March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0343-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0343-1 Rating: important References: #1129059 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for chromium to version 73.0.3683.75 fixes the following issues: Security issues fixed (bsc#1129059): - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap buffer overflow in V8. - CVE-2019-5791: Fixed a type confusion in V8. - CVE-2019-5792: Fixed an integer overflow in PDFium. - CVE-2019-5793: Fixed excessive permissions for private API in Extensions. - CVE-2019-5794: Fixed security UI spoofing. - CVE-2019-5795: Fixed an integer overflow in PDFium. - CVE-2019-5796: Fixed a race condition in Extensions. - CVE-2019-5797: Fixed a race condition in DOMStorage. - CVE-2019-5798: Fixed an out of bounds read in Skia. - CVE-2019-5799: Fixed a CSP bypass with blob URL. - CVE-2019-5800: Fixed a CSP bypass with blob URL. - CVE-2019-5801: Fixed an incorrect Omnibox display on iOS. - CVE-2019-5802: Fixed security UI spoofing. - CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'. - CVE-2019-5804: Fixed a command line injection on Windows. Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des ktop_12.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-343=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-73.0.3683.75-205.1 chromedriver-debuginfo-73.0.3683.75-205.1 chromium-73.0.3683.75-205.1 chromium-debuginfo-73.0.3683.75-205.1 chromium-debugsource-73.0.3683.75-205.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://bugzilla.suse.com/1129059

1 0

openSUSE-RU-2019:0342-1: Recommended update for gnome-settings-daemon
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for gnome-settings-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0342-1 Rating: low References: #1029083 #1056289 #1063826 #1067288 #1077412 #1086496 #990470 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for gnome-settings-daemon provides the following fixes: - Fix update notification not showing when patches have conflicts. (bsc#1063826) - Switch new user's default input engine from "anthy" to "mozc" in gnome-desktop with Japanese language and ibus input framework. (bsc#1056289, bsc#1067288, bsc#1029083) - Make it possible to wake up the screen using a touch screen input. (bsc#1086496) - Fix two finger scroll gesture support. (bsc#1077412, bsc#990470) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-342=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gnome-settings-daemon-3.20.1-20.2 gnome-settings-daemon-debuginfo-3.20.1-20.2 gnome-settings-daemon-debugsource-3.20.1-20.2 gnome-settings-daemon-devel-3.20.1-20.2 - openSUSE Leap 42.3 (noarch): gnome-settings-daemon-lang-3.20.1-20.2 References: https://bugzilla.suse.com/1029083 https://bugzilla.suse.com/1056289 https://bugzilla.suse.com/1063826 https://bugzilla.suse.com/1067288 https://bugzilla.suse.com/1077412 https://bugzilla.suse.com/1086496 https://bugzilla.suse.com/990470

1 0

openSUSE-RU-2019:0341-1: moderate: Recommended update for konsole
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for konsole ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0341-1 Rating: moderate References: #1095022 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for konsole fixes the following issues: - Fixed problems with rendering text in bold (boo#1095022) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-341=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-341=1 Package List: - openSUSE Leap 15.0 (noarch): konsole-part-lang-17.12.3-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): konsole-17.12.3-lp150.2.3.1 konsole-debuginfo-17.12.3-lp150.2.3.1 konsole-debugsource-17.12.3-lp150.2.3.1 konsole-part-17.12.3-lp150.2.3.1 konsole-part-debuginfo-17.12.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): konsole-17.12.3-bp150.3.3.1 konsole-part-17.12.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): konsole-part-lang-17.12.3-bp150.3.3.1 References: https://bugzilla.suse.com/1095022

