April 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1113-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1113-1 Rating: moderate References: #1129633 Cross-References: CVE-2019-9894 CVE-2019-9895 CVE-2019-9896 CVE-2019-9897 CVE-2019-9898 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for putty fixes the following issues: Update to new upstream release 0.71 [boo#1129633] * CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography. * CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of server-to-client forwarding. * CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered by writing to the terminal. * CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography * CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable * Major rewrite of the crypto code to remove cache and timing side channels. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1113=1 Package List: - openSUSE Leap 15.0 (x86_64): putty-0.71-lp150.9.1 putty-debuginfo-0.71-lp150.9.1 putty-debugsource-0.71-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-9894.html https://www.suse.com/security/cve/CVE-2019-9895.html https://www.suse.com/security/cve/CVE-2019-9896.html https://www.suse.com/security/cve/CVE-2019-9897.html https://www.suse.com/security/cve/CVE-2019-9898.html https://bugzilla.suse.com/1129633

1 0

openSUSE-SU-2019:1109-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1109-1 Rating: moderate References: #1128471 #1128472 #1128474 #1128476 #1128480 #1128481 #1128490 #1128492 #1128493 Cross-References: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for libssh2_org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1109=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libssh2-1-1.8.0-lp150.3.3.1 libssh2-1-debuginfo-1.8.0-lp150.3.3.1 libssh2-devel-1.8.0-lp150.3.3.1 libssh2_org-debugsource-1.8.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libssh2-1-32bit-1.8.0-lp150.3.3.1 libssh2-1-32bit-debuginfo-1.8.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1128471 https://bugzilla.suse.com/1128472 https://bugzilla.suse.com/1128474 https://bugzilla.suse.com/1128476 https://bugzilla.suse.com/1128480 https://bugzilla.suse.com/1128481 https://bugzilla.suse.com/1128490 https://bugzilla.suse.com/1128492 https://bugzilla.suse.com/1128493

1 0

openSUSE-SU-2019:1115-1: moderate: Security update for libqt5-qtimageformats
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libqt5-qtimageformats ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1115-1 Rating: moderate References: #1118598 Cross-References: CVE-2018-19871 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtimageformats fixes the following issues: Security issues fixed: - CVE-2018-19871: Fixed CPU exhaustion in QTgaFile (bsc#1118598) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1115=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libqt5-qtimageformats-5.9.4-lp150.2.3.2 libqt5-qtimageformats-debuginfo-5.9.4-lp150.2.3.2 libqt5-qtimageformats-debugsource-5.9.4-lp150.2.3.2 libqt5-qtimageformats-devel-5.9.4-lp150.2.3.2 - openSUSE Leap 15.0 (x86_64): libqt5-qtimageformats-32bit-5.9.4-lp150.2.3.2 libqt5-qtimageformats-32bit-debuginfo-5.9.4-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-19871.html https://bugzilla.suse.com/1118598

1 0

openSUSE-SU-2019:1106-1: important: Security update for python-azure-agent
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1106-1 Rating: important References: #1127838 Cross-References: CVE-2019-0804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-azure-agent fixes the following issues: - CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1106=1 Package List: - openSUSE Leap 15.0 (noarch): python-azure-agent-2.2.36-lp150.5.10.1 python-azure-agent-test-2.2.36-lp150.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-0804.html https://bugzilla.suse.com/1127838

1 0

openSUSE-RU-2019:1103-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1103-1 Rating: moderate References: #1099674 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner fixes the following issues: spec-cleaner was updated to 1.1.3 boo#1099674: * Convert pytest calls to macros * Fix errors in %python_expand line expansions * update licenses list * Expand more excludes for curlification * Do not add accidental newlines to complex conditions Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1103=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1103=1 Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.1.3-60.1 spec-cleaner-format_spec_file-1.1.3-60.1 - openSUSE Leap 15.0 (noarch): spec-cleaner-1.1.3-lp150.61.1 spec-cleaner-format_spec_file-1.1.3-lp150.61.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:1099-1: moderate: Recommended update for firewalld
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for firewalld ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1099-1 Rating: moderate References: #1122151 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for firewalld fixes the following issues: - Fix --runtime-to-permanent error when NetworkMananger is not used. (bsc#1122151) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1099=1 Package List: - openSUSE Leap 15.0 (noarch): firewall-applet-0.5.5-lp150.2.22.2 firewall-config-0.5.5-lp150.2.22.2 firewall-macros-0.5.5-lp150.2.22.2 firewalld-0.5.5-lp150.2.22.2 firewalld-lang-0.5.5-lp150.2.22.2 python3-firewall-0.5.5-lp150.2.22.2 References: https://bugzilla.suse.com/1122151

