June 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1670-1: moderate: Recommended update for trytond
by maintenance＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Recommended Update: Recommended update for trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1670-1 Rating: moderate References: Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond fixes the following issues: trytond was updated to version 4.2.22 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1670=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1670=1 Package List: - openSUSE Leap 42.3 (noarch): trytond-4.2.22-36.1 - openSUSE Leap 15.0 (noarch): trytond-4.2.22-lp150.2.19.1 References:

1 0

openSUSE-RU-2019:1676-1: moderate: Recommended update for Salt
by maintenance＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Recommended Update: Recommended update for Salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1676-1 Rating: moderate References: #1102819 #1121439 #1122680 #1125015 #1128061 #1129079 #1130784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update includes the following new features: - Update to 2019.2.0 release (fate#327138, bsc#1133523) This update fixes the following issues: salt: - Fix async-batch to fire a single done event - Do not make Salt CLI to crash when there are IPv6 established connections (bsc#1130784) - Include aliases in FQDNS grain (bsc#1121439) - Fix issue preventing syndic to start - Update to 2019.2.0 release (fate#327138, bsc#1133523) See https://docs.saltstack.com/en/latest/topics/releases/2019.2.0.html - Update year on spec copyright notice - Use ThreadPool from multiprocessing.pool to avoid leakings when calculating FQDNs - Do not report patches as installed on RHEL systems when not all the related packages are installed (bsc#1128061) - Incorporate virt.volume_info fixes (PR#131) - Fix for -t parameter in mount module - No longer limiting Python3 version to <3.7 - Add virt.volume_infos and virt.volume_delete functions - Bugfix: properly refresh pillars (bsc#1125015) - Removes version from python3 requirement completely - Adds missing version update to %setup - Add virt.all_capabilities to return all host and domain capabilities at once - Switch to better correct version nomenclature Background: The special character tilde (~) will be available for use in version representing a negative version token. - Fix setup to use the right version tag - Add "id_" and "force" to the whitelist of API check - Add metadata to accepted keyword arguments (bsc#1122680) - Add salt-support script to package - Early feature: Salt support-config (salt-support) - More fixes on the spec file - Fix spaces and indentation - Use Adler32 algorithm to compute string checksums (bsc#1102819) - Update spec file patch ordering after MSI patch removal - Calculate the "FQDNs" grains in parallel to avoid long blocking (bsc#1129079) - Fix batch/batch-async related issues This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1676=1 Package List: - openSUSE Leap 15.0 (noarch): salt-bash-completion-2019.2.0-lp150.3.30.1 salt-fish-completion-2019.2.0-lp150.3.30.1 salt-zsh-completion-2019.2.0-lp150.3.30.1 - openSUSE Leap 15.0 (x86_64): python2-salt-2019.2.0-lp150.3.30.1 python3-salt-2019.2.0-lp150.3.30.1 salt-2019.2.0-lp150.3.30.1 salt-api-2019.2.0-lp150.3.30.1 salt-cloud-2019.2.0-lp150.3.30.1 salt-doc-2019.2.0-lp150.3.30.1 salt-master-2019.2.0-lp150.3.30.1 salt-minion-2019.2.0-lp150.3.30.1 salt-proxy-2019.2.0-lp150.3.30.1 salt-ssh-2019.2.0-lp150.3.30.1 salt-syndic-2019.2.0-lp150.3.30.1 References: https://bugzilla.suse.com/1102819 https://bugzilla.suse.com/1121439 https://bugzilla.suse.com/1122680 https://bugzilla.suse.com/1125015 https://bugzilla.suse.com/1128061 https://bugzilla.suse.com/1129079 https://bugzilla.suse.com/1130784

1 0

openSUSE-SU-2019:1671-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1671-1 Rating: important References: #1137832 Cross-References: CVE-2019-12749 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dbus-1 fixes the following issue: Security issue fixed: - CVE-2019-12749: Fixed an implementation flaw in DBUS_COOKIE_SHA1 which could have allowed local attackers to bypass authentication (bsc#1137832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1671=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dbus-1-1.12.2-lp150.2.4.2 dbus-1-debuginfo-1.12.2-lp150.2.4.2 dbus-1-debugsource-1.12.2-lp150.2.4.2 dbus-1-devel-1.12.2-lp150.2.4.2 dbus-1-x11-1.12.2-lp150.2.4.2 dbus-1-x11-debuginfo-1.12.2-lp150.2.4.2 dbus-1-x11-debugsource-1.12.2-lp150.2.4.2 libdbus-1-3-1.12.2-lp150.2.4.2 libdbus-1-3-debuginfo-1.12.2-lp150.2.4.2 - openSUSE Leap 15.0 (x86_64): dbus-1-32bit-debuginfo-1.12.2-lp150.2.4.2 dbus-1-devel-32bit-1.12.2-lp150.2.4.2 libdbus-1-3-32bit-1.12.2-lp150.2.4.2 libdbus-1-3-32bit-debuginfo-1.12.2-lp150.2.4.2 - openSUSE Leap 15.0 (noarch): dbus-1-devel-doc-1.12.2-lp150.2.4.2 References: https://www.suse.com/security/cve/CVE-2019-12749.html https://bugzilla.suse.com/1137832

1 0

openSUSE-SU-2019:1672-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1672-1 Rating: important References: #1136109 #1138301 #1138302 #1138303 Cross-References: CVE-2019-10161 CVE-2019-10166 CVE-2019-10167 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301). - CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302). - CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303). Other issue addressed: - spec: add systemd-container dependency to qemu and lxc drivers (bsc#1136109). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1672=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvirt-4.0.0-lp150.7.18.2 libvirt-admin-4.0.0-lp150.7.18.2 libvirt-admin-debuginfo-4.0.0-lp150.7.18.2 libvirt-client-4.0.0-lp150.7.18.2 libvirt-client-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-4.0.0-lp150.7.18.2 libvirt-daemon-config-network-4.0.0-lp150.7.18.2 libvirt-daemon-config-nwfilter-4.0.0-lp150.7.18.2 libvirt-daemon-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-interface-4.0.0-lp150.7.18.2 libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-lxc-4.0.0-lp150.7.18.2 libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-network-4.0.0-lp150.7.18.2 libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nodedev-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-qemu-4.0.0-lp150.7.18.2 libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-secret-4.0.0-lp150.7.18.2 libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-core-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-uml-4.0.0-lp150.7.18.2 libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-vbox-4.0.0-lp150.7.18.2 libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-hooks-4.0.0-lp150.7.18.2 libvirt-daemon-lxc-4.0.0-lp150.7.18.2 libvirt-daemon-qemu-4.0.0-lp150.7.18.2 libvirt-daemon-uml-4.0.0-lp150.7.18.2 libvirt-daemon-vbox-4.0.0-lp150.7.18.2 libvirt-debugsource-4.0.0-lp150.7.18.2 libvirt-devel-4.0.0-lp150.7.18.2 libvirt-doc-4.0.0-lp150.7.18.2 libvirt-libs-4.0.0-lp150.7.18.2 libvirt-libs-debuginfo-4.0.0-lp150.7.18.2 libvirt-lock-sanlock-4.0.0-lp150.7.18.2 libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.18.2 libvirt-nss-4.0.0-lp150.7.18.2 libvirt-nss-debuginfo-4.0.0-lp150.7.18.2 wireshark-plugin-libvirt-4.0.0-lp150.7.18.2 wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.18.2 - openSUSE Leap 15.0 (x86_64): libvirt-client-32bit-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-libxl-4.0.0-lp150.7.18.2 libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-xen-4.0.0-lp150.7.18.2 libvirt-devel-32bit-4.0.0-lp150.7.18.2 References: https://www.suse.com/security/cve/CVE-2019-10161.html https://www.suse.com/security/cve/CVE-2019-10166.html https://www.suse.com/security/cve/CVE-2019-10167.html https://bugzilla.suse.com/1136109 https://bugzilla.suse.com/1138301 https://bugzilla.suse.com/1138302 https://bugzilla.suse.com/1138303

