openSUSE Recommended Update: Recommended update for xfdesktop
______________________________________________________________________________
Announcement ID: openSUSE-RU-2019:1469-1
Rating: moderate
References: #1134125
Affected Products:
openSUSE Backports SLE-15
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update for xfdesktop fixes the following issues:
- Wallpaper scaling failed if image contained EXIF markup for rotation
(boo#1134125)
This update was imported from the openSUSE:Leap:15.0:Update update project.
Patch Instructions:
To install this openSUSE Recommended Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15:
zypper in -t patch openSUSE-2019-1469=1
Package List:
- openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):
xfdesktop-4.12.4-bp150.3.6.1
- openSUSE Backports SLE-15 (noarch):
xfdesktop-branding-upstream-4.12.4-bp150.3.6.1
xfdesktop-lang-4.12.4-bp150.3.6.1
References:
https://bugzilla.suse.com/1134125
openSUSE Recommended Update: Recommended update for vhostmd
______________________________________________________________________________
Announcement ID: openSUSE-RU-2019:1465-1
Rating: moderate
References: #1129772
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update for vhostmd fixes the following issues:
Update to vhostmd 1.1 (bsc#1129772)
- Merge libserialclient with libmetrics
- Add virtio as transport mechanism
- Update to work with modern Xen
- Add SIGPIPE handler and reconnect
- Add systemd service file
- Modernize build files
- Misc bug fixes and improvements
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Recommended Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1465=1
Package List:
- openSUSE Leap 15.0 (x86_64):
libmetrics-devel-1.1-lp150.7.1
libmetrics0-1.1-lp150.7.1
libmetrics0-debuginfo-1.1-lp150.7.1
vhostmd-1.1-lp150.7.1
vhostmd-debuginfo-1.1-lp150.7.1
vhostmd-debugsource-1.1-lp150.7.1
vm-dump-metrics-1.1-lp150.7.1
vm-dump-metrics-debuginfo-1.1-lp150.7.1
References:
https://bugzilla.suse.com/1129772
openSUSE Recommended Update: Recommended update for glib-networking
______________________________________________________________________________
Announcement ID: openSUSE-RU-2019:1457-1
Rating: important
References: #1134795
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update for glib-networking fixes the following issues:
- Fix invalid TLS sessions when TLS 1.3 is used (bsc#1134795)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Recommended Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1457=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1457=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
glib-networking-2.54.1-lp151.3.3.1
glib-networking-debuginfo-2.54.1-lp151.3.3.1
glib-networking-debugsource-2.54.1-lp151.3.3.1
- openSUSE Leap 15.1 (noarch):
glib-networking-lang-2.54.1-lp151.3.3.1
- openSUSE Leap 15.1 (x86_64):
glib-networking-32bit-2.54.1-lp151.3.3.1
glib-networking-32bit-debuginfo-2.54.1-lp151.3.3.1
- openSUSE Leap 15.0 (i586 x86_64):
glib-networking-2.54.1-lp150.2.3.1
glib-networking-debuginfo-2.54.1-lp150.2.3.1
glib-networking-debugsource-2.54.1-lp150.2.3.1
- openSUSE Leap 15.0 (x86_64):
glib-networking-32bit-2.54.1-lp150.2.3.1
glib-networking-32bit-debuginfo-2.54.1-lp150.2.3.1
- openSUSE Leap 15.0 (noarch):
glib-networking-lang-2.54.1-lp150.2.3.1
References:
https://bugzilla.suse.com/1134795
openSUSE Security Update: Security update for transfig
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1455-1
Rating: low
References: #1106531
Cross-References: CVE-2018-16140
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2018-16140: Fixed a buffer underwrite vulnerability in get_line() in
read.c, which allowed an attacker to write prior to the beginning of the
buffer via specially crafted .fig file (bsc#1106531)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1455=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1455=1
Package List:
- openSUSE Leap 15.1 (x86_64):
transfig-3.2.6a-lp151.4.3.1
transfig-debuginfo-3.2.6a-lp151.4.3.1
transfig-debugsource-3.2.6a-lp151.4.3.1
- openSUSE Leap 15.0 (x86_64):
transfig-3.2.6a-lp150.3.3.2
transfig-debuginfo-3.2.6a-lp150.3.3.2
transfig-debugsource-3.2.6a-lp150.3.3.2
References:
https://www.suse.com/security/cve/CVE-2018-16140.htmlhttps://bugzilla.suse.com/1106531
openSUSE Security Update: Security update for chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1456-1
Rating: important
References: #1134218
Cross-References: CVE-2019-5824 CVE-2019-5827
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium was updated to 74.0.3729.157:
- Various security fixes from internal audits, fuzzing and other
initiatives
Includes security fixes from 74.0.3729.131 (boo#1134218):
- CVE-2019-5827: Out-of-bounds access in SQLite
- CVE-2019-5824: Parameter passing error in media player
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2019-1456=1
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1456=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1456=1
Package List:
- openSUSE Leap 42.3 (x86_64):
chromedriver-74.0.3729.157-211.1
chromedriver-debuginfo-74.0.3729.157-211.1
chromium-74.0.3729.157-211.1
chromium-debuginfo-74.0.3729.157-211.1
chromium-debugsource-74.0.3729.157-211.1
- openSUSE Leap 15.1 (x86_64):
chromedriver-74.0.3729.157-lp151.2.3.1
chromedriver-debuginfo-74.0.3729.157-lp151.2.3.1
chromium-74.0.3729.157-lp151.2.3.1
chromium-debuginfo-74.0.3729.157-lp151.2.3.1
chromium-debugsource-74.0.3729.157-lp151.2.3.1
- openSUSE Leap 15.0 (x86_64):
chromedriver-74.0.3729.157-lp150.212.1
chromedriver-debuginfo-74.0.3729.157-lp150.212.1
chromium-74.0.3729.157-lp150.212.1
chromium-debuginfo-74.0.3729.157-lp150.212.1
chromium-debugsource-74.0.3729.157-lp150.212.1
References:
https://www.suse.com/security/cve/CVE-2019-5824.htmlhttps://www.suse.com/security/cve/CVE-2019-5827.htmlhttps://bugzilla.suse.com/1134218
openSUSE Security Update: Security update for systemd
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1450-1
Rating: important
References: #1080919 #1121563 #1125352 #1126056 #1127557
#1128657 #1130230 #1132348 #1132400 #1132721
#955942
Cross-References: CVE-2018-6954 CVE-2019-3842 CVE-2019-6454
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves three vulnerabilities and has 8 fixes
is now available.
