May 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1399-1: important: Security update for jakarta-commons-fileupload
by opensuse-security＠opensuse.org 15 May '19

15 May '19

openSUSE Security Update: Security update for jakarta-commons-fileupload ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1399-1 Rating: important References: #1128829 #1128963 Cross-References: CVE-2016-1000031 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for jakarta-commons-fileupload fixes the following issue: Security issue fixed: - CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1399=1 Package List: - openSUSE Leap 15.0 (noarch): jakarta-commons-fileupload-1.1.1-lp150.2.3.1 jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2016-1000031.html https://bugzilla.suse.com/1128829 https://bugzilla.suse.com/1128963

1 0

openSUSE-SU-2019:1398-1: Security update for bzip2
by opensuse-security＠opensuse.org 15 May '19

15 May '19

openSUSE Security Update: Security update for bzip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1398-1 Rating: low References: #985657 Cross-References: CVE-2016-3189 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1398=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bzip2-1.0.6-lp150.4.3.1 bzip2-debuginfo-1.0.6-lp150.4.3.1 bzip2-debugsource-1.0.6-lp150.4.3.1 libbz2-1-1.0.6-lp150.4.3.1 libbz2-1-debuginfo-1.0.6-lp150.4.3.1 libbz2-devel-1.0.6-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): bzip2-doc-1.0.6-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): libbz2-1-32bit-1.0.6-lp150.4.3.1 libbz2-1-32bit-debuginfo-1.0.6-lp150.4.3.1 libbz2-devel-32bit-1.0.6-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-3189.html https://bugzilla.suse.com/985657

1 0

openSUSE-SU-2019:1400-1: important: Security update for pacemaker
by opensuse-security＠opensuse.org 15 May '19

15 May '19

openSUSE Security Update: Security update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1400-1 Rating: important References: #1117381 #1131353 #1131356 #1131357 Cross-References: CVE-2018-16877 CVE-2018-16878 CVE-2019-3885 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2019-3885: Fixed an information disclosure in log output. (bsc#1131357) - CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. (bsc#1131356) - CVE-2018-16878: Fixed a denial of service through insufficient verification inflicted preference of uncontrolled processes. (bsc#1131353) Non-security issue fixed: - crmd: delete resource from lrmd when appropriate to avoid timeouts with crmsh (bsc#1117381). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1400=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpacemaker-devel-1.1.18+20180430.b12c320f5-lp150.2.9.1 libpacemaker3-1.1.18+20180430.b12c320f5-lp150.2.9.1 libpacemaker3-debuginfo-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-cli-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-cli-debuginfo-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-debuginfo-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-debugsource-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-remote-1.1.18+20180430.b12c320f5-lp150.2.9.1 pacemaker-remote-debuginfo-1.1.18+20180430.b12c320f5-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): pacemaker-cts-1.1.18+20180430.b12c320f5-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-16877.html https://www.suse.com/security/cve/CVE-2018-16878.html https://www.suse.com/security/cve/CVE-2019-3885.html https://bugzilla.suse.com/1117381 https://bugzilla.suse.com/1131353 https://bugzilla.suse.com/1131356 https://bugzilla.suse.com/1131357

1 0

openSUSE-SU-2019:1397-1: important: Security update for 389-ds
by opensuse-security＠opensuse.org 15 May '19

15 May '19

openSUSE Security Update: Security update for 389-ds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1397-1 Rating: important References: #1076530 #1096368 #1105606 #1106699 Cross-References: CVE-2017-15134 CVE-2017-15135 CVE-2018-10850 CVE-2018-10935 CVE-2018-14624 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for 389-ds fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368) - CVE-2017-15134: Fixed a remote denial of service via search filters in slapi_filter_sprintf in slapd/util.c (bsc#1076530) - CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (bsc#1076530) - CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606) - CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1397=1 Package List: - openSUSE Leap 15.0 (x86_64): 389-ds-1.4.0.3-lp150.3.3.1 389-ds-debuginfo-1.4.0.3-lp150.3.3.1 389-ds-debugsource-1.4.0.3-lp150.3.3.1 389-ds-devel-1.4.0.3-lp150.3.3.1 389-ds-snmp-1.4.0.3-lp150.3.3.1 389-ds-snmp-debuginfo-1.4.0.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-15134.html https://www.suse.com/security/cve/CVE-2017-15135.html https://www.suse.com/security/cve/CVE-2018-10850.html https://www.suse.com/security/cve/CVE-2018-10935.html https://www.suse.com/security/cve/CVE-2018-14624.html https://bugzilla.suse.com/1076530 https://bugzilla.suse.com/1096368 https://bugzilla.suse.com/1105606 https://bugzilla.suse.com/1106699

