0332-1 Rating: moderate References: #1094236 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bind fixes the following issues: - Fixes dynamic DNS updates against samba and Microsoft DNS servers (bsc#1094236). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-332=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bind-9.11.2-lp150.8.9.1 bind-chrootenv-9.11.2-lp150.8.9.1 bind-debuginfo-9.11.2-lp150.8.9.1 bind-debugsource-9.11.2-lp150.8.9.1 bind-devel-9.11.2-lp150.8.9.1 bind-lwresd-9.11.2-lp150.8.9.1 bind-lwresd-debuginfo-9.11.2-lp150.8.9.1 bind-utils-9.11.2-lp150.8.9.1 bind-utils-debuginfo-9.11.2-lp150.8.9.1 libbind9-160-9.11.2-lp150.8.9.1 libbind9-160-debuginfo-9.11.2-lp150.8.9.1 libdns169-9.11.2-lp150.8.9.1 libdns169-debuginfo-9.11.2-lp150.8.9.1 libirs-devel-9.11.2-lp150.8.9.1 libirs160-9.11.2-lp150.8.9.1 libirs160-debuginfo-9.11.2-lp150.8.9.1 libisc166-9.11.2-lp150.8.9.1 libisc166-debuginfo-9.11.2-lp150.8.9.1 libisccc160-9.11.2-lp150.8.9.1 libisccc160-debuginfo-9.11.2-lp150.8.9.1 libisccfg160-9.11.2-lp150.8.9.1 libisccfg160-debuginfo-9.11.2-lp150.8.9.1 liblwres160-9.11.2-lp150.8.9.1 liblwres160-debuginfo-9.11.2-lp150.8.9.1 - openSUSE Leap 15.0 (noarch): bind-doc-9.11.2-lp150.8.9.1 python3-bind-9.11.2-lp150.8.9.1 - openSUSE Leap 15.0 (x86_64): bind-devel-32bit-9.11.2-lp150.8.9.1 libbind9-160-32bit-9.11.2-lp150.8.9.1 libbind9-160-32bit-debuginfo-9.11.2-lp150.8.9.1 libdns169-32bit-9.11.2-lp150.8.9.1 libdns169-32bit-debuginfo-9.11.2-lp150.8.9.1 libirs160-32bit-9.11.2-lp150.8.9.1 libirs160-32bit-debuginfo-9.11.2-lp150.8.9.1 libisc166-32bit-9.11.2-lp150.8.9.1 libisc166-32bit-debuginfo-9.11.2-lp150.8.9.1 libisccc160-32bit-9.11.2-lp150.8.9.1 libisccc160-32bit-debuginfo-9.11.2-lp150.8.9.1 libisccfg160-32bit-9.11.2-lp150.8.9.1 libisccfg160-32bit-debuginfo-9.11.2-lp150.8.9.1 liblwres160-32bit-9.11.2-lp150.8.9.1 liblwres160-32bit-debuginfo-9.11.2-lp150.8.9.1 References: https://bugzilla.suse.com/1094236

1 0

openSUSE-RU-2019:0334-1: moderate: Recommended update for libtirpc
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for libtirpc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0334-1 Rating: moderate References: #1120689 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libtirpc fixes the following issues: - Adds a new option to enforce connection via protocol version 2 first (bsc#1120689) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-334=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtirpc-debugsource-1.0.1-5.6.1 libtirpc-devel-1.0.1-5.6.1 libtirpc-netconfig-1.0.1-5.6.1 libtirpc3-1.0.1-5.6.1 libtirpc3-debuginfo-1.0.1-5.6.1 - openSUSE Leap 42.3 (x86_64): libtirpc3-32bit-1.0.1-5.6.1 libtirpc3-debuginfo-32bit-1.0.1-5.6.1 References: https://bugzilla.suse.com/1120689

1 0

openSUSE-RU-2019:0335-1: moderate: Recommended update for cups
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for cups ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0335-1 Rating: moderate References: #1118118 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups fixes the following issues: - Fixed a cups crash when using utf8 filenames (bsc#1118118) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-335=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cups-1.7.5-12.12.1 cups-client-1.7.5-12.12.1 cups-client-debuginfo-1.7.5-12.12.1 cups-ddk-1.7.5-12.12.1 cups-ddk-debuginfo-1.7.5-12.12.1 cups-debuginfo-1.7.5-12.12.1 cups-debugsource-1.7.5-12.12.1 cups-devel-1.7.5-12.12.1 cups-libs-1.7.5-12.12.1 cups-libs-debuginfo-1.7.5-12.12.1 - openSUSE Leap 42.3 (x86_64): cups-libs-32bit-1.7.5-12.12.1 cups-libs-debuginfo-32bit-1.7.5-12.12.1 References: https://bugzilla.suse.com/1118118

1 0

openSUSE-SU-2019:0329-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0329-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-329=1 Package List: - openSUSE Backports SLE-15 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944

1 0

openSUSE-SU-2019:0328-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0328-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-328=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libcomps-devel-0.1.8-bp150.3.3.1 libcomps0_1_6-0.1.8-bp150.3.3.1 python2-libcomps-0.1.8-bp150.3.3.1 python3-libcomps-0.1.8-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libcomps-doc-0.1.8-bp150.3.3.1 python-libcomps-doc-0.1.8-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841

1 0

openSUSE-SU-2019:0325-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0325-1 Rating: important References: #1085416 #1087240 #1103557 #1104918 #1112028 #1116708 #1117963 #1117964 #1117965 #1117966 #1117967 #1120507 Cross-References: CVE-2018-0886 CVE-2018-1000852 CVE-2018-8784 CVE-2018-8785 CVE-2018-8786 CVE-2018-8787 CVE-2018-8788 CVE-2018-8789 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has four fixes is now available. Description: This update for freerdp to version 2.0.0~rc4 fixes the following issues: Security issues fixed: - CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918) - CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965) - CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967) - CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966) - CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964) - CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963) - CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708) - CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507) Other issues: - Upgraded to version 2.0.0-rc4 (FATE#326739) - Security and stability improvements, including bsc#1103557 and bsc#1112028 - gateway: multiple fixes and improvements - client/X11: support for rail (remote app) icons was added - The licensing code was re-worked: Per-device licenses are now saved on the client and used on re-connect: WARNING: this is a change in FreeRDP behavior regarding licensing. If the old behavior is required, or no licenses should be saved use the new command line option +old-license (gh#/FreeRDP/FreeRDP#4979) - Improved order handling - only orders that were enable during capability exchange are accepted. WARNING and NOTE: some servers do improperly send orders that weren't negotiated, for such cases the new command line option /relax-order-checks was added to disable the strict order checking. If connecting to xrdp the options /relax-order-checks *and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926) - Fixed automount issues - Fixed several audio and microphone related issues - Fixed X11 Right-Ctrl ungrab feature - Fixed race condition in rdpsnd channel server. - Disabled SSE2 for ARM and powerpc This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-325=1 Package List: - openSUSE Leap 15.0 (x86_64): freerdp-2.0.0~rc4-lp150.2.3.1 freerdp-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-debugsource-2.0.0~rc4-lp150.2.3.1 freerdp-devel-2.0.0~rc4-lp150.2.3.1 freerdp-server-2.0.0~rc4-lp150.2.3.1 freerdp-server-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp150.2.3.1 libfreerdp2-2.0.0~rc4-lp150.2.3.1 libfreerdp2-debuginfo-2.0.0~rc4-lp150.2.3.1 libuwac0-0-2.0.0~rc4-lp150.2.3.1 libuwac0-0-debuginfo-2.0.0~rc4-lp150.2.3.1 libwinpr2-2.0.0~rc4-lp150.2.3.1 libwinpr2-debuginfo-2.0.0~rc4-lp150.2.3.1 uwac0-0-devel-2.0.0~rc4-lp150.2.3.1 winpr2-devel-2.0.0~rc4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0886.html https://www.suse.com/security/cve/CVE-2018-1000852.html https://www.suse.com/security/cve/CVE-2018-8784.html https://www.suse.com/security/cve/CVE-2018-8785.html https://www.suse.com/security/cve/CVE-2018-8786.html https://www.suse.com/security/cve/CVE-2018-8787.html https://www.suse.com/security/cve/CVE-2018-8788.html https://www.suse.com/security/cve/CVE-2018-8789.html https://bugzilla.suse.com/1085416 https://bugzilla.suse.com/1087240 https://bugzilla.suse.com/1103557 https://bugzilla.suse.com/1104918 https://bugzilla.suse.com/1112028 https://bugzilla.suse.com/1116708 https://bugzilla.suse.com/1117963 https://bugzilla.suse.com/1117964 https://bugzilla.suse.com/1117965 https://bugzilla.suse.com/1117966 https://bugzilla.suse.com/1117967 https://bugzilla.suse.com/1120507

