April 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1268-1: important: Recommended update for btrfsprogs
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for btrfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1268-1 Rating: important References: #1122539 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for btrfsprogs provides the following: - Advise user of fs recovery options when we fail to mount (bsc#1122539) - Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1268=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): btrfsprogs-4.15-lp150.2.3.1 btrfsprogs-debuginfo-4.15-lp150.2.3.1 btrfsprogs-debugsource-4.15-lp150.2.3.1 libbtrfs-devel-4.15-lp150.2.3.1 libbtrfs0-4.15-lp150.2.3.1 libbtrfs0-debuginfo-4.15-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): btrfsprogs-udev-rules-4.15-lp150.2.3.1 References: https://bugzilla.suse.com/1122539

1 0

openSUSE-RU-2019:1270-1: moderate: Recommended update for virt-manager
by maintenance＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Recommended Update: Recommended update for virt-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1270-1 Rating: moderate References: #1054986 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for virt-manager fixes the following issues: - Bugfix: SUSE Linux Enterprise 15 SP1 was not detected correctly (bsc#1054986) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1270=1 Package List: - openSUSE Leap 15.0 (noarch): virt-install-1.5.1-lp150.6.10.1 virt-manager-1.5.1-lp150.6.10.1 virt-manager-common-1.5.1-lp150.6.10.1 References: https://bugzilla.suse.com/1054986

1 0

openSUSE-SU-2019:1264-1: moderate: Security update for slurm
by opensuse-security＠opensuse.org 24 Apr '19

24 Apr '19

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1264-1 Rating: moderate References: #1123304 Cross-References: CVE-2019-6438 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm to version 17.11.13 fixes the following issues: Security issue fixed: - CVE-2019-6438: Fixed a heap overflow on 32-bit systems in xmalloc (bsc#1123304). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1264=1 Package List: - openSUSE Leap 15.0 (x86_64): libpmi0-17.11.13-lp150.5.20.1 libpmi0-debuginfo-17.11.13-lp150.5.20.1 libslurm32-17.11.13-lp150.5.20.1 libslurm32-debuginfo-17.11.13-lp150.5.20.1 perl-slurm-17.11.13-lp150.5.20.1 perl-slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-17.11.13-lp150.5.20.1 slurm-auth-none-17.11.13-lp150.5.20.1 slurm-auth-none-debuginfo-17.11.13-lp150.5.20.1 slurm-config-17.11.13-lp150.5.20.1 slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-debugsource-17.11.13-lp150.5.20.1 slurm-devel-17.11.13-lp150.5.20.1 slurm-doc-17.11.13-lp150.5.20.1 slurm-lua-17.11.13-lp150.5.20.1 slurm-lua-debuginfo-17.11.13-lp150.5.20.1 slurm-munge-17.11.13-lp150.5.20.1 slurm-munge-debuginfo-17.11.13-lp150.5.20.1 slurm-node-17.11.13-lp150.5.20.1 slurm-node-debuginfo-17.11.13-lp150.5.20.1 slurm-openlava-17.11.13-lp150.5.20.1 slurm-pam_slurm-17.11.13-lp150.5.20.1 slurm-pam_slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-plugins-17.11.13-lp150.5.20.1 slurm-plugins-debuginfo-17.11.13-lp150.5.20.1 slurm-seff-17.11.13-lp150.5.20.1 slurm-sjstat-17.11.13-lp150.5.20.1 slurm-slurmdbd-17.11.13-lp150.5.20.1 slurm-slurmdbd-debuginfo-17.11.13-lp150.5.20.1 slurm-sql-17.11.13-lp150.5.20.1 slurm-sql-debuginfo-17.11.13-lp150.5.20.1 slurm-sview-17.11.13-lp150.5.20.1 slurm-sview-debuginfo-17.11.13-lp150.5.20.1 slurm-torque-17.11.13-lp150.5.20.1 slurm-torque-debuginfo-17.11.13-lp150.5.20.1 References: https://www.suse.com/security/cve/CVE-2019-6438.html https://bugzilla.suse.com/1123304

1 0

openSUSE-SU-2019:1265-1: Security update for openexr
by opensuse-security＠opensuse.org 24 Apr '19