1 0

openSUSE-RU-2019:1674-1: moderate: Recommended update for php72-redis
by maintenance＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Recommended Update: Recommended update for php72-redis ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1674-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for php72-redis fixes the following issues: php72-redis was updated to 4.3.0: * Proper persistent connections pooling implementation * RedisArray auth * Use zend_string for storing key * Add ZPOPMAX and ZPOPMIN support * Implement GEORADIUS_RO and GEORADIUSBYMEMBER_RO * Add callback parameter to subscribe/psubscribe arginfo * Don't check the number affected keys in PS_UPDATE_TIMESTAMP_FUNC * Xgroup updates * RedisCluster auth * Cancel pipeline mode without executing commands * Use zend_string for pipeline_cmd * Different key hashing algorithms from hash extension * Breaking the lock acquire loop in case of network problems * Implement consistent hashing algorithm for RedisArray * Use zend_string for storing RedisArray hosts * Update lzf_compress to be compatible with PECL lzf extension * Fix RedisCluster keys memory leak * Directly use return_value in RedisCluster::keys method * Fix segfault in Redis Cluster with inconsistent configuration * Masters info leakfix * Refactor redis_sock_read_bulk_reply * Remove unused parameter lazy_connect from redis_sock_create * Remove useless ZEND_ACC_[C|D]TOR. * Documentation improvements * Added additional settings to redis.ini Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1674=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): php72-redis-4.3.0-2.1 References:

1 0

openSUSE-RU-2019:1677-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1677-1 Rating: moderate References: #1095804 #1103388 #1103696 #1104034 #1118492 #1120242 #1125610 #1125744 #1128529 #1128564 #1129243 #1129300 #1130041 #1130077 #1131677 #1132346 #1133424 #1134876 #1136102 #1138130 #987798 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 21 recommended fixes can now be installed. Description: This update fixes the following issues: koan: - Require virt-install only for RHEL6/7. Other distributions accepting Recommends must use it as virt-install is not available sometimes (for example SLED) - Change virt-install from Reccommends to Require because this fixes RHEL 6 & 7 - Fix regex error in the files section - Remove Recursion in python_sitelib and remove non relevant parts of the specfile - Replace python2_sitelib macro with python_sitelib to fix build on older distros. - Remove duplicate file section entrys - Adjust Group Tag to Development/Libraries/Python to satisfy linter prometheus-node_exporter: - Add the package to the SLE Basesytem module. (fate#327287) rhnlib: - Add group to python*-rhnlib to fix building at SLE11 - Read SSL decoded buffer completely when no pending bytes on the underlying connection. - Fix encoding issues after porting to Python 3. - Sync changes from Spacewalk - 1652859 - python3 http.client does not contain _set_hostport() - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacecmd: - Save SSM list on system delete and update cache (bsc#1130077, bsc#1125744) - Replace iteritems with items for python2/3 compat (bsc#1129243) - Fix python 3 bytes issue when handling config channels - Prevent spacecmd crashing when piping the output in Python 3 (bsc#1125610) - Fix compatibility with Python 3 - Add function to merge errata and packages through spacecmd (bsc#987798) - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-backend: - Use new names in code for client tool packages which were renamed (bsc#1134876) - Fix password prompt within mgr-sign-metadata - Fix TypeError for 'errata.getErrataInfo' XMLRPC handler (bsc#1132346) - Fix typo in syncing product extensions (bsc#1118492) - Fix mgr-sign-metadata-ctl checking of exported keys. - Use suseLib.get_proxy to get the HTTP proxy configuration properly on DEB repos (bsc#1133424) - Add support for mirrorlist and metalink on Zypper reposync. - Solve situations where synced packages have epoch 0 but reposync does not find them them on the database. - Fix path to the RPM database used by Zypper at reposync. - Add makefile for python linter and unit/integration tests - Fix linking of packages in reposync (bsc#1131677) - Include arch to distinct latest packages on reposync. - Migrate missing spacewalk-cfg-get script to Python3 - Improve dependency solving algorithm for spacewalk-repo-sync. - Remove apache access_compat module and adapt config files - Add support for getting latest versions from RPM packages when running "spacewalk-repo-sync" after migration to Zypper. - Include packages dependencies on "spacewalk-repo-sync" when using filters for RPM packages. - Allow package filtering (name matching) on spacewalk-repo-sync after migrating away from yum. - Fix crash when importing new channel families on 'mgr-inter-sync' (bsc#1129300) - Make Zypper to use the spacewalk GPG keyring in reposync (bsc#1128529) - Fix: handle non-standard filenames for comps.xml (bsc#1120242) - Make reposync use and append token correctly to the URL - Fix invalid mode error when doing spacewalk-repo-sync on Ubuntu official repos. - Fix bootstrapping SLE15 traditional client (bsc#1128564) - Fix reading LOB objects with python3 - Fix "mgr-inter-sync" problems after Python 3 migration. - Mgr-sign-metadata can optionally clear-sign metadata files - Allow errata import from local repositories. - Fix "rhnpush" after migration to Python 3. - Fix package import issues when package encoding is ISO8859-1. - Fix issues with HTTP proxy and reposync. - Solve Python 3 problem and allow traditional registration. - Add "python-urlgrabber" as a new dependency. - Fix Python3 issues on satellite_tools scripts - Use "Zypper" and "libsolv" in "spacewalk-repo-sync". Replace "yum". - Require the correct dependency for python-rpm to allow the Proxy to work with Python3 only - Make rhn-ssl-dbstore compatible with python3 - Take only text files from /srv/salt to make spacewalk-debug smaller (bsc#1103388) - Support mirroring of source packages - Make spacewalk-backend code compatible with Python 3 - Prepare spacewalk-backend packages to build on Python 3 - Replace PyPAM with python-python-pam - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) - Disable Oracle support for openSUSE (bsc#1095804) spacewalk-client-tools: - Fix bootstrapping SLE15 traditional client (bsc#1128564) - Sync with Spacewalk - Add ability to work behind http proxies - 1666099 - python3 is picky about bytes and string - Fix testConfig.py - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) - The rhnsd service was replaced by rhnsd timer, so registration script and systemd presets are now adapted to this (bsc#1138130) spacewalk-koan: - Fix building on openSUSE 15.0 - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-oscap: - Fix python2 compilation on openSUSE - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-remote-utils: - Sync changes from Spacewalk - 1649374 - Update spacewalk-remote-utils with RHEL 7.6 channel definitions - 1633532 - Use python-gpg instead of python-gpgme where possible - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-usix: - Add compatibility with Python 3 - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) supportutils-plugin-susemanager-client: - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) suseRegisterInfo: - Make suseRegisterInfo compatible with Python 2 and 3 - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) zypp-plugin-spacewalk: - Fix python syntax error in distupgrade (bsc#1136102) mgr-daemon: - rhnsd service was replaced by rhnsd timer (bsc#1138130) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1677=1 Package List: - openSUSE Leap 15.0 (x86_64): golang-github-prometheus-node_exporter-0.17.0-lp150.2.3.1 References: https://bugzilla.suse.com/1095804 https://bugzilla.suse.com/1103388 https://bugzilla.suse.com/1103696 https://bugzilla.suse.com/1104034 https://bugzilla.suse.com/1118492 https://bugzilla.suse.com/1120242 https://bugzilla.suse.com/1125610 https://bugzilla.suse.com/1125744 https://bugzilla.suse.com/1128529 https://bugzilla.suse.com/1128564 https://bugzilla.suse.com/1129243 https://bugzilla.suse.com/1129300 https://bugzilla.suse.com/1130041 https://bugzilla.suse.com/1130077 https://bugzilla.suse.com/1131677 https://bugzilla.suse.com/1132346 https://bugzilla.suse.com/1133424 https://bugzilla.suse.com/1134876 https://bugzilla.suse.com/1136102 https://bugzilla.suse.com/1138130 https://bugzilla.suse.com/987798