1 0

openSUSE-SU-2019:0327-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0327-1 Rating: important References: #1013882 #1101676 #1101677 #1101678 #1103342 #1111858 #1111859 #1112368 #1112377 #1112384 #1112386 #1112391 #1112397 #1112404 #1112415 #1112417 #1112421 #1112432 #1112767 #1116686 #1118754 #1120041 #1122198 #1122475 #1127027 Cross-References: CVE-2016-9843 CVE-2018-3058 CVE-2018-3060 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066 CVE-2018-3143 CVE-2018-3156 CVE-2018-3162 CVE-2018-3173 CVE-2018-3174 CVE-2018-3185 CVE-2018-3200 CVE-2018-3251 CVE-2018-3277 CVE-2018-3282 CVE-2018-3284 CVE-2019-2510 CVE-2019-2537 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has 6 fixes is now available. Description: This update for mariadb to version 10.2.22 fixes the following issues: Security issues fixed: - CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377) - CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432) - CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391) - CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397) - CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404) - CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384) - CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368) - CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386) - CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415) - CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417) - CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421) - CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678) - CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342) - CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677) - CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676) - CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882) Non-security issues fixed: - Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027). - Fixed an issue where the lograte was not working (bsc#1112767). - Backport Information Schema CHECK_CONSTRAINTS Table. - Maximum value of table_definition_cache is now 2097152. - InnoDB ALTER TABLE fixes. - Galera crash recovery fixes. - Encryption fixes. - Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475). - Maria DB testsuite - test main.plugin_auth failed (bsc#1111859) - Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858) - Remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - Database corruption after renaming a prefix-indexed column (bsc#1120041) Release notes and changelog: - https://mariadb.com/kb/en/library/mariadb-10222-release-notes - https://mariadb.com/kb/en/library/mariadb-10222-changelog/ This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-327=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmysqld-devel-10.2.22-lp150.2.9.1 libmysqld19-10.2.22-lp150.2.9.1 libmysqld19-debuginfo-10.2.22-lp150.2.9.1 mariadb-10.2.22-lp150.2.9.1 mariadb-bench-10.2.22-lp150.2.9.1 mariadb-bench-debuginfo-10.2.22-lp150.2.9.1 mariadb-client-10.2.22-lp150.2.9.1 mariadb-client-debuginfo-10.2.22-lp150.2.9.1 mariadb-debuginfo-10.2.22-lp150.2.9.1 mariadb-debugsource-10.2.22-lp150.2.9.1 mariadb-galera-10.2.22-lp150.2.9.1 mariadb-test-10.2.22-lp150.2.9.1 mariadb-test-debuginfo-10.2.22-lp150.2.9.1 mariadb-tools-10.2.22-lp150.2.9.1 mariadb-tools-debuginfo-10.2.22-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.22-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2018-3058.html https://www.suse.com/security/cve/CVE-2018-3060.html https://www.suse.com/security/cve/CVE-2018-3063.html https://www.suse.com/security/cve/CVE-2018-3064.html https://www.suse.com/security/cve/CVE-2018-3066.html https://www.suse.com/security/cve/CVE-2018-3143.html https://www.suse.com/security/cve/CVE-2018-3156.html https://www.suse.com/security/cve/CVE-2018-3162.html https://www.suse.com/security/cve/CVE-2018-3173.html https://www.suse.com/security/cve/CVE-2018-3174.html https://www.suse.com/security/cve/CVE-2018-3185.html https://www.suse.com/security/cve/CVE-2018-3200.html https://www.suse.com/security/cve/CVE-2018-3251.html https://www.suse.com/security/cve/CVE-2018-3277.html https://www.suse.com/security/cve/CVE-2018-3282.html https://www.suse.com/security/cve/CVE-2018-3284.html https://www.suse.com/security/cve/CVE-2019-2510.html https://www.suse.com/security/cve/CVE-2019-2537.html https://bugzilla.suse.com/1013882 https://bugzilla.suse.com/1101676 https://bugzilla.suse.com/1101677 https://bugzilla.suse.com/1101678 https://bugzilla.suse.com/1103342 https://bugzilla.suse.com/1111858 https://bugzilla.suse.com/1111859 https://bugzilla.suse.com/1112368 https://bugzilla.suse.com/1112377 https://bugzilla.suse.com/1112384 https://bugzilla.suse.com/1112386 https://bugzilla.suse.com/1112391 https://bugzilla.suse.com/1112397 https://bugzilla.suse.com/1112404 https://bugzilla.suse.com/1112415 https://bugzilla.suse.com/1112417 https://bugzilla.suse.com/1112421 https://bugzilla.suse.com/1112432 https://bugzilla.suse.com/1112767 https://bugzilla.suse.com/1116686 https://bugzilla.suse.com/1118754 https://bugzilla.suse.com/1120041 https://bugzilla.suse.com/1122198 https://bugzilla.suse.com/1122475 https://bugzilla.suse.com/1127027

1 0

openSUSE-SU-2019:0326-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0326-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-326=1 Package List: - openSUSE Leap 15.0 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944

