May 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1455-1: Security update for transfig
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1455-1 Rating: low References: #1106531 Cross-References: CVE-2018-16140 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for transfig fixes the following issues: Security issue fixed: - CVE-2018-16140: Fixed a buffer underwrite vulnerability in get_line() in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file (bsc#1106531) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1455=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1455=1 Package List: - openSUSE Leap 15.1 (x86_64): transfig-3.2.6a-lp151.4.3.1 transfig-debuginfo-3.2.6a-lp151.4.3.1 transfig-debugsource-3.2.6a-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): transfig-3.2.6a-lp150.3.3.2 transfig-debuginfo-3.2.6a-lp150.3.3.2 transfig-debugsource-3.2.6a-lp150.3.3.2 References: https://www.suse.com/security/cve/CVE-2018-16140.html https://bugzilla.suse.com/1106531

1 0

openSUSE-SU-2019:1456-1: important: Security update for chromium
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1456-1 Rating: important References: #1134218 Cross-References: CVE-2019-5824 CVE-2019-5827 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.157: - Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): - CVE-2019-5827: Out-of-bounds access in SQLite - CVE-2019-5824: Parameter passing error in media player Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1456=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1456=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1456=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-74.0.3729.157-211.1 chromedriver-debuginfo-74.0.3729.157-211.1 chromium-74.0.3729.157-211.1 chromium-debuginfo-74.0.3729.157-211.1 chromium-debugsource-74.0.3729.157-211.1 - openSUSE Leap 15.1 (x86_64): chromedriver-74.0.3729.157-lp151.2.3.1 chromedriver-debuginfo-74.0.3729.157-lp151.2.3.1 chromium-74.0.3729.157-lp151.2.3.1 chromium-debuginfo-74.0.3729.157-lp151.2.3.1 chromium-debugsource-74.0.3729.157-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): chromedriver-74.0.3729.157-lp150.212.1 chromedriver-debuginfo-74.0.3729.157-lp150.212.1 chromium-74.0.3729.157-lp150.212.1 chromium-debuginfo-74.0.3729.157-lp150.212.1 chromium-debugsource-74.0.3729.157-lp150.212.1 References: https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://bugzilla.suse.com/1134218

1 0

openSUSE-SU-2019:1450-1: important: Security update for systemd
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1450-1 Rating: important References: #1080919 #1121563 #1125352 #1126056 #1127557 #1128657 #1130230 #1132348 #1132400 #1132721 #955942 Cross-References: CVE-2018-6954 CVE-2019-3842 CVE-2019-6454 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 8 fixes is now available. Description: This update for systemd fixes the following issues: Security issues fixed: - CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files (bsc#1080919). - CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348). - CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352). Non-security issues fixed: - systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933) - udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400) - sd-bus: bump message queue size again (bsc#1132721) - core: only watch processes when it's really necessary (bsc#955942 bsc#1128657) - rules: load drivers only on "add" events (bsc#1126056) - sysctl: Don't pass null directive argument to '%s' (bsc#1121563) - Do not automatically online memory on s390x (bsc#1127557) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1450=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-71.1 libsystemd0-debuginfo-228-71.1 libsystemd0-mini-228-71.1 libsystemd0-mini-debuginfo-228-71.1 libudev-devel-228-71.1 libudev-mini-devel-228-71.1 libudev-mini1-228-71.1 libudev-mini1-debuginfo-228-71.1 libudev1-228-71.1 libudev1-debuginfo-228-71.1 nss-myhostname-228-71.1 nss-myhostname-debuginfo-228-71.1 nss-mymachines-228-71.1 nss-mymachines-debuginfo-228-71.1 systemd-228-71.1 systemd-debuginfo-228-71.1 systemd-debugsource-228-71.1 systemd-devel-228-71.1 systemd-logger-228-71.1 systemd-mini-228-71.1 systemd-mini-debuginfo-228-71.1 systemd-mini-debugsource-228-71.1 systemd-mini-devel-228-71.1 systemd-mini-sysvinit-228-71.1 systemd-sysvinit-228-71.1 udev-228-71.1 udev-debuginfo-228-71.1 udev-mini-228-71.1 udev-mini-debuginfo-228-71.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-71.1 systemd-mini-bash-completion-228-71.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-71.1 libsystemd0-debuginfo-32bit-228-71.1 libudev1-32bit-228-71.1 libudev1-debuginfo-32bit-228-71.1 nss-myhostname-32bit-228-71.1 nss-myhostname-debuginfo-32bit-228-71.1 systemd-32bit-228-71.1 systemd-debuginfo-32bit-228-71.1 References: https://www.suse.com/security/cve/CVE-2018-6954.html https://www.suse.com/security/cve/CVE-2019-3842.html https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1080919 https://bugzilla.suse.com/1121563 https://bugzilla.suse.com/1125352 https://bugzilla.suse.com/1126056 https://bugzilla.suse.com/1127557 https://bugzilla.suse.com/1128657 https://bugzilla.suse.com/1130230 https://bugzilla.suse.com/1132348 https://bugzilla.suse.com/1132400 https://bugzilla.suse.com/1132721 https://bugzilla.suse.com/955942

