April 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1277-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 26 Apr '19

26 Apr '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1277-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1277=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.8.2 kauth-devel-5.45.0-bp150.8.2 libKF5Auth5-5.45.0-bp150.8.2 libKF5Auth5-debuginfo-5.45.0-bp150.8.2 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x): libpolkit-qt5-1-1-0.112.0-bp150.3.6.1 libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.8.2 libKF5Auth5-64bit-5.45.0-bp150.8.2 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.8.2 libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1 libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.8.2 - openSUSE Backports SLE-15 (x86_64): libpolkit-qt5-1-1-0.112.0-bp150.3.6.2 libpolkit-qt5-1-devel-0.112.0-bp150.3.6.2 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863

1 0

openSUSE-SU-2019:1276-1: moderate: Security update for xmltooling
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for xmltooling ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1276-1 Rating: moderate References: #1129537 Cross-References: CVE-2019-9628 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmltooling fixes the following issue: Security issue fixed: - CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1276=1 Package List: - openSUSE Leap 42.3 (x86_64): libxmltooling-devel-1.5.6-12.1 libxmltooling6-1.5.6-12.1 libxmltooling6-debuginfo-1.5.6-12.1 xmltooling-debugsource-1.5.6-12.1 xmltooling-schemas-1.5.6-12.1 References: https://www.suse.com/security/cve/CVE-2019-9628.html https://bugzilla.suse.com/1129537

1 0

openSUSE-SU-2019:1274-1: important: Security update for qemu
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1274-1 Rating: important References: #1118900 #1125721 #1126455 #1129622 #1130675 #1131955 Cross-References: CVE-2018-20815 CVE-2019-3812 CVE-2019-8934 CVE-2019-9824 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-9824: Fixed information leak in slirp (bsc#1129622). - CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 hostinformation (bsc#1126455). - CVE-2019-3812: Fixed Out-of-bounds memory access and information leak in virtual monitor interface (bsc#1125721). - CVE-2018-20815: Fixed a denial of service possibility in device tree processing (bsc#1130675). Non-security issue fixed: - Backported Skylake-Server vcpu model support from qemu v2.11 (FATE#327261 bsc#1131955). - Added ability to set virtqueue size using virtqueue_size parameter (FATE#327255 bsc#1118900). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1274=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-59.1 qemu-linux-user-debuginfo-2.9.1-59.1 qemu-linux-user-debugsource-2.9.1-59.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0+-59.1 qemu-seabios-1.10.2-59.1 qemu-sgabios-8-59.1 qemu-vgabios-1.10.2-59.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-59.1 qemu-arm-2.9.1-59.1 qemu-arm-debuginfo-2.9.1-59.1 qemu-block-curl-2.9.1-59.1 qemu-block-curl-debuginfo-2.9.1-59.1 qemu-block-dmg-2.9.1-59.1 qemu-block-dmg-debuginfo-2.9.1-59.1 qemu-block-iscsi-2.9.1-59.1 qemu-block-iscsi-debuginfo-2.9.1-59.1 qemu-block-rbd-2.9.1-59.1 qemu-block-rbd-debuginfo-2.9.1-59.1 qemu-block-ssh-2.9.1-59.1 qemu-block-ssh-debuginfo-2.9.1-59.1 qemu-debugsource-2.9.1-59.1 qemu-extra-2.9.1-59.1 qemu-extra-debuginfo-2.9.1-59.1 qemu-guest-agent-2.9.1-59.1 qemu-guest-agent-debuginfo-2.9.1-59.1 qemu-ksm-2.9.1-59.1 qemu-kvm-2.9.1-59.1 qemu-lang-2.9.1-59.1 qemu-ppc-2.9.1-59.1 qemu-ppc-debuginfo-2.9.1-59.1 qemu-s390-2.9.1-59.1 qemu-s390-debuginfo-2.9.1-59.1 qemu-testsuite-2.9.1-59.2 qemu-tools-2.9.1-59.1 qemu-tools-debuginfo-2.9.1-59.1 qemu-x86-2.9.1-59.1 qemu-x86-debuginfo-2.9.1-59.1 References: https://www.suse.com/security/cve/CVE-2018-20815.html https://www.suse.com/security/cve/CVE-2019-3812.html https://www.suse.com/security/cve/CVE-2019-8934.html https://www.suse.com/security/cve/CVE-2019-9824.html https://bugzilla.suse.com/1118900 https://bugzilla.suse.com/1125721 https://bugzilla.suse.com/1126455 https://bugzilla.suse.com/1129622 https://bugzilla.suse.com/1130675 https://bugzilla.suse.com/1131955