1 0

openSUSE-RU-2019:0324-1: moderate: Recommended update for libreoffice
by maintenance＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Recommended Update: Recommended update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0324-1 Rating: moderate References: #1079744 #1088266 #1095755 #1107012 #1110345 #1110348 #1112112 #1112113 #1112114 #1117195 #1117300 #1124658 #882383 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for libreoffice fixes the following issues: LibreOffice was updated to the 6.1.5.2 release, containing lots of bugfixes. Various improvements to PPTX were also done: - SmartArt: Basic rendering of the Organizational Chart (bsc#1112114) - SmartArt: Basic rendering of Accent Process and Continuous Block Process (bsc#1112113) - Chart in PPTX lacks color and is too large (bsc#882383) - SmartArt: Basic rendering of several list types (bsc#1112112) - Charts having weird/darker/ugly background versus Office 365 and strange artefacts where overlapping (bsc#1110348) - Text on arc feature, export to PPTX (bsc#1088266) - PPTX Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1095755) - Chart showing numbers with post-comma digits versus rounded with Office 365 (bsc#1110345) - Font sizes and text position way off (too small,...) (bsc#1107012) Additional fixes: - [DATA LOSS] Saving a new document can silently (bsc#1117300) - Install also C++ libreofficekit headers (bsc#1117195) - unoil.jar does not contain any content in LibreOffice 5.4.4.2 update (bsc#1079744) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-324=1 Package List: - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.1.5.2-30.3 libreoffice-gdb-pretty-printers-6.1.5.2-30.3 libreoffice-glade-6.1.5.2-30.3 libreoffice-icon-themes-6.1.5.2-30.3 libreoffice-l10n-af-6.1.5.2-30.3 libreoffice-l10n-am-6.1.5.2-30.3 libreoffice-l10n-ar-6.1.5.2-30.3 libreoffice-l10n-as-6.1.5.2-30.3 libreoffice-l10n-ast-6.1.5.2-30.3 libreoffice-l10n-be-6.1.5.2-30.3 libreoffice-l10n-bg-6.1.5.2-30.3 libreoffice-l10n-bn-6.1.5.2-30.3 libreoffice-l10n-bn_IN-6.1.5.2-30.3 libreoffice-l10n-bo-6.1.5.2-30.3 libreoffice-l10n-br-6.1.5.2-30.3 libreoffice-l10n-brx-6.1.5.2-30.3 libreoffice-l10n-bs-6.1.5.2-30.3 libreoffice-l10n-ca-6.1.5.2-30.3 libreoffice-l10n-ca_valencia-6.1.5.2-30.3 libreoffice-l10n-cs-6.1.5.2-30.3 libreoffice-l10n-cy-6.1.5.2-30.3 libreoffice-l10n-da-6.1.5.2-30.3 libreoffice-l10n-de-6.1.5.2-30.3 libreoffice-l10n-dgo-6.1.5.2-30.3 libreoffice-l10n-dz-6.1.5.2-30.3 libreoffice-l10n-el-6.1.5.2-30.3 libreoffice-l10n-en-6.1.5.2-30.3 libreoffice-l10n-en_GB-6.1.5.2-30.3 libreoffice-l10n-en_ZA-6.1.5.2-30.3 libreoffice-l10n-eo-6.1.5.2-30.3 libreoffice-l10n-es-6.1.5.2-30.3 libreoffice-l10n-et-6.1.5.2-30.3 libreoffice-l10n-eu-6.1.5.2-30.3 libreoffice-l10n-fa-6.1.5.2-30.3 libreoffice-l10n-fi-6.1.5.2-30.3 libreoffice-l10n-fr-6.1.5.2-30.3 libreoffice-l10n-fy-6.1.5.2-30.3 libreoffice-l10n-ga-6.1.5.2-30.3 libreoffice-l10n-gd-6.1.5.2-30.3 libreoffice-l10n-gl-6.1.5.2-30.3 libreoffice-l10n-gu-6.1.5.2-30.3 libreoffice-l10n-gug-6.1.5.2-30.3 libreoffice-l10n-he-6.1.5.2-30.3 libreoffice-l10n-hi-6.1.5.2-30.3 libreoffice-l10n-hr-6.1.5.2-30.3 libreoffice-l10n-hsb-6.1.5.2-30.3 libreoffice-l10n-hu-6.1.5.2-30.3 libreoffice-l10n-id-6.1.5.2-30.3 libreoffice-l10n-is-6.1.5.2-30.3 libreoffice-l10n-it-6.1.5.2-30.3 libreoffice-l10n-ja-6.1.5.2-30.3 libreoffice-l10n-ka-6.1.5.2-30.3 libreoffice-l10n-kab-6.1.5.2-30.3 libreoffice-l10n-kk-6.1.5.2-30.3 libreoffice-l10n-km-6.1.5.2-30.3 libreoffice-l10n-kmr_Latn-6.1.5.2-30.3 libreoffice-l10n-kn-6.1.5.2-30.3 libreoffice-l10n-ko-6.1.5.2-30.3 libreoffice-l10n-kok-6.1.5.2-30.3 libreoffice-l10n-ks-6.1.5.2-30.3 libreoffice-l10n-lb-6.1.5.2-30.3 libreoffice-l10n-lo-6.1.5.2-30.3 libreoffice-l10n-lt-6.1.5.2-30.3 libreoffice-l10n-lv-6.1.5.2-30.3 libreoffice-l10n-mai-6.1.5.2-30.3 libreoffice-l10n-mk-6.1.5.2-30.3 libreoffice-l10n-ml-6.1.5.2-30.3 libreoffice-l10n-mn-6.1.5.2-30.3 libreoffice-l10n-mni-6.1.5.2-30.3 libreoffice-l10n-mr-6.1.5.2-30.3 libreoffice-l10n-my-6.1.5.2-30.3 libreoffice-l10n-nb-6.1.5.2-30.3 libreoffice-l10n-ne-6.1.5.2-30.3 libreoffice-l10n-nl-6.1.5.2-30.3 libreoffice-l10n-nn-6.1.5.2-30.3 libreoffice-l10n-nr-6.1.5.2-30.3 libreoffice-l10n-nso-6.1.5.2-30.3 libreoffice-l10n-oc-6.1.5.2-30.3 libreoffice-l10n-om-6.1.5.2-30.3 libreoffice-l10n-or-6.1.5.2-30.3 libreoffice-l10n-pa-6.1.5.2-30.3 libreoffice-l10n-pl-6.1.5.2-30.3 libreoffice-l10n-pt_BR-6.1.5.2-30.3 libreoffice-l10n-pt_PT-6.1.5.2-30.3 libreoffice-l10n-ro-6.1.5.2-30.3 libreoffice-l10n-ru-6.1.5.2-30.3 libreoffice-l10n-rw-6.1.5.2-30.3 libreoffice-l10n-sa_IN-6.1.5.2-30.3 libreoffice-l10n-sat-6.1.5.2-30.3 libreoffice-l10n-sd-6.1.5.2-30.3 libreoffice-l10n-si-6.1.5.2-30.3 libreoffice-l10n-sid-6.1.5.2-30.3 libreoffice-l10n-sk-6.1.5.2-30.3 libreoffice-l10n-sl-6.1.5.2-30.3 libreoffice-l10n-sq-6.1.5.2-30.3 libreoffice-l10n-sr-6.1.5.2-30.3 libreoffice-l10n-ss-6.1.5.2-30.3 libreoffice-l10n-st-6.1.5.2-30.3 libreoffice-l10n-sv-6.1.5.2-30.3 libreoffice-l10n-sw_TZ-6.1.5.2-30.3 libreoffice-l10n-ta-6.1.5.2-30.3 libreoffice-l10n-te-6.1.5.2-30.3 libreoffice-l10n-tg-6.1.5.2-30.3 libreoffice-l10n-th-6.1.5.2-30.3 libreoffice-l10n-tn-6.1.5.2-30.3 libreoffice-l10n-tr-6.1.5.2-30.3 libreoffice-l10n-ts-6.1.5.2-30.3 libreoffice-l10n-tt-6.1.5.2-30.3 libreoffice-l10n-ug-6.1.5.2-30.3 libreoffice-l10n-uk-6.1.5.2-30.3 libreoffice-l10n-uz-6.1.5.2-30.3 libreoffice-l10n-ve-6.1.5.2-30.3 libreoffice-l10n-vec-6.1.5.2-30.3 libreoffice-l10n-vi-6.1.5.2-30.3 libreoffice-l10n-xh-6.1.5.2-30.3 libreoffice-l10n-zh_CN-6.1.5.2-30.3 libreoffice-l10n-zh_TW-6.1.5.2-30.3 libreoffice-l10n-zu-6.1.5.2-30.3 - openSUSE Leap 42.3 (x86_64): libreoffice-6.1.5.2-30.3 libreoffice-base-6.1.5.2-30.3 libreoffice-base-debuginfo-6.1.5.2-30.3 libreoffice-base-drivers-postgresql-6.1.5.2-30.3 libreoffice-base-drivers-postgresql-debuginfo-6.1.5.2-30.3 libreoffice-calc-6.1.5.2-30.3 libreoffice-calc-debuginfo-6.1.5.2-30.3 libreoffice-calc-extensions-6.1.5.2-30.3 libreoffice-debuginfo-6.1.5.2-30.3 libreoffice-debugsource-6.1.5.2-30.3 libreoffice-draw-6.1.5.2-30.3 libreoffice-draw-debuginfo-6.1.5.2-30.3 libreoffice-filters-optional-6.1.5.2-30.3 libreoffice-gnome-6.1.5.2-30.3 libreoffice-gnome-debuginfo-6.1.5.2-30.3 libreoffice-gtk2-6.1.5.2-30.3 libreoffice-gtk2-debuginfo-6.1.5.2-30.3 libreoffice-gtk3-6.1.5.2-30.3 libreoffice-gtk3-debuginfo-6.1.5.2-30.3 libreoffice-impress-6.1.5.2-30.3 libreoffice-impress-debuginfo-6.1.5.2-30.3 libreoffice-mailmerge-6.1.5.2-30.3 libreoffice-math-6.1.5.2-30.3 libreoffice-math-debuginfo-6.1.5.2-30.3 libreoffice-officebean-6.1.5.2-30.3 libreoffice-officebean-debuginfo-6.1.5.2-30.3 libreoffice-pyuno-6.1.5.2-30.3 libreoffice-pyuno-debuginfo-6.1.5.2-30.3 libreoffice-qt5-6.1.5.2-30.3 libreoffice-qt5-debuginfo-6.1.5.2-30.3 libreoffice-sdk-6.1.5.2-30.3 libreoffice-sdk-debuginfo-6.1.5.2-30.3 libreoffice-sdk-doc-6.1.5.2-30.3 libreoffice-writer-6.1.5.2-30.3 libreoffice-writer-debuginfo-6.1.5.2-30.3 libreoffice-writer-extensions-6.1.5.2-30.3 libreofficekit-6.1.5.2-30.3 libreofficekit-devel-6.1.5.2-30.3 References: https://bugzilla.suse.com/1079744 https://bugzilla.suse.com/1088266 https://bugzilla.suse.com/1095755 https://bugzilla.suse.com/1107012 https://bugzilla.suse.com/1110345 https://bugzilla.suse.com/1110348 https://bugzilla.suse.com/1112112 https://bugzilla.suse.com/1112113 https://bugzilla.suse.com/1112114 https://bugzilla.suse.com/1117195 https://bugzilla.suse.com/1117300 https://bugzilla.suse.com/1124658 https://bugzilla.suse.com/882383