1 0

openSUSE-RU-2019:1675-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1675-1 Rating: moderate References: #1095804 #1103388 #1103696 #1104034 #1118492 #1120242 #1125610 #1125744 #1128529 #1128564 #1129243 #1129300 #1130077 #1131677 #1132346 #1133424 #1134876 #1136102 #1138130 #987798 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 20 recommended fixes can now be installed. Description: This update fixes the following issues: POS_Image-Graphical6: - Add busybox package for tftp client POS_Image-JeOS6: - Add busybox package for tftp client hwdata: - Fix build for older distributon not supporting license tag at the SPEC file kiwi-desc-saltboot: - Refactor kernel check and kexec functionality - make sure that preinit is called with correct kernel - Support for SLES11 - Add nls modules for vfat - Fallback to previously installed image if SUMA is offline - Add tools to create efi partition - Add nvme drivers rhnlib: - Add group to python*-rhnlib to fix building at SLE11 - Read SSL decoded buffer completely when no pending bytes on the underlying connection. - Fix encoding issues after porting to Python 3. - Sync changes from Spacewalk - 1652859 - python3 http.client does not contain _set_hostport() - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacecmd: - Save SSM list on system delete and update cache (bsc#1130077, bsc#1125744) - Replace iteritems with items for python2/3 compat (bsc#1129243) - Fix python 3 bytes issue when handling config channels - Prevent spacecmd crashing when piping the output in Python 3 (bsc#1125610) - Fix compatibility with Python 3 - Add function to merge errata and packages through spacecmd (bsc#987798) - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-backend: - Use new names in code for client tool packages which were renamed (bsc#1134876) - Fix password prompt within mgr-sign-metadata - Fix TypeError for 'errata.getErrataInfo' XMLRPC handler (bsc#1132346) - Fix typo in syncing product extensions (bsc#1118492) - Fix mgr-sign-metadata-ctl checking of exported keys. - Use suseLib.get_proxy to get the HTTP proxy configuration properly on DEB repos (bsc#1133424) - Add support for mirrorlist and metalink on Zypper reposync. - Solve situations where synced packages have epoch 0 but reposync does not find them them on the database. - Fix path to the RPM database used by Zypper at reposync. - Add makefile for python linter and unit/integration tests - Fix linking of packages in reposync (bsc#1131677) - Include arch to distinct latest packages on reposync. - Migrate missing spacewalk-cfg-get script to Python3 - Improve dependency solving algorithm for spacewalk-repo-sync. - Remove apache access_compat module and adapt config files - Add support for getting latest versions from RPM packages when running "spacewalk-repo-sync" after migration to Zypper. - Include packages dependencies on "spacewalk-repo-sync" when using filters for RPM packages. - Allow package filtering (name matching) on spacewalk-repo-sync after migrating away from yum. - Fix crash when importing new channel families on 'mgr-inter-sync' (bsc#1129300) - Make Zypper to use the spacewalk GPG keyring in reposync (bsc#1128529) - Fix: handle non-standard filenames for comps.xml (bsc#1120242) - Make reposync use and append token correctly to the URL - Fix invalid mode error when doing spacewalk-repo-sync on Ubuntu official repos. - Fix bootstrapping SLE15 traditional client (bsc#1128564) - Fix reading LOB objects with python3 - Fix "mgr-inter-sync" problems after Python 3 migration. - Mgr-sign-metadata can optionally clear-sign metadata files - Allow errata import from local repositories. - Fix "rhnpush" after migration to Python 3. - Fix package import issues when package encoding is ISO8859-1. - Fix issues with HTTP proxy and reposync. - Solve Python 3 problem and allow traditional registration. - Add "python-urlgrabber" as a new dependency. - Fix Python3 issues on satellite_tools scripts - Use "Zypper" and "libsolv" in "spacewalk-repo-sync". Replace "yum". - Require the correct dependency for python-rpm to allow the Proxy to work with Python3 only - Make rhn-ssl-dbstore compatible with python3 - Take only text files from /srv/salt to make spacewalk-debug smaller (bsc#1103388) - Support mirroring of source packages - Make spacewalk-backend code compatible with Python 3 - Prepare spacewalk-backend packages to build on Python 3 - Replace PyPAM with python-python-pam - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) - Disable Oracle support for openSUSE (bsc#1095804) spacewalk-client-tools: - Fix bootstrapping SLE15 traditional client (bsc#1128564) - Sync with Spacewalk - Add ability to work behind http proxies - 1666099 - python3 is picky about bytes and string - Fix testConfig.py - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) - The rhnsd service was replaced by rhnsd timer, so registration script and systemd presets are now adapted to this (bsc#1138130) spacewalk-koan: - Fix building on openSUSE 15.0 - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-oscap: - Fix python2 compilation on openSUSE - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-remote-utils: - Sync changes from Spacewalk - 1649374 - Update spacewalk-remote-utils with RHEL 7.6 channel definitions - 1633532 - Use python-gpg instead of python-gpgme where possible - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacewalk-usix: - Compatibility with Python 2 and 3 - Use rpm for debian packaging - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) supportutils-plugin-susemanager-client: - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) suseRegisterInfo: - Make suseRegisterInfo compatible with Python 2 and 3 - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) zypp-plugin-spacewalk: - Fix python syntax error in distupgrade (bsc#1136102) mgr-daemon: - rhnsd service was replaced by rhnsd timer (bsc#1138130) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1675=1 Package List: - openSUSE Leap 42.3 (noarch): hwdata-0.314-16.1 References: https://bugzilla.suse.com/1095804 https://bugzilla.suse.com/1103388 https://bugzilla.suse.com/1103696 https://bugzilla.suse.com/1104034 https://bugzilla.suse.com/1118492 https://bugzilla.suse.com/1120242 https://bugzilla.suse.com/1125610 https://bugzilla.suse.com/1125744 https://bugzilla.suse.com/1128529 https://bugzilla.suse.com/1128564 https://bugzilla.suse.com/1129243 https://bugzilla.suse.com/1129300 https://bugzilla.suse.com/1130077 https://bugzilla.suse.com/1131677 https://bugzilla.suse.com/1132346 https://bugzilla.suse.com/1133424 https://bugzilla.suse.com/1134876 https://bugzilla.suse.com/1136102 https://bugzilla.suse.com/1138130 https://bugzilla.suse.com/987798

1 0

openSUSE-SU-2019:1673-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1673-1 Rating: moderate References: #1111966 #1131055 #1136085 Cross-References: CVE-2019-0199 CVE-2019-0221 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for tomcat to version 9.0.20 fixes the following issues: Security issues fixed: - CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055). - CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085). Non-security issues fixed: - Increase maximum number of threads and open files for tomcat (bsc#1111966). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1673=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.20-lp150.2.19.1 tomcat-admin-webapps-9.0.20-lp150.2.19.1 tomcat-docs-webapp-9.0.20-lp150.2.19.1 tomcat-el-3_0-api-9.0.20-lp150.2.19.1 tomcat-embed-9.0.20-lp150.2.19.1 tomcat-javadoc-9.0.20-lp150.2.19.1 tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1 tomcat-jsvc-9.0.20-lp150.2.19.1 tomcat-lib-9.0.20-lp150.2.19.1 tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1 tomcat-webapps-9.0.20-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-0199.html https://www.suse.com/security/cve/CVE-2019-0221.html https://bugzilla.suse.com/1111966 https://bugzilla.suse.com/1131055 https://bugzilla.suse.com/1136085