1 0

openSUSE-RU-2019:1094-1: moderate: Recommended update for yast2-iscsi-client
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for yast2-iscsi-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1094-1 Rating: moderate References: #1099691 #1103681 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-iscsi-client fixes the following issues: - Fix detection of service current status (bsc#1103681) - Added additional searchkeys to desktop file (fate#321043, bsc#1099691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1094=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-iscsi-client-4.0.2-lp150.2.3.1 References: https://bugzilla.suse.com/1099691 https://bugzilla.suse.com/1103681

1 0

openSUSE-RU-2019:1100-1: moderate: Recommended update for glibc
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1100-1 Rating: moderate References: #1063675 #1112570 #1114984 #1114993 #1126590 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for glibc fixes the following issues: - Fix Haswell CPU string flags. (bsc#1114984) - Fix waiters-after-spinning case. (bsc#1114993) - Do not relocate absolute symbols. (bsc#1112570) - Add glibc-locale-base subpackage containing only C, C.UTF-8 and en_US.UTF-8 locales. (fate#326551) - Add HWCAP_ATOMICS to HWCAP_IMPORTANT (fate#325962) - Remove slow paths from math routines. (fate#325815, fate#325879, fate#325880, fate#325881, fate#325882) - Add MAP_SYNC from Linux 4.15 (bsc#1126590) - Add MAP_SHARED_VALIDATE from Linux 4.15 (bsc#1126590) - nptl: Preserve error in setxid thread broadcast in coredumps (bsc#1063675, BZ #22153) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1100=1 Package List: - openSUSE Leap 15.0 (i586 i686 x86_64): glibc-2.26-lp150.11.14.2 glibc-debuginfo-2.26-lp150.11.14.2 glibc-debugsource-2.26-lp150.11.14.2 glibc-devel-2.26-lp150.11.14.2 glibc-devel-debuginfo-2.26-lp150.11.14.2 glibc-devel-static-2.26-lp150.11.14.2 glibc-locale-2.26-lp150.11.14.2 glibc-locale-base-2.26-lp150.11.14.2 glibc-locale-base-debuginfo-2.26-lp150.11.14.2 glibc-profile-2.26-lp150.11.14.2 - openSUSE Leap 15.0 (i586 x86_64): glibc-extra-2.26-lp150.11.14.2 glibc-extra-debuginfo-2.26-lp150.11.14.2 glibc-utils-2.26-lp150.11.14.2 glibc-utils-debuginfo-2.26-lp150.11.14.2 glibc-utils-src-debugsource-2.26-lp150.11.14.2 nscd-2.26-lp150.11.14.2 nscd-debuginfo-2.26-lp150.11.14.2 - openSUSE Leap 15.0 (x86_64): glibc-32bit-2.26-lp150.11.14.2 glibc-32bit-debuginfo-2.26-lp150.11.14.2 glibc-devel-32bit-2.26-lp150.11.14.2 glibc-devel-32bit-debuginfo-2.26-lp150.11.14.2 glibc-devel-static-32bit-2.26-lp150.11.14.2 glibc-locale-base-32bit-2.26-lp150.11.14.2 glibc-locale-base-32bit-debuginfo-2.26-lp150.11.14.2 glibc-profile-32bit-2.26-lp150.11.14.2 glibc-utils-32bit-2.26-lp150.11.14.2 glibc-utils-32bit-debuginfo-2.26-lp150.11.14.2 - openSUSE Leap 15.0 (noarch): glibc-html-2.26-lp150.11.14.2 glibc-i18ndata-2.26-lp150.11.14.2 glibc-info-2.26-lp150.11.14.2 References: https://bugzilla.suse.com/1063675 https://bugzilla.suse.com/1112570 https://bugzilla.suse.com/1114984 https://bugzilla.suse.com/1114993 https://bugzilla.suse.com/1126590