1 0

openSUSE-SU-2019:0323-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 11 Mar '19

11 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0323-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-323=1 Package List: - openSUSE Leap 15.0 (noarch): libcomps-doc-0.1.8-lp150.2.3.1 python-libcomps-doc-0.1.8-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcomps-debuginfo-0.1.8-lp150.2.3.1 libcomps-debugsource-0.1.8-lp150.2.3.1 libcomps-devel-0.1.8-lp150.2.3.1 libcomps0_1_6-0.1.8-lp150.2.3.1 libcomps0_1_6-debuginfo-0.1.8-lp150.2.3.1 python2-libcomps-0.1.8-lp150.2.3.1 python2-libcomps-debuginfo-0.1.8-lp150.2.3.1 python3-libcomps-0.1.8-lp150.2.3.1 python3-libcomps-debuginfo-0.1.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841

1 0

openSUSE-SU-2019:0322-1: important: Security update for hiawatha
by opensuse-security＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Security Update: Security update for hiawatha ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0322-1 Rating: important References: #1125751 Cross-References: CVE-2019-8358 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiawatha to version 10.8.4 fixes the following issue: Security issue fixed: - CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal when AllowDotFiles was enabled (bsc#1125751). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-322=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hiawatha-10.8.4-bp150.3.3.1 hiawatha-letsencrypt-10.8.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-8358.html https://bugzilla.suse.com/1125751

1 0

openSUSE-RU-2019:0313-1: moderate: Recommended update for unar
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for unar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0313-1 Rating: moderate References: #1110754 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for unar fixes the following issues: - Support RAR self-extracting (SFX) archives [boo#1110754] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-313=1 Package List: - openSUSE Leap 42.3 (x86_64): unar-1.10.1-2.3.1 unar-debuginfo-1.10.1-2.3.1 unar-debugsource-1.10.1-2.3.1 References: https://bugzilla.suse.com/1110754

1 0

openSUSE-RU-2019:0319-1: moderate: Recommended update for permissions
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0319-1 Rating: moderate References: #1120650 #1123886 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for permissions fixes the following issues: - New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox(bsc#1120650) - Ensure consistency of entries, otherwise switching between settings becomes problematic - Whitelist for postgresql. Currently the checker doesn't complain because the directories aren't packaged, but that might change and/or our checkers might improve (bsc#1123886) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-319=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): permissions-20180125-lp150.2.6.1 permissions-debuginfo-20180125-lp150.2.6.1 permissions-debugsource-20180125-lp150.2.6.1 References: https://bugzilla.suse.com/1120650 https://bugzilla.suse.com/1123886

1 0

openSUSE-RU-2019:0315-1: moderate: Recommended update for aws-vpc-move-ip
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for aws-vpc-move-ip ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0315-1 Rating: moderate References: #1125138 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for aws-vpc-move-ip fixes the following issues: - Add support for multiple VPC routing tables in the routing_tables parameter (bsc#1125138) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-315=1 Package List: - openSUSE Leap 15.0 (noarch): aws-vpc-move-ip-0.2.20171113-lp150.2.6.1 References: https://bugzilla.suse.com/1125138

1 0

openSUSE-RU-2019:0320-1: moderate: Recommended update for libapr-util1
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for libapr-util1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0320-1 Rating: moderate References: #1125331 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libapr-util1 fixes the following issues: - build against the threadsafe libldap_r instead of libldap to avoid potential crashes (bsc#1125331) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-320=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libapr-util1-1.5.3-11.1 libapr-util1-dbd-mysql-1.5.3-11.1 libapr-util1-dbd-mysql-debuginfo-1.5.3-11.1 libapr-util1-dbd-pgsql-1.5.3-11.1 libapr-util1-dbd-pgsql-debuginfo-1.5.3-11.1 libapr-util1-dbd-sqlite3-1.5.3-11.1 libapr-util1-dbd-sqlite3-debuginfo-1.5.3-11.1 libapr-util1-debuginfo-1.5.3-11.1 libapr-util1-debugsource-1.5.3-11.1 libapr-util1-devel-1.5.3-11.1 References: https://bugzilla.suse.com/1125331

1 0

openSUSE-RU-2019:0317-1: moderate: Recommended update for crash
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0317-1 Rating: moderate References: #1090127 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for crash fixes the following issues: - Fix crash utility printing "bt:seek" and "bt:read" errors. (bsc#1090127) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-317=1 Package List: - openSUSE Leap 15.0 (x86_64): crash-7.2.1-lp150.2.8.1 crash-debuginfo-7.2.1-lp150.2.8.1 crash-debugsource-7.2.1-lp150.2.8.1 crash-devel-7.2.1-lp150.2.8.1 crash-doc-7.2.1-lp150.2.8.1 crash-eppic-7.2.1-lp150.2.8.1 crash-eppic-debuginfo-7.2.1-lp150.2.8.1 crash-gcore-7.2.1-lp150.2.8.1 crash-gcore-debuginfo-7.2.1-lp150.2.8.1 crash-kmp-default-7.2.1_k4.12.14_lp150.12.48-lp150.2.8.1 crash-kmp-default-debuginfo-7.2.1_k4.12.14_lp150.12.48-lp150.2.8.1 References: https://bugzilla.suse.com/1090127

1 0

openSUSE-RU-2019:0312-1: moderate: Recommended update for mailman
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0312-1 Rating: moderate References: #1095112 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mailman fixes the following issues: - Add /etc/mailman/mailman.cgi-gid and fix user rights (boo#1095112) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-312=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mailman-2.1.29-bp150.2.3.1 References: https://bugzilla.suse.com/1095112

1 0

openSUSE-RU-2019:0311-1: moderate: Recommended update for console-setup, kbd
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for console-setup, kbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0311-1 Rating: moderate References: #1122361 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for console-setup and kbd provides the following fix: - Fix Shift-Tab mapping. (bsc#1122361) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-311=1 Package List: - openSUSE Backports SLE-15 (noarch): console-setup-1.134-bp150.2.3.1 References: https://bugzilla.suse.com/1122361

1 0

openSUSE-RU-2019:0316-1: moderate: Recommended update for xdg-desktop-portal
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for xdg-desktop-portal ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0316-1 Rating: moderate References: #1118121 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xdg-desktop-portal provides the following fix: - Prevent a crash when xdg-desktop-portal-gtk times out. (bsc#1118121) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-316=1 Package List: - openSUSE Leap 15.0 (x86_64): xdg-desktop-portal-0.10-lp150.2.3.1 xdg-desktop-portal-debuginfo-0.10-lp150.2.3.1 xdg-desktop-portal-debugsource-0.10-lp150.2.3.1 xdg-desktop-portal-devel-0.10-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): xdg-desktop-portal-lang-0.10-lp150.2.3.1 References: https://bugzilla.suse.com/1118121