1 0

openSUSE-SU-2019:1667-1: moderate: Recommended update for evince
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Recommended update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1667-1 Rating: moderate References: #1122794 #1133037 Cross-References: CVE-2019-11459 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for evince provides the following fixes: Security issue fixed: - CVE-2019-11459: Fixed an improper error handling in which could have led to use of unitialized use of memory (bsc#1133037). Other issue addressed: - Removed Supplements from psdocument package, so that it isn't pulled in by default (bsc#1122794). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1667=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1667=1 Package List: - openSUSE Leap 15.1 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): evince-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-debugsource-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.3.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.3.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.3.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.3.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): evince-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-debugsource-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-devel-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp150.3.3.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 libevview3-3-3.26.0+20180128.1bd86963-lp150.3.3.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 nautilus-evince-3.26.0+20180128.1bd86963-lp150.3.3.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp150.3.3.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11459.html https://bugzilla.suse.com/1122794 https://bugzilla.suse.com/1133037

1 0

openSUSE-SU-2019:1668-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1668-1 Rating: moderate References: #1134689 Cross-References: CVE-2019-10130 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql96 fixes the following issues: Security issue fixed: - CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1668=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql96-9.6.13-24.1 postgresql96-contrib-9.6.13-24.1 postgresql96-contrib-debuginfo-9.6.13-24.1 postgresql96-debuginfo-9.6.13-24.1 postgresql96-debugsource-9.6.13-24.1 postgresql96-devel-9.6.13-24.1 postgresql96-devel-debuginfo-9.6.13-24.1 postgresql96-libs-debugsource-9.6.13-24.1 postgresql96-plperl-9.6.13-24.1 postgresql96-plperl-debuginfo-9.6.13-24.1 postgresql96-plpython-9.6.13-24.1 postgresql96-plpython-debuginfo-9.6.13-24.1 postgresql96-pltcl-9.6.13-24.1 postgresql96-pltcl-debuginfo-9.6.13-24.1 postgresql96-server-9.6.13-24.1 postgresql96-server-debuginfo-9.6.13-24.1 postgresql96-test-9.6.13-24.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.13-24.1 References: https://www.suse.com/security/cve/CVE-2019-10130.html https://bugzilla.suse.com/1134689

1 0

openSUSE-SU-2019:1669-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1669-1 Rating: moderate References: #1136021 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for wireshark to version 2.4.15 fixes the following issues: Security issue fixed: - Fixed a denial of service in the dissection engine (bsc#1136021). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1669=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1669=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwireshark9-2.4.15-lp151.2.3.1 libwireshark9-debuginfo-2.4.15-lp151.2.3.1 libwiretap7-2.4.15-lp151.2.3.1 libwiretap7-debuginfo-2.4.15-lp151.2.3.1 libwscodecs1-2.4.15-lp151.2.3.1 libwscodecs1-debuginfo-2.4.15-lp151.2.3.1 libwsutil8-2.4.15-lp151.2.3.1 libwsutil8-debuginfo-2.4.15-lp151.2.3.1 wireshark-2.4.15-lp151.2.3.1 wireshark-debuginfo-2.4.15-lp151.2.3.1 wireshark-debugsource-2.4.15-lp151.2.3.1 wireshark-devel-2.4.15-lp151.2.3.1 wireshark-ui-qt-2.4.15-lp151.2.3.1 wireshark-ui-qt-debuginfo-2.4.15-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.15-lp150.2.29.1 libwireshark9-debuginfo-2.4.15-lp150.2.29.1 libwiretap7-2.4.15-lp150.2.29.1 libwiretap7-debuginfo-2.4.15-lp150.2.29.1 libwscodecs1-2.4.15-lp150.2.29.1 libwscodecs1-debuginfo-2.4.15-lp150.2.29.1 libwsutil8-2.4.15-lp150.2.29.1 libwsutil8-debuginfo-2.4.15-lp150.2.29.1 wireshark-2.4.15-lp150.2.29.1 wireshark-debuginfo-2.4.15-lp150.2.29.1 wireshark-debugsource-2.4.15-lp150.2.29.1 wireshark-devel-2.4.15-lp150.2.29.1 wireshark-ui-qt-2.4.15-lp150.2.29.1 wireshark-ui-qt-debuginfo-2.4.15-lp150.2.29.1 References: https://bugzilla.suse.com/1136021

1 0

openSUSE-SU-2019:1666-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1666-1 Rating: important References: #1129059 #1133313 #1134218 #1137332 #1138287 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 CVE-2019-5824 CVE-2019-5827 CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 CVE-2019-5842 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 53 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 75.0.3770.90 (boo#1137332 boo#1138287): * CVE-2019-5842: Use-after-free in Blink. Also updated to 75.0.3770.80 boo#1137332: * CVE-2019-5828: Use after free in ServiceWorker * CVE-2019-5829: Use after free in Download Manager * CVE-2019-5830: Incorrectly credentialed requests in CORS * CVE-2019-5831: Incorrect map processing in V8 * CVE-2019-5832: Incorrect CORS handling in XHR * CVE-2019-5833: Inconsistent security UI placemen * CVE-2019-5835: Out of bounds read in Swiftshader * CVE-2019-5836: Heap buffer overflow in Angle * CVE-2019-5837: Cross-origin resources size disclosure in Appcache * CVE-2019-5838: Overly permissive tab access in Extensions * CVE-2019-5839: Incorrect handling of certain code points in Blink * CVE-2019-5840: Popup blocker bypass * Various fixes from internal audits, fuzzing and other initiatives * CVE-2019-5834: URL spoof in Omnibox on iOS Update to 74.0.3729.169: * Feature fixes update only Update to 74.0.3729.157: * Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): * CVE-2019-5827: Out-of-bounds access in SQLite * CVE-2019-5824: Parameter passing error in media player Update to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows Update to 73.0.3686.103: * Various feature fixes Update to 73.0.3683.86: * Just feature fixes around - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Update to 73.0.3683.75 boo#1129059: * CVE-2019-5787: Use after free in Canvas. * CVE-2019-5788: Use after free in FileAPI. * CVE-2019-5789: Use after free in WebMIDI. * CVE-2019-5790: Heap buffer overflow in V8. * CVE-2019-5791: Type confusion in V8. * CVE-2019-5792: Integer overflow in PDFium. * CVE-2019-5793: Excessive permissions for private API in Extensions. * CVE-2019-5794: Security UI spoofing. * CVE-2019-5795: Integer overflow in PDFium. * CVE-2019-5796: Race condition in Extensions. * CVE-2019-5797: Race condition in DOMStorage. * CVE-2019-5798: Out of bounds read in Skia. * CVE-2019-5799: CSP bypass with blob URL. * CVE-2019-5800: CSP bypass with blob URL. * CVE-2019-5801: Incorrect Omnibox display on iOS. * CVE-2019-5802: Security UI spoofing. * CVE-2019-5803: CSP bypass with Javascript URLs'. * CVE-2019-5804: Command line command injection on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1666=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1666=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-75.0.3770.90-217.1 chromedriver-debuginfo-75.0.3770.90-217.1 chromium-75.0.3770.90-217.1 chromium-debuginfo-75.0.3770.90-217.1 chromium-debugsource-75.0.3770.90-217.1 - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.90-lp151.2.9.3 chromedriver-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-75.0.3770.90-lp151.2.9.3 chromium-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-debugsource-75.0.3770.90-lp151.2.9.3 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.90-lp150.218.4 chromedriver-debuginfo-75.0.3770.90-lp150.218.4 chromium-75.0.3770.90-lp150.218.4 chromium-debuginfo-75.0.3770.90-lp150.218.4 chromium-debugsource-75.0.3770.90-lp150.218.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.90-bp150.213.3 chromedriver-debuginfo-75.0.3770.90-bp150.213.3 chromium-75.0.3770.90-bp150.213.3 chromium-debuginfo-75.0.3770.90-bp150.213.3 chromium-debugsource-75.0.3770.90-bp150.213.3 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.90-2.1 chromedriver-debuginfo-75.0.3770.90-2.1 chromium-75.0.3770.90-2.1 chromium-debuginfo-75.0.3770.90-2.1 chromium-debugsource-75.0.3770.90-2.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://www.suse.com/security/cve/CVE-2019-5828.html https://www.suse.com/security/cve/CVE-2019-5829.html https://www.suse.com/security/cve/CVE-2019-5830.html https://www.suse.com/security/cve/CVE-2019-5831.html https://www.suse.com/security/cve/CVE-2019-5832.html https://www.suse.com/security/cve/CVE-2019-5833.html https://www.suse.com/security/cve/CVE-2019-5834.html https://www.suse.com/security/cve/CVE-2019-5835.html https://www.suse.com/security/cve/CVE-2019-5836.html https://www.suse.com/security/cve/CVE-2019-5837.html https://www.suse.com/security/cve/CVE-2019-5838.html https://www.suse.com/security/cve/CVE-2019-5839.html https://www.suse.com/security/cve/CVE-2019-5840.html https://www.suse.com/security/cve/CVE-2019-5842.html https://bugzilla.suse.com/1129059 https://bugzilla.suse.com/1133313 https://bugzilla.suse.com/1134218 https://bugzilla.suse.com/1137332 https://bugzilla.suse.com/1138287