1 0

openSUSE-RU-2019:1396-1: moderate: Recommended update for gdm
by maintenance＠opensuse.org 14 May '19

14 May '19

openSUSE Recommended Update: Recommended update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1396-1 Rating: moderate References: #1129412 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gdm fixes the following issues: - Remove the gnome session runtime requirement of g-s-d Wacom plugin because it is not build on s390 (bsc#1129412). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1396=1 Package List: - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.13.1 gdm-debuginfo-3.26.2.1-lp150.11.13.1 gdm-debugsource-3.26.2.1-lp150.11.13.1 gdm-devel-3.26.2.1-lp150.11.13.1 libgdm1-3.26.2.1-lp150.11.13.1 libgdm1-debuginfo-3.26.2.1-lp150.11.13.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.13.1 - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.13.1 gdm-lang-3.26.2.1-lp150.11.13.1 gdmflexiserver-3.26.2.1-lp150.11.13.1 References: https://bugzilla.suse.com/1129412

1 0

openSUSE-RU-2019:1384-1: moderate: Recommended update for cifs-utils
by maintenance＠opensuse.org 13 May '19

13 May '19

openSUSE Recommended Update: Recommended update for cifs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1384-1 Rating: moderate References: #1130528 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cifs-utils fixes the following issues: - Allow cached DNS entry to expire (fate#325270). - Document new SMB2.1+ defaults (bsc#1130528). - Add typo corrections, better doc and configure fixes from upstream - Update to cifs-utils 6.8 (please find all 6.8 changes in the changelog) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1384=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cifs-utils-6.8-lp150.2.3.1 cifs-utils-debuginfo-6.8-lp150.2.3.1 cifs-utils-debugsource-6.8-lp150.2.3.1 cifs-utils-devel-6.8-lp150.2.3.1 pam_cifscreds-6.8-lp150.2.3.1 pam_cifscreds-debuginfo-6.8-lp150.2.3.1 References: https://bugzilla.suse.com/1130528

1 0

openSUSE-RU-2019:1381-1: important: Recommended update for aws-vpc-move-ip
by maintenance＠opensuse.org 13 May '19

13 May '19

openSUSE Recommended Update: Recommended update for aws-vpc-move-ip ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1381-1 Rating: important References: #1133962 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for aws-vpc-move-ip fixes the following issues: - Fixed an error when updating the route table in case VM has multiple network interfaces (bsc#1133962) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1381=1 Package List: - openSUSE Leap 15.0 (noarch): aws-vpc-move-ip-0.2.20171113-lp150.2.10.1 References: https://bugzilla.suse.com/1133962