1 0

openSUSE-RU-2019:0321-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0321-1 Rating: moderate References: #1113712 #1124088 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - Correct fix for displaying text on emergency consoles (bsc#1124088) - 95iscsi: handle qedi like bnx2i (bsc#1113712) - 91zipl: Don't use contents of commented lines (osc#1119499) - Fix displaying text on emergency consoles (bsc#1124088) - Remove invalid "FONT_MAP=none" from vconsole.conf (osc#1013573) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-321=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-044.1-lp150.14.18.1 dracut-debuginfo-044.1-lp150.14.18.1 dracut-debugsource-044.1-lp150.14.18.1 dracut-fips-044.1-lp150.14.18.1 dracut-ima-044.1-lp150.14.18.1 dracut-tools-044.1-lp150.14.18.1 References: https://bugzilla.suse.com/1113712 https://bugzilla.suse.com/1124088

1 0

openSUSE-RU-2019:0318-1: moderate: Recommended update for polkit-default-privs
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for polkit-default-privs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0318-1 Rating: moderate References: #1122116 #1123653 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for polkit-default-privs fixes the following issues: - soften a flatpak permissions rule (bsc#1122116) - add an additional flatpak rule (bsc#1123653) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-318=1 Package List: - openSUSE Leap 15.0 (noarch): polkit-default-privs-13.2-lp150.8.15.1 References: https://bugzilla.suse.com/1122116 https://bugzilla.suse.com/1123653

1 0

openSUSE-RU-2019:0314-1: moderate: Recommended update for gstreamer-plugins-ugly
by maintenance＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Recommended Update: Recommended update for gstreamer-plugins-ugly ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0314-1 Rating: moderate References: Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gstreamer-plugins-ugly fixes the following issues: - Fixed 10bit encoding with X264_BUILD >= 153 (bgo#796975) - Make it build with the VideoLAN SVN liba52 patched by Packman - Enable a52dec build. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-314=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gstreamer-plugins-ugly-1.8.3-5.3.1 gstreamer-plugins-ugly-debuginfo-1.8.3-5.3.1 gstreamer-plugins-ugly-debugsource-1.8.3-5.3.1 gstreamer-plugins-ugly-doc-1.8.3-5.3.1 - openSUSE Leap 42.3 (x86_64): gstreamer-plugins-ugly-32bit-1.8.3-5.3.1 gstreamer-plugins-ugly-debuginfo-32bit-1.8.3-5.3.1 - openSUSE Leap 42.3 (noarch): gstreamer-plugins-ugly-lang-1.8.3-5.3.1 References:

1 0

openSUSE-SU-2019:0310-1: moderate: Security update for gdm
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0310-1 Rating: moderate References: #1112294 #1112578 #1113245 #1113700 #1120307 #1124628 Cross-References: CVE-2019-3825 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for gdm fixes the following issues: Security issue fixed: - CVE-2019-3825: Fixed a lock screen bypass when timed login was enabled (bsc#1124628). Other issues fixed: - GLX applications do not work well when the proprietary nvidia driver is used with a wayland session. Because of that this update disables wayland on that hardware (bsc#1112578). - Fixed an issue where gdm restart fails to kill user processes (bsc#1112294 and bsc#1113245). - Fixed a System halt in the screen with message "End of ORACLE section" (bsc#1120307). - Fixed an issue which did not allow the returning to text console when gdm is stopped (bsc#1113700). - Fixed an issue which was causing system hang during the load of gdm (bsc#1112578). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-310=1 Package List: - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.9.1 gdm-debuginfo-3.26.2.1-lp150.11.9.1 gdm-debugsource-3.26.2.1-lp150.11.9.1 gdm-devel-3.26.2.1-lp150.11.9.1 libgdm1-3.26.2.1-lp150.11.9.1 libgdm1-debuginfo-3.26.2.1-lp150.11.9.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.9.1 - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.9.1 gdm-lang-3.26.2.1-lp150.11.9.1 gdmflexiserver-3.26.2.1-lp150.11.9.1 References: https://www.suse.com/security/cve/CVE-2019-3825.html https://bugzilla.suse.com/1112294 https://bugzilla.suse.com/1112578 https://bugzilla.suse.com/1113245 https://bugzilla.suse.com/1113700 https://bugzilla.suse.com/1120307 https://bugzilla.suse.com/1124628

1 0

openSUSE-RU-2019:0302-1: moderate: Recommended update for console-setup, kbd
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for console-setup, kbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0302-1 Rating: moderate References: #1122361 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for console-setup and kbd provides the following fix: - Fix Shift-Tab mapping. (bsc#1122361) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-302=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kbd-2.0.4-lp150.7.3.1 kbd-debuginfo-2.0.4-lp150.7.3.1 kbd-debugsource-2.0.4-lp150.7.3.1 - openSUSE Leap 15.0 (noarch): console-setup-1.134-lp150.4.3.1 kbd-legacy-2.0.4-lp150.7.3.1 References: https://bugzilla.suse.com/1122361

1 0

openSUSE-SU-2019:0306-1: important: Security update for ceph
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0306-1 Rating: important References: #1111177 #1113246 #1114710 #1121567 Cross-References: CVE-2018-14662 CVE-2018-16846 CVE-2018-16889 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-14662: mon: limit caps allowed to access the config store (bsc#1111177) - CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts (bsc#1114710) - CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567) Non-security issue fixed: - os/bluestore: avoid frequent allocator dump on bluefs rebalance failure (bsc#1113246) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-306=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.10+git.1549630712.bb089269ea-21.1 ceph-base-12.2.10+git.1549630712.bb089269ea-21.1 ceph-base-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-common-12.2.10+git.1549630712.bb089269ea-21.1 ceph-common-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-debugsource-12.2.10+git.1549630712.bb089269ea-21.1 ceph-fuse-12.2.10+git.1549630712.bb089269ea-21.1 ceph-fuse-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mds-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mds-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mgr-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mgr-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mon-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mon-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-osd-12.2.10+git.1549630712.bb089269ea-21.1 ceph-osd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-radosgw-12.2.10+git.1549630712.bb089269ea-21.1 ceph-radosgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-resource-agents-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-debugsource-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs-devel-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs2-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librados-devel-12.2.10+git.1549630712.bb089269ea-21.1 librados-devel-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librados2-12.2.10+git.1549630712.bb089269ea-21.1 librados2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper-devel-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper1-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper1-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librbd-devel-12.2.10+git.1549630712.bb089269ea-21.1 librbd1-12.2.10+git.1549630712.bb089269ea-21.1 librbd1-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librgw-devel-12.2.10+git.1549630712.bb089269ea-21.1 librgw2-12.2.10+git.1549630712.bb089269ea-21.1 librgw2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-ceph-compat-12.2.10+git.1549630712.bb089269ea-21.1 python-cephfs-12.2.10+git.1549630712.bb089269ea-21.1 python-cephfs-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rados-12.2.10+git.1549630712.bb089269ea-21.1 python-rados-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rbd-12.2.10+git.1549630712.bb089269ea-21.1 python-rbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rgw-12.2.10+git.1549630712.bb089269ea-21.1 python-rgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-ceph-argparse-12.2.10+git.1549630712.bb089269ea-21.1 python3-cephfs-12.2.10+git.1549630712.bb089269ea-21.1 python3-cephfs-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rados-12.2.10+git.1549630712.bb089269ea-21.1 python3-rados-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rbd-12.2.10+git.1549630712.bb089269ea-21.1 python3-rbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rgw-12.2.10+git.1549630712.bb089269ea-21.1 python3-rgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rados-objclass-devel-12.2.10+git.1549630712.bb089269ea-21.1 rbd-fuse-12.2.10+git.1549630712.bb089269ea-21.1 rbd-fuse-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rbd-mirror-12.2.10+git.1549630712.bb089269ea-21.1 rbd-mirror-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rbd-nbd-12.2.10+git.1549630712.bb089269ea-21.1 rbd-nbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 References: https://www.suse.com/security/cve/CVE-2018-14662.html https://www.suse.com/security/cve/CVE-2018-16846.html https://www.suse.com/security/cve/CVE-2018-16889.html https://bugzilla.suse.com/1111177 https://bugzilla.suse.com/1113246 https://bugzilla.suse.com/1114710 https://bugzilla.suse.com/1121567