1 0

openSUSE-SU-2019:1666-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1666-1 Rating: important References: #1129059 #1133313 #1134218 #1137332 #1138287 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 CVE-2019-5824 CVE-2019-5827 CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 CVE-2019-5842 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 53 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 75.0.3770.90 (boo#1137332 boo#1138287): * CVE-2019-5842: Use-after-free in Blink. Also updated to 75.0.3770.80 boo#1137332: * CVE-2019-5828: Use after free in ServiceWorker * CVE-2019-5829: Use after free in Download Manager * CVE-2019-5830: Incorrectly credentialed requests in CORS * CVE-2019-5831: Incorrect map processing in V8 * CVE-2019-5832: Incorrect CORS handling in XHR * CVE-2019-5833: Inconsistent security UI placemen * CVE-2019-5835: Out of bounds read in Swiftshader * CVE-2019-5836: Heap buffer overflow in Angle * CVE-2019-5837: Cross-origin resources size disclosure in Appcache * CVE-2019-5838: Overly permissive tab access in Extensions * CVE-2019-5839: Incorrect handling of certain code points in Blink * CVE-2019-5840: Popup blocker bypass * Various fixes from internal audits, fuzzing and other initiatives * CVE-2019-5834: URL spoof in Omnibox on iOS Update to 74.0.3729.169: * Feature fixes update only Update to 74.0.3729.157: * Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): * CVE-2019-5827: Out-of-bounds access in SQLite * CVE-2019-5824: Parameter passing error in media player Update to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows Update to 73.0.3686.103: * Various feature fixes Update to 73.0.3683.86: * Just feature fixes around - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Update to 73.0.3683.75 boo#1129059: * CVE-2019-5787: Use after free in Canvas. * CVE-2019-5788: Use after free in FileAPI. * CVE-2019-5789: Use after free in WebMIDI. * CVE-2019-5790: Heap buffer overflow in V8. * CVE-2019-5791: Type confusion in V8. * CVE-2019-5792: Integer overflow in PDFium. * CVE-2019-5793: Excessive permissions for private API in Extensions. * CVE-2019-5794: Security UI spoofing. * CVE-2019-5795: Integer overflow in PDFium. * CVE-2019-5796: Race condition in Extensions. * CVE-2019-5797: Race condition in DOMStorage. * CVE-2019-5798: Out of bounds read in Skia. * CVE-2019-5799: CSP bypass with blob URL. * CVE-2019-5800: CSP bypass with blob URL. * CVE-2019-5801: Incorrect Omnibox display on iOS. * CVE-2019-5802: Security UI spoofing. * CVE-2019-5803: CSP bypass with Javascript URLs'. * CVE-2019-5804: Command line command injection on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1666=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-75.0.3770.90-217.1 chromedriver-debuginfo-75.0.3770.90-217.1 chromium-75.0.3770.90-217.1 chromium-debuginfo-75.0.3770.90-217.1 chromium-debugsource-75.0.3770.90-217.1 - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.90-lp151.2.9.3 chromedriver-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-75.0.3770.90-lp151.2.9.3 chromium-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-debugsource-75.0.3770.90-lp151.2.9.3 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.90-lp150.218.4 chromedriver-debuginfo-75.0.3770.90-lp150.218.4 chromium-75.0.3770.90-lp150.218.4 chromium-debuginfo-75.0.3770.90-lp150.218.4 chromium-debugsource-75.0.3770.90-lp150.218.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.90-bp150.213.3 chromedriver-debuginfo-75.0.3770.90-bp150.213.3 chromium-75.0.3770.90-bp150.213.3 chromium-debuginfo-75.0.3770.90-bp150.213.3 chromium-debugsource-75.0.3770.90-bp150.213.3 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://www.suse.com/security/cve/CVE-2019-5828.html https://www.suse.com/security/cve/CVE-2019-5829.html https://www.suse.com/security/cve/CVE-2019-5830.html https://www.suse.com/security/cve/CVE-2019-5831.html https://www.suse.com/security/cve/CVE-2019-5832.html https://www.suse.com/security/cve/CVE-2019-5833.html https://www.suse.com/security/cve/CVE-2019-5834.html https://www.suse.com/security/cve/CVE-2019-5835.html https://www.suse.com/security/cve/CVE-2019-5836.html https://www.suse.com/security/cve/CVE-2019-5837.html https://www.suse.com/security/cve/CVE-2019-5838.html https://www.suse.com/security/cve/CVE-2019-5839.html https://www.suse.com/security/cve/CVE-2019-5840.html https://www.suse.com/security/cve/CVE-2019-5842.html https://bugzilla.suse.com/1129059 https://bugzilla.suse.com/1133313 https://bugzilla.suse.com/1134218 https://bugzilla.suse.com/1137332 https://bugzilla.suse.com/1138287