1 0

openSUSE-SU-2019:1272-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1272-1 Rating: moderate References: #1132053 #1132054 #1132055 #1132058 #1132060 #1132061 Cross-References: CVE-2019-11005 CVE-2019-11006 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-11010 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2019-11005: Fixed a stack-based buffer overflow in SVGStartElement of coders/svg.c that allowed attackers to cause DOS or an unspecified impact (boo#1132058) - CVE-2019-11006: Fixed a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c that allowed attackers to cause DOS or information disclosure (boo#1132061) - CVE-2019-11010: Fixed a memory leak in ReadMPCImage of coders/mpc.c that which allowed attackers to cause DOS via a crafted image file (boo#1132055) - CVE-2019-11007: Fixed a heap-based buffer over-read in the ReadMNGImage function of coders/png.c that which allowed attackers to cause a denial of service or information disclosure (boo#1132060) - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c that which allowed remote attackers to cause DOS or other unspecified impact (boo#1132054) - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c that which allowed attackers to cause DOS or information disclosure (boo#1132053) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1272=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1272=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-132.1 GraphicsMagick-debuginfo-1.3.25-132.1 GraphicsMagick-debugsource-1.3.25-132.1 GraphicsMagick-devel-1.3.25-132.1 libGraphicsMagick++-Q16-12-1.3.25-132.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-132.1 libGraphicsMagick++-devel-1.3.25-132.1 libGraphicsMagick-Q16-3-1.3.25-132.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-132.1 libGraphicsMagick3-config-1.3.25-132.1 libGraphicsMagickWand-Q16-2-1.3.25-132.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-132.1 perl-GraphicsMagick-1.3.25-132.1 perl-GraphicsMagick-debuginfo-1.3.25-132.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.25.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1 GraphicsMagick-debugsource-1.3.29-lp150.3.25.1 GraphicsMagick-devel-1.3.29-lp150.3.25.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.25.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.25.1 libGraphicsMagick++-devel-1.3.29-lp150.3.25.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.25.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.25.1 libGraphicsMagick3-config-1.3.29-lp150.3.25.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.25.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.25.1 perl-GraphicsMagick-1.3.29-lp150.3.25.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1 References: https://www.suse.com/security/cve/CVE-2019-11005.html https://www.suse.com/security/cve/CVE-2019-11006.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11010.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132055 https://bugzilla.suse.com/1132058 https://bugzilla.suse.com/1132060 https://bugzilla.suse.com/1132061

1 0

openSUSE-SU-2019:1273-1: important: Security update for python
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1273-1 Rating: important References: #1129346 #1130847 Cross-References: CVE-2019-9636 CVE-2019-9948 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-9948: Fixed a 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead (bsc#1130847). - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1273=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): python-2.7.14-lp150.6.10.1 python-curses-2.7.14-lp150.6.10.1 python-curses-debuginfo-2.7.14-lp150.6.10.1 python-debuginfo-2.7.14-lp150.6.10.1 python-debugsource-2.7.14-lp150.6.10.1 python-demo-2.7.14-lp150.6.10.1 python-gdbm-2.7.14-lp150.6.10.1 python-gdbm-debuginfo-2.7.14-lp150.6.10.1 python-idle-2.7.14-lp150.6.10.1 python-tk-2.7.14-lp150.6.10.1 python-tk-debuginfo-2.7.14-lp150.6.10.1 - openSUSE Leap 15.0 (x86_64): python-32bit-2.7.14-lp150.6.10.1 python-32bit-debuginfo-2.7.14-lp150.6.10.1 References: https://www.suse.com/security/cve/CVE-2019-9636.html https://www.suse.com/security/cve/CVE-2019-9948.html https://bugzilla.suse.com/1129346 https://bugzilla.suse.com/1130847

1 0

openSUSE-SU-2019:1275-1: important: Security update for lxc, lxcfs
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for lxc, lxcfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1275-1 Rating: important References: #1122185 #1131762 #988348 Cross-References: CVE-2018-6556 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for lxc, lxcfs to version 3.1.0 fixes the following issues: Security issues fixed: - CVE-2019-5736: Fixed a container breakout vulnerability (boo#1122185). - CVE-2018-6556: Enable setuid bit on lxc-user-nic (boo#988348). Non-security issues fixed: - Update to LXC 3.1.0. The changelog is far too long to include here, please look at https://linuxcontainers.org/. (boo#1131762) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1275=1 Package List: - openSUSE Leap 15.0 (x86_64): liblxc-devel-3.1.0-lp150.2.10.1 liblxc1-3.1.0-lp150.2.10.1 liblxc1-debuginfo-3.1.0-lp150.2.10.1 lxc-3.1.0-lp150.2.10.1 lxc-debuginfo-3.1.0-lp150.2.10.1 lxc-debugsource-3.1.0-lp150.2.10.1 lxcfs-3.0.3-lp150.2.3.1 lxcfs-debuginfo-3.0.3-lp150.2.3.1 lxcfs-debugsource-3.0.3-lp150.2.3.1 pam_cgfs-3.1.0-lp150.2.10.1 pam_cgfs-debuginfo-3.1.0-lp150.2.10.1 - openSUSE Leap 15.0 (noarch): lxc-bash-completion-3.1.0-lp150.2.10.1 lxcfs-hooks-lxc-3.0.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-6556.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1122185 https://bugzilla.suse.com/1131762 https://bugzilla.suse.com/988348