1 0

openSUSE-SU-2019:1394-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1394-1 Rating: important References: #1132549 #1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549). - CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1394=1 Package List: - openSUSE Leap 42.3 (x86_64): freeradius-server-3.0.15-9.1 freeradius-server-debuginfo-3.0.15-9.1 freeradius-server-debugsource-3.0.15-9.1 freeradius-server-devel-3.0.15-9.1 freeradius-server-doc-3.0.15-9.1 freeradius-server-krb5-3.0.15-9.1 freeradius-server-krb5-debuginfo-3.0.15-9.1 freeradius-server-ldap-3.0.15-9.1 freeradius-server-ldap-debuginfo-3.0.15-9.1 freeradius-server-libs-3.0.15-9.1 freeradius-server-libs-debuginfo-3.0.15-9.1 freeradius-server-mysql-3.0.15-9.1 freeradius-server-mysql-debuginfo-3.0.15-9.1 freeradius-server-perl-3.0.15-9.1 freeradius-server-perl-debuginfo-3.0.15-9.1 freeradius-server-postgresql-3.0.15-9.1 freeradius-server-postgresql-debuginfo-3.0.15-9.1 freeradius-server-python-3.0.15-9.1 freeradius-server-python-debuginfo-3.0.15-9.1 freeradius-server-sqlite-3.0.15-9.1 freeradius-server-sqlite-debuginfo-3.0.15-9.1 freeradius-server-utils-3.0.15-9.1 freeradius-server-utils-debuginfo-3.0.15-9.1 References: https://www.suse.com/security/cve/CVE-2019-11234.html https://www.suse.com/security/cve/CVE-2019-11235.html https://bugzilla.suse.com/1132549 https://bugzilla.suse.com/1132664

1 0

openSUSE-SU-2019:1391-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1391-1 Rating: important References: #1132256 Cross-References: CVE-2019-11070 CVE-2019-6201 CVE-2019-6251 CVE-2019-7285 CVE-2019-7292 CVE-2019-8503 CVE-2019-8506 CVE-2019-8515 CVE-2019-8524 CVE-2019-8535 CVE-2019-8536 CVE-2019-8544 CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.24.1 fixes the following issues: Security issues fixed: - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1391=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.1-27.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.1-27.1 libwebkit2gtk-4_0-37-2.24.1-27.1 libwebkit2gtk-4_0-37-debuginfo-2.24.1-27.1 typelib-1_0-JavaScriptCore-4_0-2.24.1-27.1 typelib-1_0-WebKit2-4_0-2.24.1-27.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.1-27.1 webkit-jsc-4-2.24.1-27.1 webkit-jsc-4-debuginfo-2.24.1-27.1 webkit2gtk-4_0-injected-bundles-2.24.1-27.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.1-27.1 webkit2gtk3-debugsource-2.24.1-27.1 webkit2gtk3-devel-2.24.1-27.1 webkit2gtk3-minibrowser-2.24.1-27.1 webkit2gtk3-minibrowser-debuginfo-2.24.1-27.1 webkit2gtk3-plugin-process-gtk2-2.24.1-27.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.1-27.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.24.1-27.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.1-27.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.24.1-27.1 libwebkit2gtk-4_0-37-32bit-2.24.1-27.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.24.1-27.1 References: https://www.suse.com/security/cve/CVE-2019-11070.html https://www.suse.com/security/cve/CVE-2019-6201.html https://www.suse.com/security/cve/CVE-2019-6251.html https://www.suse.com/security/cve/CVE-2019-7285.html https://www.suse.com/security/cve/CVE-2019-7292.html https://www.suse.com/security/cve/CVE-2019-8503.html https://www.suse.com/security/cve/CVE-2019-8506.html https://www.suse.com/security/cve/CVE-2019-8515.html https://www.suse.com/security/cve/CVE-2019-8524.html https://www.suse.com/security/cve/CVE-2019-8535.html https://www.suse.com/security/cve/CVE-2019-8536.html https://www.suse.com/security/cve/CVE-2019-8544.html https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://bugzilla.suse.com/1132256

1 0

openSUSE-RU-2019:1382-1: moderate: Recommended update for perl-IO-Socket-SSL
by maintenance＠opensuse.org 13 May '19

13 May '19

openSUSE Recommended Update: Recommended update for perl-IO-Socket-SSL ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1382-1 Rating: moderate References: #1130684 #1131103 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for perl-IO-Socket-SSL fixes the following issues: - Update expired certificates in the build tests [bsc#1131103, bsc#1130684] perl-IO-Socket-SSL updated to 2.052. See /usr/share/doc/packages/perl-IO-Socket-SSL/Changes for more information. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1382=1 Package List: - openSUSE Leap 42.3 (noarch): perl-IO-Socket-SSL-2.052-8.3.1 References: https://bugzilla.suse.com/1130684 https://bugzilla.suse.com/1131103

1 0