1 0

openSUSE-RU-2019:1454-1: moderate: Recommended update for xfdesktop
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for xfdesktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1454-1 Rating: moderate References: #1134125 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfdesktop fixes the following issues: - Wallpaper scaling failed if image contained EXIF markup for rotation (boo#1134125) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1454=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1454=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1454=1 Package List: - openSUSE Leap 15.1 (x86_64): xfdesktop-4.12.4-lp151.4.3.1 xfdesktop-debuginfo-4.12.4-lp151.4.3.1 xfdesktop-debugsource-4.12.4-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): xfdesktop-branding-upstream-4.12.4-lp151.4.3.1 xfdesktop-lang-4.12.4-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): xfdesktop-branding-upstream-4.12.4-lp150.2.3.1 xfdesktop-lang-4.12.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): xfdesktop-4.12.4-lp150.2.3.1 xfdesktop-debuginfo-4.12.4-lp150.2.3.1 xfdesktop-debugsource-4.12.4-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): xfdesktop-4.12.4-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): xfdesktop-branding-upstream-4.12.4-bp150.3.3.1 xfdesktop-lang-4.12.4-bp150.3.3.1 References: https://bugzilla.suse.com/1134125

1 0

openSUSE-SU-2019:1453-1: moderate: Security update for evolution
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for evolution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1453-1 Rating: moderate References: #1125230 Cross-References: CVE-2018-15587 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evolution fixes the following issues: Security issue fixed: - CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1453=1 Package List: - openSUSE Leap 15.0 (noarch): evolution-lang-3.26.6-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): evolution-3.26.6-lp150.3.3.1 evolution-debuginfo-3.26.6-lp150.3.3.1 evolution-debugsource-3.26.6-lp150.3.3.1 evolution-devel-3.26.6-lp150.3.3.1 evolution-plugin-bogofilter-3.26.6-lp150.3.3.1 evolution-plugin-bogofilter-debuginfo-3.26.6-lp150.3.3.1 evolution-plugin-pst-import-3.26.6-lp150.3.3.1 evolution-plugin-pst-import-debuginfo-3.26.6-lp150.3.3.1 evolution-plugin-spamassassin-3.26.6-lp150.3.3.1 evolution-plugin-spamassassin-debuginfo-3.26.6-lp150.3.3.1 glade-catalog-evolution-3.26.6-lp150.3.3.1 glade-catalog-evolution-debuginfo-3.26.6-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15587.html https://bugzilla.suse.com/1125230

1 0

openSUSE-RU-2019:1452-1: moderate: Recommended update for postfix
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1452-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for postfix fixes the following issues: - Setting the security file permissions to "paranoid" could have caused postfix to hang (bsc#1120757) - postfix-files contained an incorrect path to postfix-ldap.so which resulted in an error when running postfix set-permissions (bsc#bsc#1120110) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1452=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): postfix-3.3.1-lp150.9.2 postfix-debuginfo-3.3.1-lp150.9.2 postfix-debugsource-3.3.1-lp150.9.2 postfix-devel-3.3.1-lp150.9.2 postfix-lmdb-3.3.1-lp150.9.2 postfix-lmdb-debuginfo-3.3.1-lp150.9.2 postfix-mysql-3.3.1-lp150.9.2 postfix-mysql-debuginfo-3.3.1-lp150.9.2 postfix-postgresql-3.3.1-lp150.9.2 postfix-postgresql-debuginfo-3.3.1-lp150.9.2 - openSUSE Leap 15.0 (noarch): postfix-doc-3.3.1-lp150.9.2 References:

1 0

openSUSE-RU-2019:1451-1: moderate: Recommended update for SUSEConnect
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1451-1 Rating: moderate References: #1128969 #959561 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for SUSEConnect fixes the following issues: - Does no longer try to remove a service during migration, if a zypper service plugin already exists (bsc#1128969) - Shows non-enabled extensions with a remark about availability - Adds output information about registration and unregistration progress - Output proper message when SUSEConnect is called without parameters (bsc#959561) - Default to https URI when no protocol prefix is provided for --url - Support transactional-update systems (fate#326482) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1451=1 Package List: - openSUSE Leap 15.0 (x86_64): SUSEConnect-0.3.17-lp150.2.14.1 References: https://bugzilla.suse.com/1128969 https://bugzilla.suse.com/959561

1 0

openSUSE-RU-2019:1447-1: moderate: Recommended update for krdc
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for krdc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1447-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for krdc fixes the following issues: - Fixed broken VNC display with color depths other than 32bit. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1447=1 Package List: - openSUSE Leap 15.1 (noarch): krdc-lang-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (x86_64): krdc-18.12.3-lp151.2.4.1 krdc-debuginfo-18.12.3-lp151.2.4.1 krdc-debugsource-18.12.3-lp151.2.4.1 krdc-devel-18.12.3-lp151.2.4.1 References:

1 0

openSUSE-RU-2019:1449-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1449-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for virtualbox fixes the following issues: VirtualBox was updated to 6.0.8 (released May 13 2019 by Oracle) This is a maintenance release. The following items were fixed and/or added: - Core: fix saved state resume failures (bugs #18265 and #18331) - User interface: show full file location in New Medium window. - User interface: fix mouse click pass-through problems in multi-screen virtual machines (6.0.6 regression, bug #18567) - Graphics: fixed a crash when powering off a VM without graphics controller (bug #18570) - API: partial fix for dealing with VM config conflicting with other VMs related to medium UUIDs, now correctly flags VM as inaccessible (bug #17908) - Linux hosts: fix kernel module build breakage in non-default build set-ups (bug #18620, thank you Ambroz Bizjak) - Linux hosts: fix kernel module build breakage in debug build set-ups (bug #18621, thank you Ambroz Bizjak) - Windows guests: notice file size increases in shared folders which were missed in certain cases - Linux guests: make shared folders work with Linux 3.16.35 - Linux guests: fix incorrectly read-only shared folders (bug #18345) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1449=1 Package List: - openSUSE Leap 15.1 (noarch): virtualbox-guest-desktop-icons-6.0.8-lp151.2.3.1 virtualbox-guest-source-6.0.8-lp151.2.3.1 virtualbox-host-source-6.0.8-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): python3-virtualbox-6.0.8-lp151.2.3.1 python3-virtualbox-debuginfo-6.0.8-lp151.2.3.1 virtualbox-6.0.8-lp151.2.3.1 virtualbox-debuginfo-6.0.8-lp151.2.3.1 virtualbox-debugsource-6.0.8-lp151.2.3.1 virtualbox-devel-6.0.8-lp151.2.3.1 virtualbox-guest-kmp-default-6.0.8_k4.12.14_lp151.27-lp151.2.3.1 virtualbox-guest-kmp-default-debuginfo-6.0.8_k4.12.14_lp151.27-lp151.2.3.1 virtualbox-guest-tools-6.0.8-lp151.2.3.1 virtualbox-guest-tools-debuginfo-6.0.8-lp151.2.3.1 virtualbox-guest-x11-6.0.8-lp151.2.3.1 virtualbox-guest-x11-debuginfo-6.0.8-lp151.2.3.1 virtualbox-host-kmp-default-6.0.8_k4.12.14_lp151.27-lp151.2.3.1 virtualbox-host-kmp-default-debuginfo-6.0.8_k4.12.14_lp151.27-lp151.2.3.1 virtualbox-qt-6.0.8-lp151.2.3.1 virtualbox-qt-debuginfo-6.0.8-lp151.2.3.1 virtualbox-vnc-6.0.8-lp151.2.3.1 virtualbox-websrv-6.0.8-lp151.2.3.1 virtualbox-websrv-debuginfo-6.0.8-lp151.2.3.1 References:

1 0

openSUSE-RU-2019:1448-1: moderate: Recommended update for akonadi-server
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for akonadi-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1448-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for akonadi-server fixes the following issues: - Fixed a possible crash on exit (kde#401692) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1448=1 Package List: - openSUSE Leap 15.1 (x86_64): akonadi-server-18.12.3-lp151.3.4.1 akonadi-server-debuginfo-18.12.3-lp151.3.4.1 akonadi-server-debugsource-18.12.3-lp151.3.4.1 akonadi-server-devel-18.12.3-lp151.3.4.1 akonadi-server-devel-debuginfo-18.12.3-lp151.3.4.1 akonadi-server-sqlite-18.12.3-lp151.3.4.1 akonadi-server-sqlite-debuginfo-18.12.3-lp151.3.4.1 libKF5AkonadiAgentBase5-18.12.3-lp151.3.4.1 libKF5AkonadiAgentBase5-debuginfo-18.12.3-lp151.3.4.1 libKF5AkonadiCore5-18.12.3-lp151.3.4.1 libKF5AkonadiCore5-debuginfo-18.12.3-lp151.3.4.1 libKF5AkonadiPrivate5-18.12.3-lp151.3.4.1 libKF5AkonadiPrivate5-debuginfo-18.12.3-lp151.3.4.1 libKF5AkonadiWidgets5-18.12.3-lp151.3.4.1 libKF5AkonadiWidgets5-debuginfo-18.12.3-lp151.3.4.1 libKF5AkonadiXml5-18.12.3-lp151.3.4.1 libKF5AkonadiXml5-debuginfo-18.12.3-lp151.3.4.1 - openSUSE Leap 15.1 (noarch): akonadi-server-lang-18.12.3-lp151.3.4.1 References:

1 0

openSUSE-RU-2019:1446-1: moderate: Recommended update for kidentitymanagement
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: Recommended update for kidentitymanagement ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1446-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kidentitymanagement fixes the following issues: - Fixed that newly created itentities are not showing up in the settings dialog before kmail is restarted (kde#391631) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1446=1 Package List: - openSUSE Leap 15.1 (noarch): kidentitymanagement-lang-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (x86_64): kidentitymanagement-debugsource-18.12.3-lp151.2.4.1 kidentitymanagement-devel-18.12.3-lp151.2.4.1 libKF5IdentityManagement5-18.12.3-lp151.2.4.1 libKF5IdentityManagement5-debuginfo-18.12.3-lp151.2.4.1 References:

1 0

openSUSE-SU-2019:1444-1: important: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1444-1 Rating: important References: #1114209 #1114832 #1118897 #1118898 #1118899 #1121397 #1121967 #1123013 #1128376 #1128746 #1134068 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 CVE-2019-6486 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967). - CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013). - CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897). - CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898). - CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899). Other changes and bug fixes: - Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068). - docker-test: Improvements to test packaging (bsc#1128746). - Move daemon.json file to /etc/docker directory (bsc#1114832). - Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209). - Fix go build failures (bsc#1121397). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1444=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go-1.12-lp151.2.3.1 go-doc-1.12-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): containerd-1.2.5-lp151.2.3.1 containerd-ctr-1.2.5-lp151.2.3.1 docker-18.09.6_ce-lp151.2.3.1 docker-debuginfo-18.09.6_ce-lp151.2.3.1 docker-debugsource-18.09.6_ce-lp151.2.3.1 docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 docker-runc-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-runc-debuginfo-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-test-18.09.6_ce-lp151.2.3.1 docker-test-debuginfo-18.09.6_ce-lp151.2.3.1 go-race-1.12-lp151.2.3.1 go1.11-1.11.9-lp151.2.3.1 go1.11-doc-1.11.9-lp151.2.3.1 go1.11-race-1.11.9-lp151.2.3.1 go1.12-1.12.4-lp151.2.3.1 go1.12-doc-1.12.4-lp151.2.3.1 go1.12-race-1.12.4-lp151.2.3.1 golang-github-docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): containerd-test-1.2.5-lp151.2.3.1 docker-bash-completion-18.09.6_ce-lp151.2.3.1 docker-runc-test-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-zsh-completion-18.09.6_ce-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://www.suse.com/security/cve/CVE-2019-6486.html https://bugzilla.suse.com/1114209 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121397 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1123013 https://bugzilla.suse.com/1128376 https://bugzilla.suse.com/1128746 https://bugzilla.suse.com/1134068