1 0

openSUSE-SU-2019:0309-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0309-1 Rating: important References: #1124937 Cross-References: CVE-2019-6212 CVE-2019-6215 CVE-2019-6216 CVE-2019-6217 CVE-2019-6226 CVE-2019-6227 CVE-2019-6229 CVE-2019-6233 CVE-2019-6234 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.22.6 fixes the following issues: Security issues fixed: - CVE-2019-6212: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6215: Fixed a type confusion vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6216: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6217: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6226: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6227: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6229: Fixed a logic issue by improving validation which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6233: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6234: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. Other issues addressed: - Update to version 2.22.6 (bsc#1124937). - Kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour. - Fixed Web inspector magnifier under Wayland. - Fixed garbled rendering of some websites (e.g. YouTube) while scrolling under X11. - Fixed several crashes, race conditions, and rendering issues. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-309=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.22.6-21.1 libjavascriptcoregtk-4_0-18-debuginfo-2.22.6-21.1 libwebkit2gtk-4_0-37-2.22.6-21.1 libwebkit2gtk-4_0-37-debuginfo-2.22.6-21.1 typelib-1_0-JavaScriptCore-4_0-2.22.6-21.1 typelib-1_0-WebKit2-4_0-2.22.6-21.1 typelib-1_0-WebKit2WebExtension-4_0-2.22.6-21.1 webkit-jsc-4-2.22.6-21.1 webkit-jsc-4-debuginfo-2.22.6-21.1 webkit2gtk-4_0-injected-bundles-2.22.6-21.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.22.6-21.1 webkit2gtk3-debugsource-2.22.6-21.1 webkit2gtk3-devel-2.22.6-21.1 webkit2gtk3-minibrowser-2.22.6-21.1 webkit2gtk3-minibrowser-debuginfo-2.22.6-21.1 webkit2gtk3-plugin-process-gtk2-2.22.6-21.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.22.6-21.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.22.6-21.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.22.6-21.1 libwebkit2gtk-4_0-37-32bit-2.22.6-21.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.22.6-21.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.22.6-21.1 References: https://www.suse.com/security/cve/CVE-2019-6212.html https://www.suse.com/security/cve/CVE-2019-6215.html https://www.suse.com/security/cve/CVE-2019-6216.html https://www.suse.com/security/cve/CVE-2019-6217.html https://www.suse.com/security/cve/CVE-2019-6226.html https://www.suse.com/security/cve/CVE-2019-6227.html https://www.suse.com/security/cve/CVE-2019-6229.html https://www.suse.com/security/cve/CVE-2019-6233.html https://www.suse.com/security/cve/CVE-2019-6234.html https://bugzilla.suse.com/1124937

1 0

openSUSE-SU-2019:0308-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0308-1 Rating: moderate References: #1119553 #1119554 #1119555 #1119556 #1119557 #1119558 #1124937 Cross-References: CVE-2018-4437 CVE-2018-4438 CVE-2018-4441 CVE-2018-4442 CVE-2018-4443 CVE-2018-4464 CVE-2019-6212 CVE-2019-6215 CVE-2019-6216 CVE-2019-6217 CVE-2019-6226 CVE-2019-6227 CVE-2019-6229 CVE-2019-6233 CVE-2019-6234 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558): Security vulnerabilities fixed: - CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553) - CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554) - CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555) - CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556) - CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557) - CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558) - CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling. - CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. - CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation. - CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. - CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. Other bug fixes and changes: - Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour. - Fix Web inspector magnifier under Wayland. - Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11. - Fix several crashes, race conditions, and rendering issues. For a detailed list of changes, please refer to: - https://webkitgtk.org/security/WSA-2019-0001.html - https://webkitgtk.org/2019/02/09/webkitgtk2.22.6-released.html - https://webkitgtk.org/security/WSA-2018-0009.html - https://webkitgtk.org/2018/12/13/webkitgtk2.22.5-released.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-308=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.22.6-lp150.2.12.1 libjavascriptcoregtk-4_0-18-debuginfo-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-debuginfo-2.22.6-lp150.2.12.1 typelib-1_0-JavaScriptCore-4_0-2.22.6-lp150.2.12.1 typelib-1_0-WebKit2-4_0-2.22.6-lp150.2.12.1 typelib-1_0-WebKit2WebExtension-4_0-2.22.6-lp150.2.12.1 webkit-jsc-4-2.22.6-lp150.2.12.1 webkit-jsc-4-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk-4_0-injected-bundles-2.22.6-lp150.2.12.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk3-debugsource-2.22.6-lp150.2.12.1 webkit2gtk3-devel-2.22.6-lp150.2.12.1 webkit2gtk3-minibrowser-2.22.6-lp150.2.12.1 webkit2gtk3-minibrowser-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk3-plugin-process-gtk2-2.22.6-lp150.2.12.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.22.6-lp150.2.12.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.22.6-lp150.2.12.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-32bit-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.22.6-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.22.6-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-4437.html https://www.suse.com/security/cve/CVE-2018-4438.html https://www.suse.com/security/cve/CVE-2018-4441.html https://www.suse.com/security/cve/CVE-2018-4442.html https://www.suse.com/security/cve/CVE-2018-4443.html https://www.suse.com/security/cve/CVE-2018-4464.html https://www.suse.com/security/cve/CVE-2019-6212.html https://www.suse.com/security/cve/CVE-2019-6215.html https://www.suse.com/security/cve/CVE-2019-6216.html https://www.suse.com/security/cve/CVE-2019-6217.html https://www.suse.com/security/cve/CVE-2019-6226.html https://www.suse.com/security/cve/CVE-2019-6227.html https://www.suse.com/security/cve/CVE-2019-6229.html https://www.suse.com/security/cve/CVE-2019-6233.html https://www.suse.com/security/cve/CVE-2019-6234.html https://bugzilla.suse.com/1119553 https://bugzilla.suse.com/1119554 https://bugzilla.suse.com/1119555 https://bugzilla.suse.com/1119556 https://bugzilla.suse.com/1119557 https://bugzilla.suse.com/1119558 https://bugzilla.suse.com/1124937

1 0

openSUSE-RU-2019:0303-1: moderate: Recommended update for cloud-netconfig
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for cloud-netconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0303-1 Rating: moderate References: #1112822 #1118783 #1122013 #1123008 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for cloud-netconfig provides the following fixes: - Run cloud-netconfig periodically. (bsc#1118783, bsc#1122013) - Do not treat eth0 special with regard to routing policies. (bsc#1123008) - Reduce the timeout on metadata read. (bsc#1112822) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-303=1 Package List: - openSUSE Leap 15.0 (noarch): cloud-netconfig-azure-0.9-lp150.4.6.1 cloud-netconfig-ec2-0.9-lp150.4.6.1 References: https://bugzilla.suse.com/1112822 https://bugzilla.suse.com/1118783 https://bugzilla.suse.com/1122013 https://bugzilla.suse.com/1123008

1 0

openSUSE-RU-2019:0304-1: moderate: Recommended update for cloud-netconfig
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for cloud-netconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0304-1 Rating: moderate References: #1075484 #1112822 #1118783 #1122013 #1123008 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for cloud-netconfig provides the following fixes: - Run cloud-netconfig periodically. (bsc#1118783, bsc#1122013) - Do not treat eth0 special with regard to routing policies. (bsc#1123008) - Reduce the timeout on metadata read. (bsc#1112822) - Remove dependency on udev-persistent-ifnames. (bsc#1075484) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-304=1 Package List: - openSUSE Leap 42.3 (noarch): cloud-netconfig-azure-0.9-14.1 cloud-netconfig-ec2-0.9-14.1 References: https://bugzilla.suse.com/1075484 https://bugzilla.suse.com/1112822 https://bugzilla.suse.com/1118783 https://bugzilla.suse.com/1122013 https://bugzilla.suse.com/1123008