1 0

openSUSE-RU-2019:0339-1: Recommended update for NetworkManager
by maintenance＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0339-1 Rating: low References: #1019813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager fixes the following issues: - Drop previous patch that has side effects when geoclue is not installed. (bsc#1019813) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-339=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): NetworkManager-1.0.12-7.6.1 NetworkManager-debuginfo-1.0.12-7.6.1 NetworkManager-debugsource-1.0.12-7.6.1 NetworkManager-devel-1.0.12-7.6.1 libnm-glib-vpn1-1.0.12-7.6.1 libnm-glib-vpn1-debuginfo-1.0.12-7.6.1 libnm-glib4-1.0.12-7.6.1 libnm-glib4-debuginfo-1.0.12-7.6.1 libnm-util2-1.0.12-7.6.1 libnm-util2-debuginfo-1.0.12-7.6.1 libnm0-1.0.12-7.6.1 libnm0-debuginfo-1.0.12-7.6.1 typelib-1_0-NM-1_0-1.0.12-7.6.1 typelib-1_0-NMClient-1_0-1.0.12-7.6.1 typelib-1_0-NetworkManager-1_0-1.0.12-7.6.1 - openSUSE Leap 42.3 (noarch): NetworkManager-branding-upstream-1.0.12-7.6.1 NetworkManager-lang-1.0.12-7.6.1 - openSUSE Leap 42.3 (x86_64): NetworkManager-devel-32bit-1.0.12-7.6.1 libnm-glib-vpn1-32bit-1.0.12-7.6.1 libnm-glib-vpn1-debuginfo-32bit-1.0.12-7.6.1 libnm-glib4-32bit-1.0.12-7.6.1 libnm-glib4-debuginfo-32bit-1.0.12-7.6.1 libnm-util2-32bit-1.0.12-7.6.1 libnm-util2-debuginfo-32bit-1.0.12-7.6.1 References: https://bugzilla.suse.com/1019813

1 0

openSUSE-RU-2019:0333-1: moderate: Recommended update for arpwatch
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for arpwatch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0333-1 Rating: moderate References: #1119851 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for arpwatch provides the following fix: - Prevent a memory leak in gethname. (bsc#1119851) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-333=1 Package List: - openSUSE Leap 15.0 (x86_64): arpwatch-2.1a15-lp150.3.3.1 arpwatch-debuginfo-2.1a15-lp150.3.3.1 arpwatch-debugsource-2.1a15-lp150.3.3.1 arpwatch-ethercodes-build-2.1a15-lp150.3.3.1 References: https://bugzilla.suse.com/1119851

1 0

openSUSE-RU-2019:0336-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0336-1 Rating: moderate References: #1084379 #1103354 #1111286 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for nvme-cli fixes the following issues: - fabrics: allow nr_io/write/poll_queues and queue size to discovery (bsc#1084379) - fabrics: do not use 'queue_size' and 'nr_io_queues' for discovery controller (bsc#1111286) - fabrics: mask out invalid options during discovery (bsc#1111286) - nvme: Document '-Q' and '-i' for discovery and connect-all - Add 71-nvme-iopolicy-netapp.rules (bsc1124564) - Add FC-NVMe autoconnect scripts (bsc#1103354) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-336=1 Package List: - openSUSE Leap 15.0 (x86_64): nvme-cli-1.5-lp150.6.9.1 nvme-cli-debuginfo-1.5-lp150.6.9.1 nvme-cli-debugsource-1.5-lp150.6.9.1 References: https://bugzilla.suse.com/1084379 https://bugzilla.suse.com/1103354 https://bugzilla.suse.com/1111286

1 0

openSUSE-RU-2019:0330-1: moderate: Recommended update for supportutils
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0330-1 Rating: moderate References: #1094225 #1109664 #1120049 #1121043 #1127063 #1127069 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for supportutils fixes the following issues: - Dont show error if /proc/fb is not present (bsc#1127069) - Fixed issue where dasdview got called with wrong arguments (bsc#1109664) - Clarified -t argument description in help output (bsc#1121043) - Fixed grep error in NTP when /etc/cron.d is empty (bsc#1127063) - Collect systemd journal logs with minimum installation (bsc#1094225) - Fixed tar file generation (bsc#1120049) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-330=1 Package List: - openSUSE Leap 15.0 (noarch): supportutils-3.1.1-lp150.4.6.1 References: https://bugzilla.suse.com/1094225 https://bugzilla.suse.com/1109664 https://bugzilla.suse.com/1120049 https://bugzilla.suse.com/1121043 https://bugzilla.suse.com/1127063 https://bugzilla.suse.com/1127069