1 0

openSUSE-RU-2019:1443-1: moderate: PackageKit
by maintenance＠opensuse.org 27 May '19

27 May '19

openSUSE Recommended Update: PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1443-1 Rating: moderate References: #1038425 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for PackageKit fixes the following issues: - This fixes an issue on GNOME where a pop up window for license agreements was not shown (boo#1038425) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1443=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): PackageKit-1.1.10-lp151.8.3.1 PackageKit-backend-zypp-1.1.10-lp151.8.3.1 PackageKit-backend-zypp-debuginfo-1.1.10-lp151.8.3.1 PackageKit-debuginfo-1.1.10-lp151.8.3.1 PackageKit-debugsource-1.1.10-lp151.8.3.1 PackageKit-devel-1.1.10-lp151.8.3.1 PackageKit-devel-debuginfo-1.1.10-lp151.8.3.1 PackageKit-gstreamer-plugin-1.1.10-lp151.8.3.1 PackageKit-gstreamer-plugin-debuginfo-1.1.10-lp151.8.3.1 PackageKit-gtk3-module-1.1.10-lp151.8.3.1 PackageKit-gtk3-module-debuginfo-1.1.10-lp151.8.3.1 libpackagekit-glib2-18-1.1.10-lp151.8.3.1 libpackagekit-glib2-18-debuginfo-1.1.10-lp151.8.3.1 libpackagekit-glib2-devel-1.1.10-lp151.8.3.1 typelib-1_0-PackageKitGlib-1_0-1.1.10-lp151.8.3.1 - openSUSE Leap 15.1 (noarch): PackageKit-branding-upstream-1.1.10-lp151.8.3.1 PackageKit-lang-1.1.10-lp151.8.3.1 - openSUSE Leap 15.1 (x86_64): libpackagekit-glib2-18-32bit-1.1.10-lp151.8.3.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.10-lp151.8.3.1 libpackagekit-glib2-devel-32bit-1.1.10-lp151.8.3.1 References: https://bugzilla.suse.com/1038425

1 0

openSUSE-RU-2019:1442-1: moderate: Recommended update for usbguard
by maintenance＠opensuse.org 26 May '19

26 May '19

openSUSE Recommended Update: Recommended update for usbguard ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1442-1 Rating: moderate References: #1071076 #1120969 #1132443 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for usbguard to version 0.7.4 fixes the following issues: - Updated usbguard.service to allow autostart (boo#1120969). - Added a sample rules.conf (boo#1071076). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1442=1 Package List: - openSUSE Leap 15.0 (x86_64): libusbguard0-0.7.4-lp150.2.3.1 libusbguard0-debuginfo-0.7.4-lp150.2.3.1 usbguard-0.7.4-lp150.2.3.1 usbguard-applet-qt-0.7.4-lp150.2.3.1 usbguard-applet-qt-debuginfo-0.7.4-lp150.2.3.1 usbguard-debuginfo-0.7.4-lp150.2.3.1 usbguard-debugsource-0.7.4-lp150.2.3.1 usbguard-devel-0.7.4-lp150.2.3.1 usbguard-tools-0.7.4-lp150.2.3.1 usbguard-tools-debuginfo-0.7.4-lp150.2.3.1 References: https://bugzilla.suse.com/1071076 https://bugzilla.suse.com/1120969 https://bugzilla.suse.com/1132443

1 0

openSUSE-RU-2019:1441-1: important: Recommended update for docker-runc
by maintenance＠opensuse.org 26 May '19

26 May '19

openSUSE Recommended Update: Recommended update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1441-1 Rating: important References: #1131314 #1131553 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for docker-runc fixes the following issues: - Backport various upstream patches to fix some kernel regression related to O_TMPFILE. bsc#1131314 bsc#1131553 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1441=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): docker-runc-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-debugsource-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-kubic-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-kubic-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-kubic-debugsource-1.0.0rc6+gitr3748_96ec2177ae84-14.1 - openSUSE Leap 42.3 (noarch): docker-runc-kubic-test-1.0.0rc6+gitr3748_96ec2177ae84-14.1 docker-runc-test-1.0.0rc6+gitr3748_96ec2177ae84-14.1 References: https://bugzilla.suse.com/1131314 https://bugzilla.suse.com/1131553

1 0

openSUSE-OU-2019:1440-1: Optional update for php7-redis
by maintenance＠opensuse.org 24 May '19