1 0

openSUSE-RU-2019:0300-1: Recommended update for mirror
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for mirror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0300-1 Rating: low References: #1123661 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mirror provides the following fix: - Remove a warning that dump() will no longer be available in Perl 5.30. (bsc#1123661) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-300=1 Package List: - openSUSE Leap 15.0 (noarch): mirror-2.9-lp150.2.6.1 References: https://bugzilla.suse.com/1123661

1 0

openSUSE-SU-2019:0307-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0307-1 Rating: moderate References: #1121816 #1121821 #1125687 Cross-References: CVE-2019-6109 CVE-2019-6111 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816) - CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821) Other bug fixes and changes: - Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested (bsc#1125687) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-307=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): openssh-7.6p1-lp150.8.15.2 openssh-cavs-7.6p1-lp150.8.15.2 openssh-cavs-debuginfo-7.6p1-lp150.8.15.2 openssh-debuginfo-7.6p1-lp150.8.15.2 openssh-debugsource-7.6p1-lp150.8.15.2 openssh-fips-7.6p1-lp150.8.15.2 openssh-helpers-7.6p1-lp150.8.15.2 openssh-helpers-debuginfo-7.6p1-lp150.8.15.2 - openSUSE Leap 15.0 (x86_64): openssh-askpass-gnome-7.6p1-lp150.8.15.1 openssh-askpass-gnome-debuginfo-7.6p1-lp150.8.15.1 References: https://www.suse.com/security/cve/CVE-2019-6109.html https://www.suse.com/security/cve/CVE-2019-6111.html https://bugzilla.suse.com/1121816 https://bugzilla.suse.com/1121821 https://bugzilla.suse.com/1125687

1 0

openSUSE-RU-2019:0299-1: moderate: Recommended update for mailman
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0299-1 Rating: moderate References: #1095112 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mailman fixes the following issues: - Add /etc/mailman/mailman.cgi-gid and fix user rights (boo#1095112) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-299=1 Package List: - openSUSE Leap 15.0 (x86_64): mailman-2.1.29-lp150.2.11.1 mailman-debuginfo-2.1.29-lp150.2.11.1 mailman-debugsource-2.1.29-lp150.2.11.1 References: https://bugzilla.suse.com/1095112

1 0

openSUSE-SU-2019:0305-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0305-1 Rating: moderate References: #1121086 #1122838 #1122839 Cross-References: CVE-2018-17189 CVE-2018-17199 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838) - CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839) Non-security issue fixed: - sysconfig.d is not created anymore if it already exists (bsc#1121086) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-305=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-37.1 apache2-debuginfo-2.4.23-37.1 apache2-debugsource-2.4.23-37.1 apache2-devel-2.4.23-37.1 apache2-event-2.4.23-37.1 apache2-event-debuginfo-2.4.23-37.1 apache2-example-pages-2.4.23-37.1 apache2-prefork-2.4.23-37.1 apache2-prefork-debuginfo-2.4.23-37.1 apache2-utils-2.4.23-37.1 apache2-utils-debuginfo-2.4.23-37.1 apache2-worker-2.4.23-37.1 apache2-worker-debuginfo-2.4.23-37.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-37.1 References: https://www.suse.com/security/cve/CVE-2018-17189.html https://www.suse.com/security/cve/CVE-2018-17199.html https://bugzilla.suse.com/1121086 https://bugzilla.suse.com/1122838 https://bugzilla.suse.com/1122839

1 0

openSUSE-RU-2019:0301-1: important: Recommended update for gnome-shell
by maintenance＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Recommended Update: Recommended update for gnome-shell ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0301-1 Rating: important References: #1093541 #1120178 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gnome-shell and gsettings-desktop-schemas fixes the following issues: gnome-shell: - Fixes an issue where gnome-shell crashed and prevented booting into a GNOME environment (bsc#1120178) - Fixes a memory leak bug (bsc#1093541) gsettings-desktop-schemas: - Fixes an issue where gsettings-desktop-schemas crashed in combination with gnome-shell (bsc#1120178) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-301=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gsettings-desktop-schemas-3.24.1-lp150.2.3.1 gsettings-desktop-schemas-devel-3.24.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): gnome-shell-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-browser-plugin-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-browser-plugin-debuginfo-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-calendar-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-calendar-debuginfo-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-debuginfo-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-debugsource-3.26.2+20180130.0d9c74212-lp150.3.7.1 gnome-shell-devel-3.26.2+20180130.0d9c74212-lp150.3.7.1 - openSUSE Leap 15.0 (noarch): gnome-shell-lang-3.26.2+20180130.0d9c74212-lp150.3.7.1 gsettings-desktop-schemas-lang-3.24.1-lp150.2.3.1 References: https://bugzilla.suse.com/1093541 https://bugzilla.suse.com/1120178

1 0

openSUSE-SU-2019:0298-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Mar '19

07 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0298-1 Rating: important References: #1127602 Cross-References: CVE-2019-5786 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium was updated: to 72.0.3626.121: * CVE-2019-5786: Use-after-free in FileReader fixed (boo#1127602) * Feature fixes update only Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-298=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-298=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-298=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-298=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-72.0.3626.121-202.1 chromedriver-debuginfo-72.0.3626.121-202.1 chromium-72.0.3626.121-202.1 chromium-debuginfo-72.0.3626.121-202.1 chromium-debugsource-72.0.3626.121-202.1 - openSUSE Leap 15.0 (x86_64): chromedriver-72.0.3626.121-lp150.2.46.1 chromedriver-debuginfo-72.0.3626.121-lp150.2.46.1 chromium-72.0.3626.121-lp150.2.46.1 chromium-debuginfo-72.0.3626.121-lp150.2.46.1 chromium-debugsource-72.0.3626.121-lp150.2.46.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-72.0.3626.121-bp150.2.37.1 chromedriver-debuginfo-72.0.3626.121-bp150.2.37.1 chromium-72.0.3626.121-bp150.2.37.1 chromium-debuginfo-72.0.3626.121-bp150.2.37.1 chromium-debugsource-72.0.3626.121-bp150.2.37.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.121-92.1 chromedriver-debuginfo-72.0.3626.121-92.1 chromium-72.0.3626.121-92.1 chromium-debuginfo-72.0.3626.121-92.1 chromium-debugsource-72.0.3626.121-92.1 References: https://www.suse.com/security/cve/CVE-2019-5786.html https://bugzilla.suse.com/1127602

1 0

openSUSE-SU-2019:0298-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Mar '19

07 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0298-1 Rating: important References: #1127602 Cross-References: CVE-2019-5786 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium was updated: to 72.0.3626.121: * CVE-2019-5786: Use-after-free in FileReader fixed (boo#1127602) * Feature fixes update only Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-298=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.121-92.1 chromedriver-debuginfo-72.0.3626.121-92.1 chromium-72.0.3626.121-92.1 chromium-debuginfo-72.0.3626.121-92.1 chromium-debugsource-72.0.3626.121-92.1 References: https://www.suse.com/security/cve/CVE-2019-5786.html https://bugzilla.suse.com/1127602

1 0

openSUSE-SU-2019:0296-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0296-1 Rating: moderate References: #1121086 #1122838 #1122839 Cross-References: CVE-2018-17189 CVE-2018-17199 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838) - CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839) Non-security issue fixed: - sysconfig.d is not created anymore if it already exists (bsc#1121086) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-296=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.9.1 apache2-debuginfo-2.4.33-lp150.2.9.1 apache2-debugsource-2.4.33-lp150.2.9.1 apache2-devel-2.4.33-lp150.2.9.1 apache2-event-2.4.33-lp150.2.9.1 apache2-event-debuginfo-2.4.33-lp150.2.9.1 apache2-example-pages-2.4.33-lp150.2.9.1 apache2-prefork-2.4.33-lp150.2.9.1 apache2-prefork-debuginfo-2.4.33-lp150.2.9.1 apache2-utils-2.4.33-lp150.2.9.1 apache2-utils-debuginfo-2.4.33-lp150.2.9.1 apache2-worker-2.4.33-lp150.2.9.1 apache2-worker-debuginfo-2.4.33-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-17189.html https://www.suse.com/security/cve/CVE-2018-17199.html https://bugzilla.suse.com/1121086 https://bugzilla.suse.com/1122838 https://bugzilla.suse.com/1122839