24 Apr '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1265-1 Rating: low References: #1113455 Cross-References: CVE-2018-18444 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openexr fixes the following issues: Security issue fixed: - CVE-2018-18444: Fixed Out-of-bounds write in makeMultiView.cpp (bsc#1113455). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1265=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp150.2.3.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp150.2.3.1 openexr-2.2.1-lp150.2.3.1 openexr-debuginfo-2.2.1-lp150.2.3.1 openexr-debugsource-2.2.1-lp150.2.3.1 openexr-devel-2.2.1-lp150.2.3.1 openexr-doc-2.2.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp150.2.3.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18444.html https://bugzilla.suse.com/1113455

1 0

openSUSE-SU-2019:1261-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1261-1 Rating: moderate References: #1124799 #1124800 #1124802 #1124803 #1124805 #1124806 #1124824 #1124825 #1124826 #1124827 #1125099 Cross-References: CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575 CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635 CVE-2019-7636 CVE-2019-7637 CVE-2019-7638 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: Security issues fixed: - CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806). - CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099). - CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799). - CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805). - CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827). - CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826). - CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824). - CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803). - CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802). - CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825). - CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1261=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2-debugsource-2.0.8-lp150.2.3.1 libSDL2-2_0-0-2.0.8-lp150.2.3.1 libSDL2-2_0-0-debuginfo-2.0.8-lp150.2.3.1 libSDL2-devel-2.0.8-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp150.2.3.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp150.2.3.1 libSDL2-devel-32bit-2.0.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7572.html https://www.suse.com/security/cve/CVE-2019-7573.html https://www.suse.com/security/cve/CVE-2019-7574.html https://www.suse.com/security/cve/CVE-2019-7575.html https://www.suse.com/security/cve/CVE-2019-7576.html https://www.suse.com/security/cve/CVE-2019-7577.html https://www.suse.com/security/cve/CVE-2019-7578.html https://www.suse.com/security/cve/CVE-2019-7635.html https://www.suse.com/security/cve/CVE-2019-7636.html https://www.suse.com/security/cve/CVE-2019-7637.html https://www.suse.com/security/cve/CVE-2019-7638.html https://bugzilla.suse.com/1124799 https://bugzilla.suse.com/1124800 https://bugzilla.suse.com/1124802 https://bugzilla.suse.com/1124803 https://bugzilla.suse.com/1124805 https://bugzilla.suse.com/1124806 https://bugzilla.suse.com/1124824 https://bugzilla.suse.com/1124825 https://bugzilla.suse.com/1124826 https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1125099

1 0

openSUSE-SU-2019:1260-1: Security update for audiofile
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for audiofile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1260-1 Rating: low References: #1100523 Cross-References: CVE-2018-13440 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for audiofile fixes the following issues: Security issue fixed: - CVE-2018-13440: Return AF_FAIL instead of causing NULL pointer dereferences later (bsc#1100523). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1260=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): audiofile-0.3.6-lp150.7.1 audiofile-debuginfo-0.3.6-lp150.7.1 audiofile-debugsource-0.3.6-lp150.7.1 audiofile-devel-0.3.6-lp150.7.1 audiofile-doc-0.3.6-lp150.7.1 libaudiofile1-0.3.6-lp150.7.1 libaudiofile1-debuginfo-0.3.6-lp150.7.1 - openSUSE Leap 15.0 (x86_64): audiofile-devel-32bit-0.3.6-lp150.7.1 libaudiofile1-32bit-0.3.6-lp150.7.1 libaudiofile1-32bit-debuginfo-0.3.6-lp150.7.1 References: https://www.suse.com/security/cve/CVE-2018-13440.html https://bugzilla.suse.com/1100523

1 0

openSUSE-SU-2019:1259-1: moderate: Security update for libqt5-qtvirtualkeyboard
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for libqt5-qtvirtualkeyboard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1259-1 Rating: moderate References: #1118593 Cross-References: CVE-2018-19865 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtvirtualkeyboard fixes the following issues: Security issue fixed: - CVE-2018-19865: Fixed an issue with verbose keypress logging (boo#1118593). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1259=1 Package List: - openSUSE Leap 15.0 (x86_64): libqt5-qtvirtualkeyboard-5.9.4-lp150.2.3.1 libqt5-qtvirtualkeyboard-debuginfo-5.9.4-lp150.2.3.1 libqt5-qtvirtualkeyboard-debugsource-5.9.4-lp150.2.3.1 libqt5-qtvirtualkeyboard-devel-5.9.4-lp150.2.3.1 libqt5-qtvirtualkeyboard-examples-5.9.4-lp150.2.3.1 libqt5-qtvirtualkeyboard-examples-debuginfo-5.9.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19865.html https://bugzilla.suse.com/1118593