24 May '19

openSUSE Optional Update: Optional update for php7-redis ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:1440-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update for php7-redis fixes the following issues: - Add new package php7-redis Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1440=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): php7-redis-4.2.0-2.1 References:

1 0

openSUSE-SU-2019:1439-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 23 May '19

23 May '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1439-1 Rating: important References: #1122293 #1122299 #1132728 #1132729 #1132732 #1133135 Cross-References: CVE-2018-11212 CVE-2018-3639 CVE-2019-2422 CVE-2019-2426 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u212 fixes the following issues: Security issues fixed: - CVE-2019-2602: Better String parsing (bsc#1132728). - CVE-2019-2684: More dynamic RMI interactions (bsc#1132732). - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729). - CVE-2019-2422: Better FileChannel (bsc#1122293). - CVE-2018-11212: Improve JPEG (bsc#1122299). Non-Security issue fixed: - Disable LTO (bsc#1133135). - Added Japanese new era name. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1439=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.212-34.1 java-1_8_0-openjdk-accessibility-1.8.0.212-34.1 java-1_8_0-openjdk-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-debugsource-1.8.0.212-34.1 java-1_8_0-openjdk-demo-1.8.0.212-34.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-devel-1.8.0.212-34.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-headless-1.8.0.212-34.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-src-1.8.0.212-34.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.212-34.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2019-2422.html https://www.suse.com/security/cve/CVE-2019-2426.html https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://www.suse.com/security/cve/CVE-2019-2698.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132729 https://bugzilla.suse.com/1132732 https://bugzilla.suse.com/1133135

1 0

openSUSE-SU-2019:1438-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 23 May '19

23 May '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1438-1 Rating: important References: #1132728 #1132729 #1132732 #1133135 Cross-References: CVE-2018-3639 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u212 fixes the following issues: Security issues fixed: - CVE-2019-2602: Better String parsing (bsc#1132728). - CVE-2019-2684: More dynamic RMI interactions (bsc#1132732). - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729). - CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE Non-Security issue fixed: - Disable LTO (bsc#1133135). - Added Japanese new era name. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1438=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-accessibility-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-debugsource-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-demo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-devel-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-headless-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-src-1.8.0.212-lp150.2.16.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.212-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://www.suse.com/security/cve/CVE-2019-2698.html https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132729 https://bugzilla.suse.com/1132732 https://bugzilla.suse.com/1133135

1 0

openSUSE-SU-2019:1436-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1436-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1436=1 Package List: - openSUSE Backports SLE-15 (x86_64): chromedriver-74.0.3729.108-bp150.207.1 chromium-74.0.3729.108-bp150.207.1 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313

1 0

openSUSE-SU-2019:1435-1: Security update for bzip2
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for bzip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1435-1 Rating: low References: #985657 Cross-References: CVE-2016-3189 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1435=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bzip2-1.0.6-lp151.5.3.1 bzip2-debuginfo-1.0.6-lp151.5.3.1 bzip2-debugsource-1.0.6-lp151.5.3.1 libbz2-1-1.0.6-lp151.5.3.1 libbz2-1-debuginfo-1.0.6-lp151.5.3.1 libbz2-devel-1.0.6-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libbz2-1-32bit-1.0.6-lp151.5.3.1 libbz2-1-32bit-debuginfo-1.0.6-lp151.5.3.1 libbz2-devel-32bit-1.0.6-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): bzip2-doc-1.0.6-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2016-3189.html https://bugzilla.suse.com/985657

1 0

openSUSE-SU-2019:1437-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1437-1 Rating: moderate References: #1132053 #1132054 #1133202 #1133203 #1133498 #1133501 Cross-References: CVE-2019-11008 CVE-2019-11009 CVE-2019-11473 CVE-2019-11474 CVE-2019-11505 CVE-2019-11506 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2019-11506: Fixed a heap-based buffer overflow in the function WriteMATLABImage (boo#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the function WritePDBImage (boo#1133501). The following fixes where modified and refreshed: - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage (boo#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage (boo#1132053). - CVE-2019-11473: Fixed an out-of-bounds read leading to a possible denial of service in coders/xwd.c (boo#1133203). - CVE-2019-11474: Fixed a floating-point exception leading to a possible denial of service in coders/xwd.c (boo#1133202). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1437=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.21.1 GraphicsMagick-devel-1.3.29-bp150.2.21.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.21.1 libGraphicsMagick++-devel-1.3.29-bp150.2.21.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.21.1 libGraphicsMagick3-config-1.3.29-bp150.2.21.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.21.1 perl-GraphicsMagick-1.3.29-bp150.2.21.1 References: https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11473.html https://www.suse.com/security/cve/CVE-2019-11474.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1133202 https://bugzilla.suse.com/1133203 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501

