April 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1163-1: moderate: Security update for ldb
by opensuse-security＠opensuse.org 05 Apr '19

05 Apr '19

openSUSE Security Update: Security update for ldb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1163-1 Rating: moderate References: #1125410 Cross-References: CVE-2019-3824 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ldb fixes the following issue: Security issue fixed: - CVE-2019-3824: Fixed an out-of-bound read vulnerability in ldb_wildcard_compare (bsc#1125410). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1163=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ldb-debugsource-1.2.3-lp150.7.2 ldb-tools-1.2.3-lp150.7.2 ldb-tools-debuginfo-1.2.3-lp150.7.2 libldb-devel-1.2.3-lp150.7.2 libldb1-1.2.3-lp150.7.2 libldb1-debuginfo-1.2.3-lp150.7.2 python-ldb-1.2.3-lp150.7.2 python-ldb-debuginfo-1.2.3-lp150.7.2 python-ldb-devel-1.2.3-lp150.7.2 python3-ldb-1.2.3-lp150.7.2 python3-ldb-debuginfo-1.2.3-lp150.7.2 python3-ldb-devel-1.2.3-lp150.7.2 - openSUSE Leap 15.0 (x86_64): libldb1-32bit-1.2.3-lp150.7.2 libldb1-32bit-debuginfo-1.2.3-lp150.7.2 python-ldb-32bit-1.2.3-lp150.7.2 python-ldb-32bit-debuginfo-1.2.3-lp150.7.2 python3-ldb-32bit-1.2.3-lp150.7.2 python3-ldb-32bit-debuginfo-1.2.3-lp150.7.2 References: https://www.suse.com/security/cve/CVE-2019-3824.html https://bugzilla.suse.com/1125410

1 0

openSUSE-RU-2019:1157-1: moderate: Recommended update for python-certbot
by maintenance＠opensuse.org 05 Apr '19

05 Apr '19

openSUSE Recommended Update: Recommended update for python-certbot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1157-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-certbot fixes the following issues: - Provide certbot namespace on py2 too to avoid migration conflict Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1157=1 Package List: - openSUSE Leap 15.0 (noarch): python2-certbot-0.30.2-lp150.6.1 python3-certbot-0.30.2-lp150.6.1 References:

1 0

openSUSE-RU-2019:1153-1: moderate: Recommended update for PackageKit-Qt
by maintenance＠opensuse.org 05 Apr '19

05 Apr '19

openSUSE Recommended Update: Recommended update for PackageKit-Qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1153-1 Rating: moderate References: #1103678 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for PackageKit-Qt fixes the following issues: - Uses now the NetworkManager's dbus signal when PackageKit is not running and thus, can't emit a propertiesUpdated signal when the network changes its state. (boo#1103678) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1153=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): PackageKit-Qt-devel-0.9.6-bp150.3.3.1 libpackagekitqt5-0-0.9.6-bp150.3.3.1 References: https://bugzilla.suse.com/1103678

1 0

openSUSE-RU-2019:1150-1: moderate: Recommended update for xmonad
by maintenance＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Recommended Update: Recommended update for xmonad ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1150-1 Rating: moderate References: #1128329 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xmonad fixes the following issues: - Fix focus when pointer entering empty workspace. - Fix issues where xmonad would not start because an incorrect serialized state file was still lying around in the user's home. The patch comes from https://github.com/xmonad/xmonad/pull/91 (boo#1128329). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1150=1 Package List: - openSUSE Leap 15.0 (x86_64): ghc-xmonad-0.13-lp150.2.3.1 ghc-xmonad-devel-0.13-lp150.2.3.1 xmonad-0.13-lp150.2.3.1 References: https://bugzilla.suse.com/1128329

1 0

openSUSE-SU-2019:1141-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1141-1 Rating: moderate References: #1106415 #1106996 #1113064 #1120381 #1124365 #1124366 #1124367 #1124368 #1128649 Cross-References: CVE-2018-16412 CVE-2018-18544 CVE-2018-20467 CVE-2019-7175 CVE-2019-7395 CVE-2019-7396 CVE-2019-7397 CVE-2019-7398 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). - CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage (bsc#1113064). - CVE-2018-20467: Fixed an infinite loop in coders/bmp.c (bsc#1120381). - CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). - CVE-2019-7396: Fixed a memory leak in the function ReadSIXELImage (bsc#1124367). - CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). - CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). - CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996). Non-security issue fixed: - Fixed a regression in regards to the 'edge' comand line flag (bsc#1106415) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1141=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.26.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.26.1 ImageMagick-debugsource-7.0.7.34-lp150.2.26.1 ImageMagick-devel-7.0.7.34-lp150.2.26.1 ImageMagick-extra-7.0.7.34-lp150.2.26.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.26.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.26.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.26.1 libMagick++-devel-7.0.7.34-lp150.2.26.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.26.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.26.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.26.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.26.1 perl-PerlMagick-7.0.7.34-lp150.2.26.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.26.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.26.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.26.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.26.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.26.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.26.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.26.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.26.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.26.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.26.1 References: https://www.suse.com/security/cve/CVE-2018-16412.html https://www.suse.com/security/cve/CVE-2018-18544.html https://www.suse.com/security/cve/CVE-2018-20467.html https://www.suse.com/security/cve/CVE-2019-7175.html https://www.suse.com/security/cve/CVE-2019-7395.html https://www.suse.com/security/cve/CVE-2019-7396.html https://www.suse.com/security/cve/CVE-2019-7397.html https://www.suse.com/security/cve/CVE-2019-7398.html https://bugzilla.suse.com/1106415 https://bugzilla.suse.com/1106996 https://bugzilla.suse.com/1113064 https://bugzilla.suse.com/1120381 https://bugzilla.suse.com/1124365 https://bugzilla.suse.com/1124366 https://bugzilla.suse.com/1124367 https://bugzilla.suse.com/1124368 https://bugzilla.suse.com/1128649