1 0

openSUSE-SU-2019:1263-1: moderate: Security update for libqt5-qtvirtualkeyboard
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for libqt5-qtvirtualkeyboard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1263-1 Rating: moderate References: #1118593 Cross-References: CVE-2018-19865 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtvirtualkeyboard fixes the following issues: Security issue fixed: - CVE-2018-19865: Fixed an issue with verbose keypress logging (boo#1118593). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1263=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libqt5-qtvirtualkeyboard-5.9.4-bp150.3.3.1 libqt5-qtvirtualkeyboard-devel-5.9.4-bp150.3.3.1 libqt5-qtvirtualkeyboard-examples-5.9.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-19865.html https://bugzilla.suse.com/1118593

1 0

openSUSE-RU-2019:1262-1: moderate: Recommended update for datovka
by maintenance＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Recommended Update: Recommended update for datovka ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1262-1 Rating: moderate References: #1104620 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for datovka fixes the following issues: - Update to 4.13.0 (boo#1104620): * Account renaming now possible * Special format downloading now alloved to "spisova sluzba" This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1262=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): datovka-4.13.0-bp150.15.1 References: https://bugzilla.suse.com/1104620

1 0

openSUSE-SU-2019:1258-1: important: Security update for apache2
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1258-1 Rating: important References: #1131233 #1131237 #1131239 #1131241 #1131245 Cross-References: CVE-2019-0196 CVE-2019-0197 CVE-2019-0211 CVE-2019-0217 CVE-2019-0220 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: * CVE-2019-0220: The Apache HTTP server did not use a consistent strategy for URL normalization throughout all of its components. In particular, consecutive slashes were not always collapsed. Attackers could potentially abuse these inconsistencies to by-pass access control mechanisms and thus gain unauthorized access to protected parts of the service. [bsc#1131241] * CVE-2019-0217: A race condition in Apache's "mod_auth_digest" when running in a threaded server could have allowed users with valid credentials to authenticate using another username, bypassing configured access control restrictions. [bsc#1131239] * CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged child processes or threads to execute arbitrary code with the privileges of the parent process. Attackers with control over CGI scripts or extension modules run by the server could have abused this issue to potentially gain super user privileges. [bsc#1131233] * CVE-2019-0197: When HTTP/2 support was enabled in the Apache server for a 'http' host or H2Upgrade was enabled for h2 on a 'https' host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. This issue could have been abused to mount a denial-of-service attack. Servers that never enabled the h2 protocol or that only enabled it for https: and did not configure the "H2Upgrade on" are unaffected. [bsc#1131245] * CVE-2019-0196: Through specially crafted network input the Apache's http/2 request handler could be lead to access previously freed memory while determining the method of a request. This resulted in the request being misclassified and thus being processed incorrectly. [bsc#1131237] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1258=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-49.1 apache2-debuginfo-2.4.23-49.1 apache2-debugsource-2.4.23-49.1 apache2-devel-2.4.23-49.1 apache2-event-2.4.23-49.1 apache2-event-debuginfo-2.4.23-49.1 apache2-example-pages-2.4.23-49.1 apache2-prefork-2.4.23-49.1 apache2-prefork-debuginfo-2.4.23-49.1 apache2-utils-2.4.23-49.1 apache2-utils-debuginfo-2.4.23-49.1 apache2-worker-2.4.23-49.1 apache2-worker-debuginfo-2.4.23-49.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-49.1 References: https://www.suse.com/security/cve/CVE-2019-0196.html https://www.suse.com/security/cve/CVE-2019-0197.html https://www.suse.com/security/cve/CVE-2019-0211.html https://www.suse.com/security/cve/CVE-2019-0217.html https://www.suse.com/security/cve/CVE-2019-0220.html https://bugzilla.suse.com/1131233 https://bugzilla.suse.com/1131237 https://bugzilla.suse.com/1131239 https://bugzilla.suse.com/1131241 https://bugzilla.suse.com/1131245

1 0