1 0

openSUSE-SU-2019:1664-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1664-1 Rating: important References: #1130694 #1133267 #1135824 #1137595 #1138872 Cross-References: CVE-2018-18511 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11694 CVE-2019-11698 CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706 CVE-2019-11707 CVE-2019-11708 CVE-2019-5798 CVE-2019-7317 CVE-2019-9797 CVE-2019-9800 CVE-2019-9815 CVE-2019-9816 CVE-2019-9817 CVE-2019-9818 CVE-2019-9819 CVE-2019-9820 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872): * CVE-2019-11707: Type confusion in Array.pop * CVE-2019-11708: sandbox escape using Prompt:Open Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595): * CVE-2019-11703: Heap buffer overflow in icalparser.c * CVE-2019-11704: Heap buffer overflow in icalvalue.c * CVE-2019-11705: Stack buffer overflow in icalrecur.c * CVE-2019-11706: Type confusion in icalproperty.c Also fixed: No prompt for smartcard PIN when S/MIME signing is used Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824): * Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut * CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816: Type confusion with object groups and UnboxedObjects * CVE-2019-9817: Stealing of cross-domain images using canvas * CVE-2019-9818 (Windows only): Use-after-free in crash generation server * CVE-2019-9819: Compartment mismatch with fetch API * CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell * CVE-2019-11691: Use-after-free in XMLHttpRequest * CVE-2019-11692: Use-after-free removing listeners in the event listener manager * CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux * CVE-2019-7317: Use-after-free in png_image_free of libpng library * CVE-2019-9797: Cross-origin theft of images with createImageBitmap * CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox * CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks * CVE-2019-5798: Out-of-bounds read in Skia * CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 - Disable building with LTO (boo#1133267). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1664=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.7.2-85.1 MozillaThunderbird-buildsymbols-60.7.2-85.1 MozillaThunderbird-translations-common-60.7.2-85.1 MozillaThunderbird-translations-other-60.7.2-85.1 References: https://www.suse.com/security/cve/CVE-2018-18511.html https://www.suse.com/security/cve/CVE-2019-11691.html https://www.suse.com/security/cve/CVE-2019-11692.html https://www.suse.com/security/cve/CVE-2019-11693.html https://www.suse.com/security/cve/CVE-2019-11694.html https://www.suse.com/security/cve/CVE-2019-11698.html https://www.suse.com/security/cve/CVE-2019-11703.html https://www.suse.com/security/cve/CVE-2019-11704.html https://www.suse.com/security/cve/CVE-2019-11705.html https://www.suse.com/security/cve/CVE-2019-11706.html https://www.suse.com/security/cve/CVE-2019-11707.html https://www.suse.com/security/cve/CVE-2019-11708.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-7317.html https://www.suse.com/security/cve/CVE-2019-9797.html https://www.suse.com/security/cve/CVE-2019-9800.html https://www.suse.com/security/cve/CVE-2019-9815.html https://www.suse.com/security/cve/CVE-2019-9816.html https://www.suse.com/security/cve/CVE-2019-9817.html https://www.suse.com/security/cve/CVE-2019-9818.html https://www.suse.com/security/cve/CVE-2019-9819.html https://www.suse.com/security/cve/CVE-2019-9820.html https://bugzilla.suse.com/1130694 https://bugzilla.suse.com/1133267 https://bugzilla.suse.com/1135824 https://bugzilla.suse.com/1137595 https://bugzilla.suse.com/1138872

1 0

openSUSE-RU-2019:1665-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1665-1 Rating: moderate References: #1134059 #1136605 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gtk3 provides the following fixes: - Improve font handling. (bsc#1134059) - Always use the None pixmap for no background on X11, to prevent GTK3 applications from staying on top of other applications in Awesome WM. (bsc#1136605) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1665=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1665=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gettext-its-gtk3-3.22.30-lp151.6.6.1 gtk3-debugsource-3.22.30-lp151.6.6.1 gtk3-devel-3.22.30-lp151.6.6.1 gtk3-devel-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-amharic-3.22.30-lp151.6.6.1 gtk3-immodule-amharic-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-broadway-3.22.30-lp151.6.6.1 gtk3-immodule-broadway-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-inuktitut-3.22.30-lp151.6.6.1 gtk3-immodule-inuktitut-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-multipress-3.22.30-lp151.6.6.1 gtk3-immodule-multipress-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-thai-3.22.30-lp151.6.6.1 gtk3-immodule-thai-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-vietnamese-3.22.30-lp151.6.6.1 gtk3-immodule-vietnamese-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-xim-3.22.30-lp151.6.6.1 gtk3-immodule-xim-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodules-tigrigna-3.22.30-lp151.6.6.1 gtk3-immodules-tigrigna-debuginfo-3.22.30-lp151.6.6.1 gtk3-tools-3.22.30-lp151.6.6.1 gtk3-tools-debuginfo-3.22.30-lp151.6.6.1 libgtk-3-0-3.22.30-lp151.6.6.1 libgtk-3-0-debuginfo-3.22.30-lp151.6.6.1 typelib-1_0-Gtk-3_0-3.22.30-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): gtk3-devel-32bit-3.22.30-lp151.6.6.1 gtk3-devel-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-amharic-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-amharic-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-inuktitut-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-multipress-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-multipress-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-thai-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-thai-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-vietnamese-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodule-xim-32bit-3.22.30-lp151.6.6.1 gtk3-immodule-xim-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-immodules-tigrigna-32bit-3.22.30-lp151.6.6.1 gtk3-immodules-tigrigna-32bit-debuginfo-3.22.30-lp151.6.6.1 gtk3-tools-32bit-3.22.30-lp151.6.6.1 gtk3-tools-32bit-debuginfo-3.22.30-lp151.6.6.1 libgtk-3-0-32bit-3.22.30-lp151.6.6.1 libgtk-3-0-32bit-debuginfo-3.22.30-lp151.6.6.1 - openSUSE Leap 15.1 (noarch): gtk3-branding-upstream-3.22.30-lp151.6.6.1 gtk3-data-3.22.30-lp151.6.6.1 gtk3-lang-3.22.30-lp151.6.6.1 gtk3-schema-3.22.30-lp151.6.6.1 - openSUSE Leap 15.0 (i586 x86_64): gettext-its-gtk3-3.22.30-lp150.3.13.1 gtk3-debugsource-3.22.30-lp150.3.13.1 gtk3-devel-3.22.30-lp150.3.13.1 gtk3-devel-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-amharic-3.22.30-lp150.3.13.1 gtk3-immodule-amharic-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-broadway-3.22.30-lp150.3.13.1 gtk3-immodule-broadway-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-inuktitut-3.22.30-lp150.3.13.1 gtk3-immodule-inuktitut-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-multipress-3.22.30-lp150.3.13.1 gtk3-immodule-multipress-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-thai-3.22.30-lp150.3.13.1 gtk3-immodule-thai-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-vietnamese-3.22.30-lp150.3.13.1 gtk3-immodule-vietnamese-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-xim-3.22.30-lp150.3.13.1 gtk3-immodule-xim-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodules-tigrigna-3.22.30-lp150.3.13.1 gtk3-immodules-tigrigna-debuginfo-3.22.30-lp150.3.13.1 gtk3-tools-3.22.30-lp150.3.13.1 gtk3-tools-debuginfo-3.22.30-lp150.3.13.1 libgtk-3-0-3.22.30-lp150.3.13.1 libgtk-3-0-debuginfo-3.22.30-lp150.3.13.1 typelib-1_0-Gtk-3_0-3.22.30-lp150.3.13.1 - openSUSE Leap 15.0 (x86_64): gtk3-devel-32bit-3.22.30-lp150.3.13.1 gtk3-devel-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-amharic-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-amharic-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-inuktitut-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-multipress-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-multipress-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-thai-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-thai-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-vietnamese-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodule-xim-32bit-3.22.30-lp150.3.13.1 gtk3-immodule-xim-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-immodules-tigrigna-32bit-3.22.30-lp150.3.13.1 gtk3-immodules-tigrigna-32bit-debuginfo-3.22.30-lp150.3.13.1 gtk3-tools-32bit-3.22.30-lp150.3.13.1 gtk3-tools-32bit-debuginfo-3.22.30-lp150.3.13.1 libgtk-3-0-32bit-3.22.30-lp150.3.13.1 libgtk-3-0-32bit-debuginfo-3.22.30-lp150.3.13.1 - openSUSE Leap 15.0 (noarch): gtk3-branding-upstream-3.22.30-lp150.3.13.1 gtk3-data-3.22.30-lp150.3.13.1 gtk3-lang-3.22.30-lp150.3.13.1 gtk3-schema-3.22.30-lp150.3.13.1 References: https://bugzilla.suse.com/1134059 https://bugzilla.suse.com/1136605