1 0

openSUSE-RU-2019:0331-1: moderate: Recommended update for python-boto
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for python-boto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0331-1 Rating: moderate References: #1116204 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-boto fixes the following issues: python-boto was updated to version 2.49.0: * Import the latest CA Bundle from certifi (:issue:`3818`, :sha:`e4699cba`) * Fix to support uploads to KMS-encrypted buckets. (:issue:`3800`, :sha:`0a1d9040`) * Support fetching GCS bucket encryption metadata. (:issue:`3799`, :sha:`132b64d2`) * Update layer1.py (:issue:`3765`, :sha:`53340159`) * Fix tests/unit/glacier/test_writer.py to make work with pypy. (:issue:`3762`, :sha:`8402c5d6`) * Removed the upstream builtin root certificate data for trusted CAs, as SUSE ships them seperately. (bsc#1116204) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-331=1 Package List: - openSUSE Leap 15.0 (noarch): python2-boto-2.49.0-lp150.3.3.1 python3-boto-2.49.0-lp150.3.3.1 References: https://bugzilla.suse.com/1116204

1 0

openSUSE-RU-2019:0337-1: moderate: Recommended update for unar
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for unar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0337-1 Rating: moderate References: #1110754 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for unar provides the following fix: - Add support for RAR self-extracting (SFX) archives. (bsc#1110754) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-337=1 Package List: - openSUSE Leap 15.0 (x86_64): unar-1.10.1-lp150.4.3.1 unar-debuginfo-1.10.1-lp150.4.3.1 unar-debugsource-1.10.1-lp150.4.3.1 References: https://bugzilla.suse.com/1110754

1 0

openSUSE-RU-2019:0332-1: moderate: Recommended update for bind
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0332-1 Rating: moderate References: #1094236 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bind fixes the following issues: - Fixes dynamic DNS updates against samba and Microsoft DNS servers (bsc#1094236). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-332=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bind-9.11.2-lp150.8.9.1 bind-chrootenv-9.11.2-lp150.8.9.1 bind-debuginfo-9.11.2-lp150.8.9.1 bind-debugsource-9.11.2-lp150.8.9.1 bind-devel-9.11.2-lp150.8.9.1 bind-lwresd-9.11.2-lp150.8.9.1 bind-lwresd-debuginfo-9.11.2-lp150.8.9.1 bind-utils-9.11.2-lp150.8.9.1 bind-utils-debuginfo-9.11.2-lp150.8.9.1 libbind9-160-9.11.2-lp150.8.9.1 libbind9-160-debuginfo-9.11.2-lp150.8.9.1 libdns169-9.11.2-lp150.8.9.1 libdns169-debuginfo-9.11.2-lp150.8.9.1 libirs-devel-9.11.2-lp150.8.9.1 libirs160-9.11.2-lp150.8.9.1 libirs160-debuginfo-9.11.2-lp150.8.9.1 libisc166-9.11.2-lp150.8.9.1 libisc166-debuginfo-9.11.2-lp150.8.9.1 libisccc160-9.11.2-lp150.8.9.1 libisccc160-debuginfo-9.11.2-lp150.8.9.1 libisccfg160-9.11.2-lp150.8.9.1 libisccfg160-debuginfo-9.11.2-lp150.8.9.1 liblwres160-9.11.2-lp150.8.9.1 liblwres160-debuginfo-9.11.2-lp150.8.9.1 - openSUSE Leap 15.0 (noarch): bind-doc-9.11.2-lp150.8.9.1 python3-bind-9.11.2-lp150.8.9.1 - openSUSE Leap 15.0 (x86_64): bind-devel-32bit-9.11.2-lp150.8.9.1 libbind9-160-32bit-9.11.2-lp150.8.9.1 libbind9-160-32bit-debuginfo-9.11.2-lp150.8.9.1 libdns169-32bit-9.11.2-lp150.8.9.1 libdns169-32bit-debuginfo-9.11.2-lp150.8.9.1 libirs160-32bit-9.11.2-lp150.8.9.1 libirs160-32bit-debuginfo-9.11.2-lp150.8.9.1 libisc166-32bit-9.11.2-lp150.8.9.1 libisc166-32bit-debuginfo-9.11.2-lp150.8.9.1 libisccc160-32bit-9.11.2-lp150.8.9.1 libisccc160-32bit-debuginfo-9.11.2-lp150.8.9.1 libisccfg160-32bit-9.11.2-lp150.8.9.1 libisccfg160-32bit-debuginfo-9.11.2-lp150.8.9.1 liblwres160-32bit-9.11.2-lp150.8.9.1 liblwres160-32bit-debuginfo-9.11.2-lp150.8.9.1 References: https://bugzilla.suse.com/1094236

1 0