May 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1334-1: Recommended update for tryton
by maintenance＠opensuse.org 06 May '19

06 May '19

openSUSE Recommended Update: Recommended update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1334-1 Rating: low References: #1131707 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tryton to version 4.2.24 fixes the following issues: Security issue fixed: - CVE-2019-10868: Fixed an issue where an authenticated user can order records based on a field for which he has no access right (boo#1131707). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1334=1 Package List: - openSUSE Leap 42.3 (noarch): tryton-4.2.24-35.1 References: https://www.suse.com/security/cve/CVE-2019-10868.html https://bugzilla.suse.com/1131707

1 0

openSUSE-RU-2019:1335-1: Recommended update for tryton
by maintenance＠opensuse.org 06 May '19

06 May '19

openSUSE Recommended Update: Recommended update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1335-1 Rating: low References: #1131707 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tryton to version 4.2.24 fixes the following issues: Security issue fixed: - CVE-2019-10868: Fixed an issue where an authenticated user can order records based on a field for which he has no access right (boo#1131707). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1335=1 Package List: - openSUSE Leap 15.0 (noarch): tryton-4.2.24-lp150.2.18.1 References: https://www.suse.com/security/cve/CVE-2019-10868.html https://bugzilla.suse.com/1131707

1 0

openSUSE-RU-2019:1333-1: important: Recommended update for MozillaFirefox
by maintenance＠opensuse.org 06 May '19

06 May '19

openSUSE Recommended Update: Recommended update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1333-1 Rating: important References: #1134126 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox 60.6.2esr was released (boo#1134126) * Fixed the extension certificate chain. https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-fire fox/ Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1333=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1333=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.6.2-138.1 MozillaFirefox-branding-upstream-60.6.2-138.1 MozillaFirefox-buildsymbols-60.6.2-138.1 MozillaFirefox-debuginfo-60.6.2-138.1 MozillaFirefox-debugsource-60.6.2-138.1 MozillaFirefox-devel-60.6.2-138.1 MozillaFirefox-translations-common-60.6.2-138.1 MozillaFirefox-translations-other-60.6.2-138.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.6.2-lp150.3.48.1 MozillaFirefox-branding-upstream-60.6.2-lp150.3.48.1 MozillaFirefox-buildsymbols-60.6.2-lp150.3.48.1 MozillaFirefox-debuginfo-60.6.2-lp150.3.48.1 MozillaFirefox-debugsource-60.6.2-lp150.3.48.1 MozillaFirefox-devel-60.6.2-lp150.3.48.1 MozillaFirefox-translations-common-60.6.2-lp150.3.48.1 MozillaFirefox-translations-other-60.6.2-lp150.3.48.1 References: https://bugzilla.suse.com/1134126

1 0

openSUSE-RU-2019:1332-1: moderate: Recommended update for putty
by maintenance＠opensuse.org 05 May '19

05 May '19

openSUSE Recommended Update: Recommended update for putty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1332-1 Rating: moderate References: #1133181 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for putty fixes the following issues: - Reenable Xresources / remove -DNOT_X_WINDOWS, the crash under Wayland appears gone. (boo#1133181) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1332=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): putty-0.71-bp150.4.6.1 References: https://bugzilla.suse.com/1133181

1 0

openSUSE-RU-2019:1329-1: moderate: Recommended update for inotify-tools
by maintenance＠opensuse.org 04 May '19

04 May '19

openSUSE Recommended Update: Recommended update for inotify-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1329-1 Rating: moderate References: #1047218 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for inotify-tools fixes the following issues: The package inotify-tools is shipped in version 3.20.1. It contains some tools using the inotify kernel interface. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1329=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): inotify-tools-3.20.1-2.1 inotify-tools-devel-3.20.1-2.1 libinotifytools0-3.20.1-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): inotify-tools-doc-3.20.1-2.1 References: https://bugzilla.suse.com/1047218

1 0

openSUSE-OU-2019:1330-1: Recommended update for charliecloud
by maintenance＠opensuse.org 04 May '19

04 May '19

openSUSE Optional Update: Recommended update for charliecloud ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:1330-1 Rating: low References: Affected Products: openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update introduces package charliecloud: Charliecloud provides user-defined software stacks (UDSS) for high-performance computing (HPC) centers. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1330=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1330=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): charliecloud-0.9.8-bp150.2.1 - openSUSE Backports SLE-15 (noarch): charliecloud-doc-0.9.8-bp150.2.1 charliecloud-examples-0.9.8-bp150.2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): charliecloud-0.9.8-4.1 charliecloud-debuginfo-0.9.8-4.1 charliecloud-debugsource-0.9.8-4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): charliecloud-examples-0.9.8-4.1 References:

1 0

openSUSE-RU-2019:1326-1: moderate: Recommended update for crash
by maintenance＠opensuse.org 04 May '19

04 May '19

openSUSE Recommended Update: Recommended update for crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1326-1 Rating: moderate References: #1122594 #1124690 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crash fixes the following issues: - XEN dom0 changes in v4.11 caused coredumps not loading (bsc#1124690, bsc#1122594) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1326=1 Package List: - openSUSE Leap 15.0 (x86_64): crash-7.2.1-lp150.2.12.1 crash-debuginfo-7.2.1-lp150.2.12.1 crash-debugsource-7.2.1-lp150.2.12.1 crash-devel-7.2.1-lp150.2.12.1 crash-doc-7.2.1-lp150.2.12.1 crash-eppic-7.2.1-lp150.2.12.1 crash-eppic-debuginfo-7.2.1-lp150.2.12.1 crash-gcore-7.2.1-lp150.2.12.1 crash-gcore-debuginfo-7.2.1-lp150.2.12.1 crash-kmp-default-7.2.1_k4.12.14_lp150.12.58-lp150.2.12.1 crash-kmp-default-debuginfo-7.2.1_k4.12.14_lp150.12.58-lp150.2.12.1 References: https://bugzilla.suse.com/1122594 https://bugzilla.suse.com/1124690

1 0

openSUSE-SU-2019:1331-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1331-1 Rating: moderate References: #1122033 #1130330 #1131317 #1132054 #1132060 Cross-References: CVE-2019-10650 CVE-2019-11007 CVE-2019-11008 CVE-2019-9956 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). - Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected: - ImageMagick-config-7-SUSE: This has the PS decoders disabled. - ImageMagick-config-7-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1331=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.29.1 ImageMagick-config-7-SUSE-7.0.7.34-lp150.2.29.1 ImageMagick-config-7-upstream-7.0.7.34-lp150.2.29.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.29.1 ImageMagick-debugsource-7.0.7.34-lp150.2.29.1 ImageMagick-devel-7.0.7.34-lp150.2.29.1 ImageMagick-extra-7.0.7.34-lp150.2.29.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-devel-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.29.1 perl-PerlMagick-7.0.7.34-lp150.2.29.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.29.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.29.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.29.1 References: https://www.suse.com/security/cve/CVE-2019-10650.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-9956.html https://bugzilla.suse.com/1122033 https://bugzilla.suse.com/1130330 https://bugzilla.suse.com/1131317 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132060

1 0

openSUSE-SU-2019:1325-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1325-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1325=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-74.0.3729.108-lp150.209.2 chromedriver-debuginfo-74.0.3729.108-lp150.209.2 chromium-74.0.3729.108-lp150.209.2 chromium-debuginfo-74.0.3729.108-lp150.209.2 chromium-debugsource-74.0.3729.108-lp150.209.2 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313

1 0

openSUSE-SU-2019:1324-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1324-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Security update to version 74.0.3729.108 (boo#1133313). Security issues fixed: - CVE-2019-5805: Use after free in PDFium - CVE-2019-5806: Integer overflow in Angle - CVE-2019-5807: Memory corruption in V8 - CVE-2019-5808: Use after free in Blink - CVE-2019-5809: Use after free in Blink - CVE-2019-5810: User information disclosure in Autofill - CVE-2019-5811: CORS bypass in Blink - CVE-2019-5813: Out of bounds read in V8 - CVE-2019-5814: CORS bypass in Blink - CVE-2019-5815: Heap buffer overflow in Blink - CVE-2019-5818: Uninitialized value in media reader - CVE-2019-5819: Incorrect escaping in developer tools - CVE-2019-5820: Integer overflow in PDFium - CVE-2019-5821: Integer overflow in PDFium - CVE-2019-5822: CORS bypass in download manager - CVE-2019-5823: Forced navigation from service worker Bug fixes: - Update to 73.0.3686.103: * Various feature fixes - Update to 73.0.3683.86: * Various feature fixes - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1324=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-74.0.3729.108-208.1 chromedriver-debuginfo-74.0.3729.108-208.1 chromium-74.0.3729.108-208.1 chromium-debuginfo-74.0.3729.108-208.1 chromium-debugsource-74.0.3729.108-208.1 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313

1 0