1 0

openSUSE-SU-2019:0295-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0295-1 Rating: important References: #1048046 #1051429 #1114832 #1118897 #1118898 #1118899 #1121967 #1124308 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has four fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues: Security issues fixed: - CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899). - CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898). - CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897). - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967). Other changes and fixes: - Update shell completion to use Group: System/Shells. - Add daemon.json file with rotation logs configuration (bsc#1114832) - Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Update go requirements to >= go1.10 - Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429). - Remove the usage of 'cp -r' to reduce noise in the build logs. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-295=1 Package List: - openSUSE Leap 15.0 (noarch): containerd-test-1.2.2-lp150.4.10.1 docker-bash-completion-18.09.1_ce-lp150.5.13.1 docker-runc-test-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-zsh-completion-18.09.1_ce-lp150.5.13.1 runc-test-1.0.0~rc6-lp150.2.7.1 - openSUSE Leap 15.0 (x86_64): containerd-1.2.2-lp150.4.10.1 containerd-ctr-1.2.2-lp150.4.10.1 docker-18.09.1_ce-lp150.5.13.1 docker-debuginfo-18.09.1_ce-lp150.5.13.1 docker-debugsource-18.09.1_ce-lp150.5.13.1 docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 docker-runc-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-runc-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-test-18.09.1_ce-lp150.5.13.1 docker-test-debuginfo-18.09.1_ce-lp150.5.13.1 golang-github-docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 runc-1.0.0~rc6-lp150.2.7.1 runc-debuginfo-1.0.0~rc6-lp150.2.7.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1048046 https://bugzilla.suse.com/1051429 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1124308

1 0

openSUSE-SU-2019:0297-1: moderate: Security update for amavisd-new
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for amavisd-new ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0297-1 Rating: moderate References: #1123389 #987887 Cross-References: CVE-2016-1238 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for amavisd-new fixes the following issues: Security issue fixed: - CVE-2016-1238: Workedaround a perl vulnerability by removing a trailing dot element from @INC (bsc#987887). Other issues addressed: - update to version 2.11.1 (bsc#1123389). - amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR for a message "PID <pid> went away", and removed redundant newlines from some log messages - avoid warning messages "Use of uninitialized value in subroutine entry" in Encode::MIME::Header when the $check argument is undefined - @sa_userconf_maps has been extended to allow loading of per-recipient (or per-policy bank, or global) SpamAssassin configuration set from LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with 'ldap:' will load SpamAssassin configuration set using the load_scoreonly_ldap() method. - add some Sanesecurity.Foxhole false positives to the default list @virus_name_to_spam_score_maps - update amavis-milter to version 2.6.1: * Fixed a bug when creating amavisd-new policy bank names This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-297=1 Package List: - openSUSE Leap 15.0 (x86_64): amavisd-new-2.11.1-lp150.5.3.1 amavisd-new-debuginfo-2.11.1-lp150.5.3.1 amavisd-new-debugsource-2.11.1-lp150.5.3.1 amavisd-new-docs-2.11.1-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2016-1238.html https://bugzilla.suse.com/1123389 https://bugzilla.suse.com/987887

1 0

openSUSE-SU-2019:0292-1: important: Security update for python
by opensuse-security＠opensuse.org 05 Mar '19

05 Mar '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0292-1 Rating: important References: #1073748 #1109847 #1122191 Cross-References: CVE-2018-14647 CVE-2019-5010 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). - CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: - Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-292=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython2_7-1_0-2.7.13-27.12.1 libpython2_7-1_0-debuginfo-2.7.13-27.12.1 python-2.7.13-27.12.1 python-base-2.7.13-27.12.1 python-base-debuginfo-2.7.13-27.12.1 python-base-debugsource-2.7.13-27.12.1 python-curses-2.7.13-27.12.1 python-curses-debuginfo-2.7.13-27.12.1 python-debuginfo-2.7.13-27.12.1 python-debugsource-2.7.13-27.12.1 python-demo-2.7.13-27.12.1 python-devel-2.7.13-27.12.1 python-gdbm-2.7.13-27.12.1 python-gdbm-debuginfo-2.7.13-27.12.1 python-idle-2.7.13-27.12.1 python-tk-2.7.13-27.12.1 python-tk-debuginfo-2.7.13-27.12.1 python-xml-2.7.13-27.12.1 python-xml-debuginfo-2.7.13-27.12.1 - openSUSE Leap 42.3 (noarch): python-doc-2.7.13-27.12.1 python-doc-pdf-2.7.13-27.12.1 - openSUSE Leap 42.3 (x86_64): libpython2_7-1_0-32bit-2.7.13-27.12.1 libpython2_7-1_0-debuginfo-32bit-2.7.13-27.12.1 python-32bit-2.7.13-27.12.1 python-base-32bit-2.7.13-27.12.1 python-base-debuginfo-32bit-2.7.13-27.12.1 python-debuginfo-32bit-2.7.13-27.12.1 References: https://www.suse.com/security/cve/CVE-2018-14647.html https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1073748 https://bugzilla.suse.com/1109847 https://bugzilla.suse.com/1122191

1 0

openSUSE-SU-2019:0293-1: important: Security update for supportutils
by opensuse-security＠opensuse.org 05 Mar '19

05 Mar '19

openSUSE Security Update: Security update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0293-1 Rating: important References: #1043311 #1046681 #1051797 #1071545 #1105849 #1112461 #1115245 #1117776 #1118460 #1118462 #1118463 #1125609 #1125666 Cross-References: CVE-2018-19637 CVE-2018-19638 CVE-2018-19639 CVE-2018-19640 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has 9 fixes is now available. Description: This update for supportutils fixes the following issues: Security issues fixed: - CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463). - CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460). - CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462). - CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776). Other issues fixed: - Fixed invalid exit code commands (bsc#1125666). - Included additional SUSE separation (bsc#1125609). - Merged added listing of locked packes by zypper. - Exclude pam.txt per GDPR by default (bsc#1112461). - Clarified -x functionality in supportconfig(8) (bsc#1115245). - udev service and provide the whole journal content in supportconfig (bsc#1051797). - supportconfig collects tuned profile settings (bsc#1071545). - sfdisk -d no disk device specified (bsc#1043311). - Added vulnerabilites status check in basic-health.txt (bsc#1105849). - Added only sched_domain from cpu0. - Blacklist sched_domain from proc.txt (bsc#1046681). - Added firewall-cmd info. - Add ls -lA --time-style=long-iso /etc/products.d/ - Dump lsof errors. - Added corosync status to ha_info. - Dump find errors in ib_info. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-293=1 Package List: - openSUSE Leap 15.0 (noarch): supportutils-3.1-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-19637.html https://www.suse.com/security/cve/CVE-2018-19638.html https://www.suse.com/security/cve/CVE-2018-19639.html https://www.suse.com/security/cve/CVE-2018-19640.html https://bugzilla.suse.com/1043311 https://bugzilla.suse.com/1046681 https://bugzilla.suse.com/1051797 https://bugzilla.suse.com/1071545 https://bugzilla.suse.com/1105849 https://bugzilla.suse.com/1112461 https://bugzilla.suse.com/1115245 https://bugzilla.suse.com/1117776 https://bugzilla.suse.com/1118460 https://bugzilla.suse.com/1118462 https://bugzilla.suse.com/1118463 https://bugzilla.suse.com/1125609 https://bugzilla.suse.com/1125666

1 0