1 0

openSUSE-RU-2019:1269-1: moderate: Recommended update for python-rpm-macros
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for python-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1269-1 Rating: moderate References: #1128323 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rpm-macros fixes the following issues: The Python RPM macros were updated to version 20190408.32abece, fixing bugs (bsc#1128323) * Add missing $ expansion on the pytest call * Rewrite pytest and pytest_arch into Lua macros with multiple arguments. * We should preserve existing PYTHONPATH. * Add --ignore to pytest calls to ignore build directories. * Actually make pytest into function to capture arguments as well * Add pytest definitions. * Use upstream-recommended %{_rpmconfigdir}/macros.d directory for the rpm macros. * Fix an issue with epoch printing having too many \ * add epoch while printing "Provides:" This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1269=1 Package List: - openSUSE Leap 15.0 (noarch): python-rpm-macros-20190408.32abece-lp150.2.3.1 References: https://bugzilla.suse.com/1128323

1 0

openSUSE-RU-2019:1271-1: moderate: Recommended update for sg3_utils
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for sg3_utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1271-1 Rating: moderate References: #1069384 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sg3_utils fixes the following issues: - rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1271=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsgutils-devel-1.43+43.158502d-18.1 libsgutils2-2-1.43+43.158502d-18.1 libsgutils2-2-debuginfo-1.43+43.158502d-18.1 sg3_utils-1.43+43.158502d-18.1 sg3_utils-debuginfo-1.43+43.158502d-18.1 sg3_utils-debugsource-1.43+43.158502d-18.1 References: https://bugzilla.suse.com/1069384

1 0

openSUSE-RU-2019:1266-1: moderate: Recommended update for hplip
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for hplip ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1266-1 Rating: moderate References: #1094141 #1096755 #1100511 #1112331 #1131613 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for hplip fixes the following issues: - Bugfix: hang during GNOME session logout. (bsc#1112331) - Removed Fix-scanning-with-python-pillow-4.2.0.patch as resolved upstream. (bsc#1096755) - Added support for 104 new printers/scanners/devices. See the changelog for the detailed list. - Added support for the several other distributions: - Require python3-Pillow for hp-scan to work. (bsc#1100511) - Bugfix: scanning with python-pillow 4.2.0. (bsc#1096755) - Bugfix: default behavior of DJ9xxVIP device must not be changed. - Avoid segfault in hplip/hpijs during PDF printing. (bsc#1094141) - File '/usr/lib/udev/rules.d/56-hpmud.rules' is no longer marked as config file - hplip: hp-scan is non-functional (bsc#1131613) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1266=1 Package List: - openSUSE Leap 15.0 (x86_64): hplip-3.18.6-lp150.4.3.1 hplip-debuginfo-3.18.6-lp150.4.3.1 hplip-debugsource-3.18.6-lp150.4.3.1 hplip-devel-3.18.6-lp150.4.3.1 hplip-hpijs-3.18.6-lp150.4.3.1 hplip-hpijs-debuginfo-3.18.6-lp150.4.3.1 hplip-sane-3.18.6-lp150.4.3.1 hplip-sane-debuginfo-3.18.6-lp150.4.3.1 References: https://bugzilla.suse.com/1094141 https://bugzilla.suse.com/1096755 https://bugzilla.suse.com/1100511 https://bugzilla.suse.com/1112331 https://bugzilla.suse.com/1131613

1 0

openSUSE-RU-2019:1267-1: moderate: Recommended update for keepassxc
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for keepassxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1267-1 Rating: moderate References: #1024998 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for brings keepassxc to version 2.4.1: * Several bugfixes and minor functional impovements * disable update check Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1267=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1267=1 Package List: - openSUSE Leap 15.0 (x86_64): keepassxc-2.4.1-lp150.2.6.1 keepassxc-debuginfo-2.4.1-lp150.2.6.1 keepassxc-debugsource-2.4.1-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): keepassxc-lang-2.4.1-lp150.2.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): keepassxc-2.4.1-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): keepassxc-lang-2.4.1-bp150.2.6.1 References: https://bugzilla.suse.com/1024998

1 0