1 0

openSUSE-RU-2019:1091-1: Recommended update for gpgme
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for gpgme ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1091-1 Rating: low References: #1121051 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gpgme provides the following fix: - Re-generate keys in Qt tests to not expire. (bsc#1121051) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1091=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gpgme-1.10.0-lp150.3.3.1 gpgme-debuginfo-1.10.0-lp150.3.3.1 gpgme-debugsource-1.10.0-lp150.3.3.1 libgpgme-devel-1.10.0-lp150.3.3.1 libgpgme11-1.10.0-lp150.3.3.1 libgpgme11-debuginfo-1.10.0-lp150.3.3.1 libgpgmepp-devel-1.10.0-lp150.3.3.1 libgpgmepp6-1.10.0-lp150.3.3.1 libgpgmepp6-debuginfo-1.10.0-lp150.3.3.1 libqgpgme-devel-1.10.0-lp150.3.3.1 libqgpgme7-1.10.0-lp150.3.3.1 libqgpgme7-debuginfo-1.10.0-lp150.3.3.1 python2-gpg-1.10.0-lp150.3.3.1 python2-gpg-debuginfo-1.10.0-lp150.3.3.1 python3-gpg-1.10.0-lp150.3.3.1 python3-gpg-debuginfo-1.10.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libgpgme11-32bit-1.10.0-lp150.3.3.1 libgpgme11-32bit-debuginfo-1.10.0-lp150.3.3.1 libgpgmepp6-32bit-1.10.0-lp150.3.3.1 libgpgmepp6-32bit-debuginfo-1.10.0-lp150.3.3.1 libqgpgme7-32bit-1.10.0-lp150.3.3.1 libqgpgme7-32bit-debuginfo-1.10.0-lp150.3.3.1 References: https://bugzilla.suse.com/1121051

1 0

openSUSE-RU-2019:1097-1: moderate: Recommended update for cyrus-sasl
by maintenance＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Recommended Update: Recommended update for cyrus-sasl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1097-1 Rating: moderate References: #1044840 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cyrus-sasl provides the following fix: - Fix a problem that was causing syslog to be polluted with messages "GSSAPI client step 1". By server context the connection will be sent to the log function but the client content does not have log level information, so there is no way to stop DEBUG level logs. (bsc#1044840) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1097=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cyrus-sasl-2.1.26-lp150.4.3.2 cyrus-sasl-crammd5-2.1.26-lp150.4.3.2 cyrus-sasl-crammd5-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-debugsource-2.1.26-lp150.4.3.2 cyrus-sasl-devel-2.1.26-lp150.4.3.2 cyrus-sasl-digestmd5-2.1.26-lp150.4.3.2 cyrus-sasl-digestmd5-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-gs2-2.1.26-lp150.4.3.2 cyrus-sasl-gs2-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-gssapi-2.1.26-lp150.4.3.2 cyrus-sasl-gssapi-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-ntlm-2.1.26-lp150.4.3.2 cyrus-sasl-ntlm-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-otp-2.1.26-lp150.4.3.2 cyrus-sasl-otp-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-plain-2.1.26-lp150.4.3.2 cyrus-sasl-plain-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-scram-2.1.26-lp150.4.3.2 cyrus-sasl-scram-debuginfo-2.1.26-lp150.4.3.2 libsasl2-3-2.1.26-lp150.4.3.2 libsasl2-3-debuginfo-2.1.26-lp150.4.3.2 - openSUSE Leap 15.0 (x86_64): cyrus-sasl-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-crammd5-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-crammd5-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-devel-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-digestmd5-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-digestmd5-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-gssapi-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-gssapi-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-ldap-auxprop-2.1.26-lp150.4.3.2 cyrus-sasl-ldap-auxprop-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-otp-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-otp-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-plain-32bit-2.1.26-lp150.4.3.2 cyrus-sasl-plain-32bit-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-saslauthd-2.1.26-lp150.4.3.2 cyrus-sasl-saslauthd-debuginfo-2.1.26-lp150.4.3.2 cyrus-sasl-saslauthd-debugsource-2.1.26-lp150.4.3.2 cyrus-sasl-sqlauxprop-2.1.26-lp150.4.3.2 cyrus-sasl-sqlauxprop-debuginfo-2.1.26-lp150.4.3.2 libsasl2-3-32bit-2.1.26-lp150.4.3.2 libsasl2-3-32bit-debuginfo-2.1.26-lp150.4.3.2 References: https://bugzilla.suse.com/1044840

1 0