1 0

openSUSE-RU-2019:1662-1: moderate: Recommended update for openvswitch
by maintenance＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Recommended Update: Recommended update for openvswitch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1662-1 Rating: moderate References: #1130276 #1132029 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openvswitch fixes the following issues: Fix problem preventing new installs to run as non root (bsc#1132029), including: * Align with upstream so that no running configuration is changed on upgrades, specifically to avoid changes on the user Open vSwitch runs under. * hugetblfs groups is created as systemgroup openvswitch was updated to bugfix release 2.8.7 (bsc#1130276). Some of the changes are: * ofp-group: support to insert bucket with weight value for select type * ofproto: fix the bug of bucket counter is not updated * netdev-dpdk: Print netdev name for txq mapping. * ifupdown.sh: Add missing "--may-exist" option * netdev-tc-offloads: Improve log message for icmpv6 offload not supported * travis: Stop rsyslog before start. * vlog: Better handle syslog handler exceptions. * travis: Remove 'sudo' configuration. * ovsdb-monitor.at: Use correct perl scripts. * rconn: Avoid occasional immediate connection failures. * conntrack: Fix L4 csum for V6 extension hdr pkts. * packets: Change return type of 'packet_csum_upperlayer6'. * ovsdb-client: Fix typo. * ofctl: break the loop if ovs_pcap_read returns error * Revert "ovs-tcpdump: Fix an undefined variable" * dhparams: Fix .c file generation with OpenSSL >= 1.1.1-pre9 * dhparams: Add pregenerated .c file to the repository. * netlink: added check to prevent netlink attribute overflow * conntrack: Keep Address Sanitizer happy. * lldp: fix string warnings * conntrack: Exclude l2 padding in 'conn_key_extract()'. * dp-packet: Add 'dp_packet_l3_size()'. * monitor: Fix crash when monitor condition adds new columns. * dpif-netdev: Add thread safety annotation to sorted_poll_list. * acinclude: Drop DPDK_EXTRA_LIB variable. * flow: fix a possible memory leak in parse_ct_state * ofproto-dpif-trace: Fix for the segmentation fault in ofproto_trace(). * datapath: Fix IPv6 later frags parsing * datapath: Derive IP protocol number for IPv6 later frags * datapath: Avoid OOB read when parsing flow nlattrs * dpif-netlink: Fix a bug that causes duplicate key error in datapath * odp-util: Stop parse odp actions if nlattr is overflow * ovs-tcpdump: Fix an undefined variable * stt: Fix return code during xmit. * ofpbuf: Fix arithmetic error in ofpbuf_insert(). * odp-util: Fix a bug in parse_odp_push_nsh_action * netdev-linux: Fix function argument order in sfq_tc_load(). * ofproto-dpif-xlate: Account mirrored packets only if the VLAN matches. * ofp-actions: Avoid overflow for ofpact_learn_spec->n_bits * python: Escape backslashes while formatting logs. * docs: Fix table title for VM MQ config in dpdk howto. * conntrack: Check all addresses for ephemeral ports. * cmap: Fix hashing in cmap_find_protected(). * python: Catch setsockopt exceptions for TCP stream. * conntrack: Skip ephemeral ports fallback for DNAT. * rhel: Add 'SYSTEMD_NO_WRAP=yes' in ovs init script for SLES * ofproto: Return correct error codes from meter_set. * debian: Install correct vtep-ctl. * packets: Fix use-after-free error in packet_put_ra_prefix_opt(). * Windows: Fix broken kernel userspace communication * netdev-tc-offloads: Delete ufid tc mapping in the right place * dpif-netlink: Fix error behavior in dpif_netlink_port_add__(). * datapath-windows: Fix invalid reference in Buffermgmt.c * netdev-dpdk: Bring link down when NETDEV_UP is not set * actions: Enforce a maximum limit for nested action depth * bond: Fix LACP fallback to active-backup when recirc is enabled. * netdev-dpdk: Fix netdev_dpdk_get_features(). * ovn-northd: Fix memory leak in free_chassis_queueid(). * python-c-ext: Fix memory leak in Parser_finish * bridge.c: prevent controller connects while flow-restore-wait * connmgr: Fix vswitchd abort when a port is added and the controller is down * odp-util: Move ufid handling to odp_flow_from_string This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1662=1 Package List: - openSUSE Leap 15.0 (noarch): openvswitch-doc-2.8.7-lp150.5.14.1 - openSUSE Leap 15.0 (x86_64): libopenvswitch-2_8-0-2.8.7-lp150.5.14.1 libopenvswitch-2_8-0-debuginfo-2.8.7-lp150.5.14.1 openvswitch-2.8.7-lp150.5.14.1 openvswitch-debuginfo-2.8.7-lp150.5.14.1 openvswitch-debugsource-2.8.7-lp150.5.14.1 openvswitch-devel-2.8.7-lp150.5.14.1 openvswitch-ovn-central-2.8.7-lp150.5.14.1 openvswitch-ovn-central-debuginfo-2.8.7-lp150.5.14.1 openvswitch-ovn-common-2.8.7-lp150.5.14.1 openvswitch-ovn-common-debuginfo-2.8.7-lp150.5.14.1 openvswitch-ovn-docker-2.8.7-lp150.5.14.1 openvswitch-ovn-host-2.8.7-lp150.5.14.1 openvswitch-ovn-host-debuginfo-2.8.7-lp150.5.14.1 openvswitch-ovn-vtep-2.8.7-lp150.5.14.1 openvswitch-ovn-vtep-debuginfo-2.8.7-lp150.5.14.1 openvswitch-pki-2.8.7-lp150.5.14.1 openvswitch-test-2.8.7-lp150.5.14.1 openvswitch-test-debuginfo-2.8.7-lp150.5.14.1 openvswitch-vtep-2.8.7-lp150.5.14.1 openvswitch-vtep-debuginfo-2.8.7-lp150.5.14.1 python2-ovs-2.8.7-lp150.5.14.1 python2-ovs-debuginfo-2.8.7-lp150.5.14.1 python3-ovs-2.8.7-lp150.5.14.1 python3-ovs-debuginfo-2.8.7-lp150.5.14.1 References: https://bugzilla.suse.com/1130276 https://bugzilla.suse.com/1132029

1 0

openSUSE-RU-2019:1661-1: moderate: Recommended update for gnome-control-center
by maintenance＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Recommended Update: Recommended update for gnome-control-center ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1661-1 Rating: moderate References: #1040055 #1091796 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gnome-control-center fixes the following issues: - Renamed gui button 'Shutdown' to 'Force Off' (bsc#1091796) - The order has been adjusted by severity (bsc#1091796) - Fixes an issue in the GUI where a text overlapped with a form field (bsc#1040055) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1661=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1661=1 Package List: - openSUSE Leap 15.1 (noarch): gnome-control-center-lang-3.26.2-lp151.9.3.1 - openSUSE Leap 15.1 (x86_64): gnome-control-center-3.26.2-lp151.9.3.1 gnome-control-center-color-3.26.2-lp151.9.3.1 gnome-control-center-debuginfo-3.26.2-lp151.9.3.1 gnome-control-center-debugsource-3.26.2-lp151.9.3.1 gnome-control-center-devel-3.26.2-lp151.9.3.1 gnome-control-center-goa-3.26.2-lp151.9.3.1 gnome-control-center-user-faces-3.26.2-lp151.9.3.1 - openSUSE Leap 15.0 (x86_64): gnome-control-center-3.26.2-lp150.5.13.1 gnome-control-center-color-3.26.2-lp150.5.13.1 gnome-control-center-debuginfo-3.26.2-lp150.5.13.1 gnome-control-center-debugsource-3.26.2-lp150.5.13.1 gnome-control-center-devel-3.26.2-lp150.5.13.1 gnome-control-center-goa-3.26.2-lp150.5.13.1 gnome-control-center-user-faces-3.26.2-lp150.5.13.1 - openSUSE Leap 15.0 (noarch): gnome-control-center-lang-3.26.2-lp150.5.13.1 References: https://bugzilla.suse.com/1040055 https://bugzilla.suse.com/1091796

1 0

openSUSE-RU-2019:1663-1: moderate: Recommended update for yast2-firstboot
by maintenance＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Recommended Update: Recommended update for yast2-firstboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1663-1 Rating: moderate References: #1131327 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-firstboot fixes the following issues: - firstboot.xml template was updated to use the "firstboot_licenses" client for the license agreement - Fixes another issue when displaying license agreements to cover more scenarios (bsc#1131327) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1663=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-firstboot-4.0.7-lp150.2.10.1 References: https://bugzilla.suse.com/1131327