1 0

openSUSE-SU-2019:1144-1: moderate: Security update for libcaca
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for libcaca ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1144-1 Rating: moderate References: #1120470 #1120502 #1120503 #1120504 #1120584 #1120589 Cross-References: CVE-2018-20544 CVE-2018-20545 CVE-2018-20546 CVE-2018-20547 CVE-2018-20548 CVE-2018-20549 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for libcaca fixes the following issues: Security issues fixed: - CVE-2018-20544: Fixed a floating point exception at caca/dither.c (bsc#1120502) - CVE-2018-20545: Fixed a WRITE memory access in the load_image function at common-image.c for 4bpp (bsc#1120584) - CVE-2018-20546: Fixed a READ memory access in the get_rgba_default function at caca/dither.c for bpp (bsc#1120503) - CVE-2018-20547: Fixed a READ memory access in the get_rgba_default function at caca/dither.c for 24bpp (bsc#1120504) - CVE-2018-20548: Fixed a WRITE memory access in the load_image function at common-image.c for 1bpp (bsc#1120589) - CVE-2018-20549: Fixed a WRITE memory access in the caca_file_read function at caca/file.c (bsc#1120470) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1144=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): caca-utils-0.99.beta19.git20171003-lp150.2.3.1 caca-utils-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 libcaca-debugsource-0.99.beta19.git20171003-lp150.2.3.1 libcaca-devel-0.99.beta19.git20171003-lp150.2.3.1 libcaca-ruby-0.99.beta19.git20171003-lp150.2.3.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-plugins-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): python3-caca-0.99.beta19.git20171003-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-lp150.2.3.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20544.html https://www.suse.com/security/cve/CVE-2018-20545.html https://www.suse.com/security/cve/CVE-2018-20546.html https://www.suse.com/security/cve/CVE-2018-20547.html https://www.suse.com/security/cve/CVE-2018-20548.html https://www.suse.com/security/cve/CVE-2018-20549.html https://bugzilla.suse.com/1120470 https://bugzilla.suse.com/1120502 https://bugzilla.suse.com/1120503 https://bugzilla.suse.com/1120504 https://bugzilla.suse.com/1120584 https://bugzilla.suse.com/1120589

1 0

openSUSE-SU-2019:1143-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1143-1 Rating: moderate References: #1128525 Cross-References: CVE-2019-8936 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ntp fixes the following issues: Security issue fixed: - CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd (bsc#1128525). Other issues addressed: - Fixed several bugs in the BANCOMM reclock driver. - Fixed ntp_loopfilter.c snprintf compilation warnings. - Fixed spurious initgroups() error message. - Fixed STA_NANO struct timex units. - Fixed GPS week rollover in libparse. - Fixed incorrect poll interval in packet. - Added a missing check for ENABLE_CMAC. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1143=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ntp-4.2.8p13-lp150.8.1 ntp-debuginfo-4.2.8p13-lp150.8.1 ntp-debugsource-4.2.8p13-lp150.8.1 ntp-doc-4.2.8p13-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-8936.html https://bugzilla.suse.com/1128525

1 0

openSUSE-SU-2019:1140-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1140-1 Rating: moderate References: #1123361 #1123522 Cross-References: CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gd fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1140=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-30.1 gd-debuginfo-2.1.0-30.1 gd-debugsource-2.1.0-30.1 gd-devel-2.1.0-30.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-30.1 gd-debuginfo-32bit-2.1.0-30.1 References: https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1123361 https://bugzilla.suse.com/1123522

1 0

openSUSE-RU-2019:1151-1: moderate: Recommended update for PackageKit-Qt
by maintenance＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Recommended Update: Recommended update for PackageKit-Qt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1151-1 Rating: moderate References: #1103678 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for PackageKit-Qt fixes the following issues: - Uses now the NetworkManager's dbus signal when PackageKit is not running and thus, can't emit a propertiesUpdated signal when the network changes its state. (boo#1103678) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1151=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): PackageKit-Qt-devel-0.9.6-lp150.3.3.1 libpackagekitqt5-0-0.9.6-lp150.3.3.1 libpackagekitqt5-0-debuginfo-0.9.6-lp150.3.3.1 References: https://bugzilla.suse.com/1103678

1 0

openSUSE-SU-2019:1139-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1139-1 Rating: moderate References: #1128503 Cross-References: CVE-2018-12181 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issue: Security issue fixed: - CVE-2018-12181: Fixed a stack buffer overflow in the HII database when a corrupted Bitmap was used (bsc#1128503). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1139=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-19.1 ovmf-tools-2017+git1492060560.b6d11d7c46-19.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-19.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-19.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-19.1 References: https://www.suse.com/security/cve/CVE-2018-12181.html https://bugzilla.suse.com/1128503

1 0