1 0

openSUSE-SU-2019:1434-1: moderate: Security update for graphviz
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for graphviz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1434-1 Rating: moderate References: #1132091 Cross-References: CVE-2019-11023 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphviz fixes the following issues: Security issue fixed: - CVE-2019-11023: Fixed a denial of service vulnerability, which was caused by a NULL pointer dereference in agroot() (bsc#1132091). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1434=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): graphviz-2.40.1-lp151.6.3.1 graphviz-addons-debuginfo-2.40.1-lp151.6.3.1 graphviz-addons-debugsource-2.40.1-lp151.6.3.1 graphviz-debuginfo-2.40.1-lp151.6.3.1 graphviz-debugsource-2.40.1-lp151.6.3.1 graphviz-devel-2.40.1-lp151.6.3.1 graphviz-doc-2.40.1-lp151.6.3.1 graphviz-gd-2.40.1-lp151.6.3.1 graphviz-gd-debuginfo-2.40.1-lp151.6.3.1 graphviz-gnome-2.40.1-lp151.6.3.1 graphviz-gnome-debuginfo-2.40.1-lp151.6.3.1 graphviz-guile-2.40.1-lp151.6.3.1 graphviz-guile-debuginfo-2.40.1-lp151.6.3.1 graphviz-gvedit-2.40.1-lp151.6.3.1 graphviz-gvedit-debuginfo-2.40.1-lp151.6.3.1 graphviz-java-2.40.1-lp151.6.3.1 graphviz-java-debuginfo-2.40.1-lp151.6.3.1 graphviz-lua-2.40.1-lp151.6.3.1 graphviz-lua-debuginfo-2.40.1-lp151.6.3.1 graphviz-perl-2.40.1-lp151.6.3.1 graphviz-perl-debuginfo-2.40.1-lp151.6.3.1 graphviz-php-2.40.1-lp151.6.3.1 graphviz-php-debuginfo-2.40.1-lp151.6.3.1 graphviz-plugins-core-2.40.1-lp151.6.3.1 graphviz-plugins-core-debuginfo-2.40.1-lp151.6.3.1 graphviz-python-2.40.1-lp151.6.3.1 graphviz-python-debuginfo-2.40.1-lp151.6.3.1 graphviz-ruby-2.40.1-lp151.6.3.1 graphviz-ruby-debuginfo-2.40.1-lp151.6.3.1 graphviz-smyrna-2.40.1-lp151.6.3.1 graphviz-smyrna-debuginfo-2.40.1-lp151.6.3.1 graphviz-tcl-2.40.1-lp151.6.3.1 graphviz-tcl-debuginfo-2.40.1-lp151.6.3.1 libgraphviz6-2.40.1-lp151.6.3.1 libgraphviz6-debuginfo-2.40.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-11023.html https://bugzilla.suse.com/1132091

1 0

openSUSE-SU-2019:1430-1: moderate: Security update for libxslt
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for libxslt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1430-1 Rating: moderate References: #1132160 Cross-References: CVE-2019-11068 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxslt fixes the following issues: - CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1430=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libxslt-debugsource-1.1.28-13.3.1 libxslt-devel-1.1.28-13.3.1 libxslt-python-1.1.28-13.3.1 libxslt-python-debuginfo-1.1.28-13.3.1 libxslt-python-debugsource-1.1.28-13.3.1 libxslt-tools-1.1.28-13.3.1 libxslt-tools-debuginfo-1.1.28-13.3.1 libxslt1-1.1.28-13.3.1 libxslt1-debuginfo-1.1.28-13.3.1 - openSUSE Leap 42.3 (x86_64): libxslt-devel-32bit-1.1.28-13.3.1 libxslt1-32bit-1.1.28-13.3.1 libxslt1-debuginfo-32bit-1.1.28-13.3.1 References: https://www.suse.com/security/cve/CVE-2019-11068.html https://bugzilla.suse.com/1132160