1 0

openSUSE-RU-2019:1660-1: moderate: Recommended update for NetworkManager-openvpn
by maintenance＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Recommended Update: Recommended update for NetworkManager-openvpn ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1660-1 Rating: moderate References: #1132946 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager-openvpn fixes the following issues: - Enable missing whirlpool HMAC authentication (bsc#1132946) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1660=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1660=1 Package List: - openSUSE Leap 15.1 (x86_64): NetworkManager-openvpn-1.8.2-lp151.4.3.1 NetworkManager-openvpn-debuginfo-1.8.2-lp151.4.3.1 NetworkManager-openvpn-debugsource-1.8.2-lp151.4.3.1 NetworkManager-openvpn-gnome-1.8.2-lp151.4.3.1 NetworkManager-openvpn-gnome-debuginfo-1.8.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): NetworkManager-openvpn-lang-1.8.2-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): NetworkManager-openvpn-lang-1.8.2-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): NetworkManager-openvpn-1.8.2-lp150.3.3.1 NetworkManager-openvpn-debuginfo-1.8.2-lp150.3.3.1 NetworkManager-openvpn-debugsource-1.8.2-lp150.3.3.1 NetworkManager-openvpn-gnome-1.8.2-lp150.3.3.1 NetworkManager-openvpn-gnome-debuginfo-1.8.2-lp150.3.3.1 References: https://bugzilla.suse.com/1132946

1 0

openSUSE-RU-2019:1659-1: moderate: Recommended update for thunar
by maintenance＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Recommended Update: Recommended update for thunar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1659-1 Rating: moderate References: #1134899 #1135362 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for thunar fixes the following issues: - Fixed crash on USB flash connection (boo#1135362) - Fixed "create document" sub-menu not showing any content (boo#1134899) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1659=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libthunarx-2-0-1.6.14-bp150.3.3.1 thunar-1.6.14-bp150.3.3.1 thunar-devel-1.6.14-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): thunar-lang-1.6.14-bp150.3.3.1 References: https://bugzilla.suse.com/1134899 https://bugzilla.suse.com/1135362

1 0

openSUSE-SU-2019:1658-1: moderate: Security update for libmediainfo
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for libmediainfo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1658-1 Rating: moderate References: #1133156 #1133157 Cross-References: CVE-2019-11372 CVE-2019-11373 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libmediainfo fixes the following issues: * CVE-2019-11373: Fixed out-of-bounds read in function File__Analyze:Get_L8 (boo#1133156) * CVE-2019-11372: Fixed out-of-bounds read in function MediaInfoLib:File__Tags_Helper:Synched_Test (boo#1133157) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1658=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmediainfo-devel-18.03-bp150.3.6.1 libmediainfo0-18.03-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libmediainfo0-64bit-18.03-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-11372.html https://www.suse.com/security/cve/CVE-2019-11373.html https://bugzilla.suse.com/1133156 https://bugzilla.suse.com/1133157

1 0

openSUSE-RU-2019:1634-1: moderate: Recommended update for thunar
by maintenance＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Recommended Update: Recommended update for thunar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1634-1 Rating: moderate References: #1134899 #1135362 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for thunar fixes the following issues: - Fixed crash on USB flash connection (boo#1135362) - Fixed "create document" sub-menu not showing any content (boo#1134899) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1634=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1634=1 Package List: - openSUSE Leap 15.1 (x86_64): libthunarx-3-0-1.8.4-lp151.2.3.1 libthunarx-3-0-debuginfo-1.8.4-lp151.2.3.1 thunar-1.8.4-lp151.2.3.1 thunar-debuginfo-1.8.4-lp151.2.3.1 thunar-debugsource-1.8.4-lp151.2.3.1 thunar-devel-1.8.4-lp151.2.3.1 typelib-1_0-Thunarx-3_0-1.8.4-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): thunar-lang-1.8.4-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): libthunarx-2-0-1.6.14-lp150.2.3.1 libthunarx-2-0-debuginfo-1.6.14-lp150.2.3.1 thunar-1.6.14-lp150.2.3.1 thunar-debuginfo-1.6.14-lp150.2.3.1 thunar-debugsource-1.6.14-lp150.2.3.1 thunar-devel-1.6.14-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): thunar-lang-1.6.14-lp150.2.3.1 References: https://bugzilla.suse.com/1134899 https://bugzilla.suse.com/1135362

1 0

openSUSE-RU-2019:1636-1: moderate: Recommended update for cloud-netconfig
by maintenance＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Recommended Update: Recommended update for cloud-netconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1636-1 Rating: moderate References: #1135257 #1135263 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for cloud-netconfig fixes the following issues: - cloud-netconfig will now pause and retry if API call throttling is detected in Azure (bsc#1135257, bsc#1135263) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1636=1 Package List: - openSUSE Leap 42.3 (noarch): cloud-netconfig-azure-1.0-18.1 cloud-netconfig-ec2-1.0-18.1 References: https://bugzilla.suse.com/1135257 https://bugzilla.suse.com/1135263

1 0

openSUSE-SU-2019:1638-1: important: Security update for gstreamer-0_10-plugins-base
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for gstreamer-0_10-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1638-1 Rating: important References: #1133375 Cross-References: CVE-2019-9928 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-0_10-plugins-base fixes the following issues: Security issue fixed: - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1638=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gstreamer-0_10-plugin-gnomevfs-0.10.36-18.3.1 gstreamer-0_10-plugin-gnomevfs-debuginfo-0.10.36-18.3.1 gstreamer-0_10-plugins-base-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debuginfo-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debugsource-0.10.36-18.3.1 gstreamer-0_10-plugins-base-devel-0.10.36-18.3.1 gstreamer-0_10-plugins-base-doc-0.10.36-18.3.1 libgstapp-0_10-0-0.10.36-18.3.1 libgstapp-0_10-0-debuginfo-0.10.36-18.3.1 libgstinterfaces-0_10-0-0.10.36-18.3.1 libgstinterfaces-0_10-0-debuginfo-0.10.36-18.3.1 typelib-1_0-GstApp-0_10-0.10.36-18.3.1 typelib-1_0-GstInterfaces-0_10-0.10.36-18.3.1 - openSUSE Leap 42.3 (noarch): gstreamer-0_10-plugins-base-lang-0.10.36-18.3.1 - openSUSE Leap 42.3 (x86_64): gstreamer-0_10-plugins-base-32bit-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debuginfo-32bit-0.10.36-18.3.1 libgstapp-0_10-0-32bit-0.10.36-18.3.1 libgstapp-0_10-0-debuginfo-32bit-0.10.36-18.3.1 libgstinterfaces-0_10-0-32bit-0.10.36-18.3.1 libgstinterfaces-0_10-0-debuginfo-32bit-0.10.36-18.3.1 References: https://www.suse.com/security/cve/CVE-2019-9928.html https://bugzilla.suse.com/1133375

1 0

openSUSE-SU-2019:1632-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1632-1 Rating: moderate References: #1124825 #1134135 Cross-References: CVE-2019-7637 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for SDL2 fixes the following issues: - Remove the fix for CVE-2019-7637, the modification of function SDL_CalculatePitch is only suited for SDL not SDL2, and breaks SDL2 software. (bsc#1134135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1632=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2-debugsource-2.0.8-lp150.2.6.1 libSDL2-2_0-0-2.0.8-lp150.2.6.1 libSDL2-2_0-0-debuginfo-2.0.8-lp150.2.6.1 libSDL2-devel-2.0.8-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp150.2.6.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp150.2.6.1 libSDL2-devel-32bit-2.0.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-7637.html https://bugzilla.suse.com/1124825 https://bugzilla.suse.com/1134135

1 0