Description:
This update for systemd fixes the following issues:
Security issues fixed:
- CVE-2018-6954: Fixed a vulnerability in the symlink handling of
systemd-tmpfiles which allowed a local user to obtain ownership of
arbitrary files (bsc#1080919).
- CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a
local user to escalate privileges (bsc#1132348).
- CVE-2019-6454: Fixed a denial of service caused by long dbus messages
(bsc#1125352).
Non-security issues fixed:
- systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933)
- udevd: notify when max number value of children is reached only once per
batch of events (bsc#1132400)
- sd-bus: bump message queue size again (bsc#1132721)
- core: only watch processes when it's really necessary (bsc#955942
bsc#1128657)
- rules: load drivers only on "add" events (bsc#1126056)
- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
- Do not automatically online memory on s390x (bsc#1127557)
This update was imported from the SUSE:SLE-12-SP2:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2019-1450=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
libsystemd0-228-71.1
libsystemd0-debuginfo-228-71.1
libsystemd0-mini-228-71.1
libsystemd0-mini-debuginfo-228-71.1
libudev-devel-228-71.1
libudev-mini-devel-228-71.1
libudev-mini1-228-71.1
libudev-mini1-debuginfo-228-71.1
libudev1-228-71.1
libudev1-debuginfo-228-71.1
nss-myhostname-228-71.1
nss-myhostname-debuginfo-228-71.1
nss-mymachines-228-71.1
nss-mymachines-debuginfo-228-71.1
systemd-228-71.1
systemd-debuginfo-228-71.1
systemd-debugsource-228-71.1
systemd-devel-228-71.1
systemd-logger-228-71.1
systemd-mini-228-71.1
systemd-mini-debuginfo-228-71.1
systemd-mini-debugsource-228-71.1
systemd-mini-devel-228-71.1
systemd-mini-sysvinit-228-71.1
systemd-sysvinit-228-71.1
udev-228-71.1
udev-debuginfo-228-71.1
udev-mini-228-71.1
udev-mini-debuginfo-228-71.1
- openSUSE Leap 42.3 (noarch):
systemd-bash-completion-228-71.1
systemd-mini-bash-completion-228-71.1
- openSUSE Leap 42.3 (x86_64):
libsystemd0-32bit-228-71.1
libsystemd0-debuginfo-32bit-228-71.1
libudev1-32bit-228-71.1
libudev1-debuginfo-32bit-228-71.1
nss-myhostname-32bit-228-71.1
nss-myhostname-debuginfo-32bit-228-71.1
systemd-32bit-228-71.1
systemd-debuginfo-32bit-228-71.1
References:
https://www.suse.com/security/cve/CVE-2018-6954.htmlhttps://www.suse.com/security/cve/CVE-2019-3842.htmlhttps://www.suse.com/security/cve/CVE-2019-6454.htmlhttps://bugzilla.suse.com/1080919https://bugzilla.suse.com/1121563https://bugzilla.suse.com/1125352https://bugzilla.suse.com/1126056https://bugzilla.suse.com/1127557https://bugzilla.suse.com/1128657https://bugzilla.suse.com/1130230https://bugzilla.suse.com/1132348https://bugzilla.suse.com/1132400https://bugzilla.suse.com/1132721https://bugzilla.suse.com/955942
openSUSE Security Update: Security update for evolution
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1453-1
Rating: moderate
References: #1125230
Cross-References: CVE-2018-15587
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for evolution fixes the following issues:
Security issue fixed:
- CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using
specially crafted emails (bsc#1125230).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1453=1
Package List:
- openSUSE Leap 15.0 (noarch):
evolution-lang-3.26.6-lp150.3.3.1
- openSUSE Leap 15.0 (x86_64):
evolution-3.26.6-lp150.3.3.1
evolution-debuginfo-3.26.6-lp150.3.3.1
evolution-debugsource-3.26.6-lp150.3.3.1
evolution-devel-3.26.6-lp150.3.3.1
evolution-plugin-bogofilter-3.26.6-lp150.3.3.1
evolution-plugin-bogofilter-debuginfo-3.26.6-lp150.3.3.1
evolution-plugin-pst-import-3.26.6-lp150.3.3.1
evolution-plugin-pst-import-debuginfo-3.26.6-lp150.3.3.1
evolution-plugin-spamassassin-3.26.6-lp150.3.3.1
evolution-plugin-spamassassin-debuginfo-3.26.6-lp150.3.3.1
glade-catalog-evolution-3.26.6-lp150.3.3.1
glade-catalog-evolution-debuginfo-3.26.6-lp150.3.3.1
References:
https://www.suse.com/security/cve/CVE-2018-15587.htmlhttps://bugzilla.suse.com/1125230