1 0

openSUSE-SU-2019:1428-1: moderate: Security update for libxslt
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for libxslt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1428-1 Rating: moderate References: #1132160 Cross-References: CVE-2019-11068 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxslt fixes the following issues: Security issue fixed: - CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1428=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libxslt-debugsource-1.1.32-lp150.2.3.1 libxslt-devel-1.1.32-lp150.2.3.1 libxslt-tools-1.1.32-lp150.2.3.1 libxslt-tools-debuginfo-1.1.32-lp150.2.3.1 libxslt1-1.1.32-lp150.2.3.1 libxslt1-debuginfo-1.1.32-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libxslt-devel-32bit-1.1.32-lp150.2.3.1 libxslt-python-1.1.32-lp150.2.3.1 libxslt-python-debuginfo-1.1.32-lp150.2.3.1 libxslt-python-debugsource-1.1.32-lp150.2.3.1 libxslt1-32bit-1.1.32-lp150.2.3.1 libxslt1-32bit-debuginfo-1.1.32-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11068.html https://bugzilla.suse.com/1132160

1 0

openSUSE-RU-2019:1423-1: moderate: Recommended update for sensors
by maintenance＠opensuse.org 22 May '19

22 May '19

openSUSE Recommended Update: Recommended update for sensors ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1423-1 Rating: moderate References: #1108468 #1116021 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for sensors fixes the following issues: sensors was updated to version 3.5.0: The following changes were done: + soname was bumped due to commit dcf2367 which introduced an ABI change. (This was reverted for the SUSE packages, as it was not necessary) + Fixed disappearance of certain hwmon chips with 4.19+ kernels (bsc#1116021). + Add the find-driver script for debugging. + Various documentation and man page improvements. + Fix various issues found by Coverity Scan. + Updated links in documentation to reflect the new home of lm_sensors. + sensors.1: Add reference to sensors-detect and document -j option (json output). + sensors: Add support for json output, add support for power min, lcrit, min_alarm, lcrit_alarm. + sensors-detect changes: * Fix systemd paths. * Add detection of Fintek F81768. * Only probe I/O ports on x86. * Add detection of Nuvoton NCT6793D. * Add detection of Microchip MCP9808. * Mark F71868A as supported by the f71882fg driver. * Mark F81768D as supported by the f71882fg driver. * Mark F81866D as supported by the f71882fg driver. * Add detection of various ITE chips. * Add detection of Nuvoton NCT6795D. * Add detection of DDR4 SPD. * Add detection of ITE IT8987D. * Add detection of AMD Family 17h temperature sensors. * Add detection of AMD KERNCZ SMBus controller. * Add detection of various Intel SMBus controllers. * Add detection of Giantec GT30TS00. * Add detection of ONS CAT34TS02C and CAT34TS04. * Add detection of AMD Family 15h Model 60+ temperature sensors. * Add detection of Nuvoton NCT6796D. * Add detection of AMD Family 15h Model 70+ temperature sensors. + configs: Add sample configuration files. + sensors.conf.default: * Add hardwired inputs of NCT6795D * Add hardwired inputs of F71868A * Add hardwired NCT6796D inputs + vt1211_pwm: replaced deprecated sub shell syntax, run with bash instead of sh. + pwmconfig: replaced deprecated sub shell syntax. + fancontrol: replaced deprecated sub shell syntax, save original pwm values. + fancontrol.8: replaced deprecated sub shell syntax. + libsensors: * Add support for SENSORS_BUS_TYPE_SCSI, add support for power min, lcrit, min_alarm, lcrit_alarm. * Handle hwmon device with thermal device parent (bsc#1108468). - Undo unnecessary libsensors version bump. - Undo the SENSORS_API_VERSION change, to stay source-compatible with upstream. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1423=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libsensors4-3.5.0-lp151.4.3.1 libsensors4-debuginfo-3.5.0-lp151.4.3.1 libsensors4-devel-3.5.0-lp151.4.3.1 sensord-3.5.0-lp151.4.3.1 sensord-debuginfo-3.5.0-lp151.4.3.1 sensors-3.5.0-lp151.4.3.1 sensors-debuginfo-3.5.0-lp151.4.3.1 sensors-debugsource-3.5.0-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libsensors4-32bit-3.5.0-lp151.4.3.1 libsensors4-32bit-debuginfo-3.5.0-lp151.4.3.1 References: https://bugzilla.suse.com/1108468 https://bugzilla.suse.com/1116021

1 0