July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1818-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1818-1 Rating: moderate References: #1104595 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Add upstream patch to fix downloaded files (via http) getting an "invalid" modification time (boo#1104595, kde#374420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1818=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1818=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1818=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kio-5.45.0-lp150.3.3.1 kio-core-5.45.0-lp150.3.3.1 kio-core-debuginfo-5.45.0-lp150.3.3.1 kio-debuginfo-5.45.0-lp150.3.3.1 kio-debugsource-5.45.0-lp150.3.3.1 kio-devel-5.45.0-lp150.3.3.1 kio-devel-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): kio-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kio-32bit-5.45.0-lp150.3.3.1 kio-32bit-debuginfo-5.45.0-lp150.3.3.1 kio-core-32bit-5.45.0-lp150.3.3.1 kio-core-32bit-debuginfo-5.45.0-lp150.3.3.1 kio-devel-32bit-5.45.0-lp150.3.3.1 kio-devel-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kio-5.45.0-bp150.3.3.1 kio-core-5.45.0-bp150.3.3.1 kio-core-debuginfo-5.45.0-bp150.3.3.1 kio-debuginfo-5.45.0-bp150.3.3.1 kio-debugsource-5.45.0-bp150.3.3.1 kio-devel-5.45.0-bp150.3.3.1 kio-devel-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kio-64bit-5.45.0-bp150.3.3.1 kio-64bit-debuginfo-5.45.0-bp150.3.3.1 kio-core-64bit-5.45.0-bp150.3.3.1 kio-core-64bit-debuginfo-5.45.0-bp150.3.3.1 kio-devel-64bit-5.45.0-bp150.3.3.1 kio-devel-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kio-lang-5.45.0-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-12.1 kio-5.26.0-11.1 kio-5.32.0-8.1 kio-core-5.20.0-12.1 kio-core-5.26.0-11.1 kio-core-5.32.0-8.1 kio-core-debuginfo-5.32.0-8.1 kio-debuginfo-5.32.0-8.1 kio-debugsource-5.32.0-8.1 kio-devel-5.20.0-12.1 kio-devel-5.26.0-11.1 kio-devel-5.32.0-8.1 kio-devel-debuginfo-5.32.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-12.1 kio-lang-5.26.0-11.1 kio-lang-5.32.0-8.1 References: https://bugzilla.suse.com/1104595

1 0

openSUSE-RU-2019:1818-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1818-1 Rating: moderate References: #1104595 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Add upstream patch to fix downloaded files (via http) getting an "invalid" modification time (boo#1104595, kde#374420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1818=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-12.1 kio-5.26.0-11.1 kio-5.32.0-8.1 kio-core-5.20.0-12.1 kio-core-5.26.0-11.1 kio-core-5.32.0-8.1 kio-core-debuginfo-5.32.0-8.1 kio-debuginfo-5.32.0-8.1 kio-debugsource-5.32.0-8.1 kio-devel-5.20.0-12.1 kio-devel-5.26.0-11.1 kio-devel-5.32.0-8.1 kio-devel-debuginfo-5.32.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-12.1 kio-lang-5.26.0-11.1 kio-lang-5.32.0-8.1 References: https://bugzilla.suse.com/1104595

1 0

openSUSE-RU-2019:1817-1: moderate: Recommended update for NetworkManager
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1817-1 Rating: moderate References: #1129587 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager fixes the following issues: - Add CAP_SYS_ADMIN which netconfig needs to call setdomainname. (bsc#1129587). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1817=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): NetworkManager-1.10.6-lp150.4.9.1 NetworkManager-debuginfo-1.10.6-lp150.4.9.1 NetworkManager-debugsource-1.10.6-lp150.4.9.1 NetworkManager-devel-1.10.6-lp150.4.9.1 libnm-glib-vpn1-1.10.6-lp150.4.9.1 libnm-glib-vpn1-debuginfo-1.10.6-lp150.4.9.1 libnm-glib4-1.10.6-lp150.4.9.1 libnm-glib4-debuginfo-1.10.6-lp150.4.9.1 libnm-util2-1.10.6-lp150.4.9.1 libnm-util2-debuginfo-1.10.6-lp150.4.9.1 libnm0-1.10.6-lp150.4.9.1 libnm0-debuginfo-1.10.6-lp150.4.9.1 typelib-1_0-NM-1_0-1.10.6-lp150.4.9.1 typelib-1_0-NMClient-1_0-1.10.6-lp150.4.9.1 typelib-1_0-NetworkManager-1_0-1.10.6-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): NetworkManager-branding-upstream-1.10.6-lp150.4.9.1 NetworkManager-lang-1.10.6-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): NetworkManager-devel-32bit-1.10.6-lp150.4.9.1 libnm-glib-vpn1-32bit-1.10.6-lp150.4.9.1 libnm-glib-vpn1-32bit-debuginfo-1.10.6-lp150.4.9.1 libnm-glib4-32bit-1.10.6-lp150.4.9.1 libnm-glib4-32bit-debuginfo-1.10.6-lp150.4.9.1 libnm-util2-32bit-1.10.6-lp150.4.9.1 libnm-util2-32bit-debuginfo-1.10.6-lp150.4.9.1 References: https://bugzilla.suse.com/1129587

1 0

openSUSE-SU-2019:1816-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1816-1 Rating: moderate References: #1040109 #1040113 #1040115 Cross-References: CVE-2017-9111 CVE-2017-9113 CVE-2017-9115 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2017-9111: Fixed an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h (bsc#1040109). - CVE-2017-9113: Fixed an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp (bsc#1040113). - CVE-2017-9115: Fixed an invalid write of size 2 in the = operator function inhalf.h (bsc#1040115). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1816=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp150.2.6.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp150.2.6.1 openexr-2.2.1-lp150.2.6.1 openexr-debuginfo-2.2.1-lp150.2.6.1 openexr-debugsource-2.2.1-lp150.2.6.1 openexr-devel-2.2.1-lp150.2.6.1 openexr-doc-2.2.1-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp150.2.6.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2017-9111.html https://www.suse.com/security/cve/CVE-2017-9113.html https://www.suse.com/security/cve/CVE-2017-9115.html https://bugzilla.suse.com/1040109 https://bugzilla.suse.com/1040113 https://bugzilla.suse.com/1040115

1 0

openSUSE-SU-2019:1815-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1815-1 Rating: important References: #1120892 #1141102 #1141649 Cross-References: CVE-2018-20073 CVE-2019-5847 CVE-2019-5848 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium to version 75.0.3770.142 fixes the following issues: Security issue fixed: - CVE-2019-5847: V8 sealed/frozen elements cause crash (boo#1141649). - CVE-2019-5848: Font sizes may expose sensitive information (boo#1141649). - CVE-2018-20073: Fixed information leaks of URL metadata nad passwords via extended filesystem attributes (boo#1120892). Non-security fix: - Fixed a segfault on startup (boo#1141102). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1815=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1815=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1815=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1815=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.142-lp151.2.12.4 chromedriver-debuginfo-75.0.3770.142-lp151.2.12.4 chromium-75.0.3770.142-lp151.2.12.4 chromium-debuginfo-75.0.3770.142-lp151.2.12.4 chromium-debugsource-75.0.3770.142-lp151.2.12.4 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.142-lp150.221.4 chromedriver-debuginfo-75.0.3770.142-lp150.221.4 chromium-75.0.3770.142-lp150.221.4 chromium-debuginfo-75.0.3770.142-lp150.221.4 chromium-debugsource-75.0.3770.142-lp150.221.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.142-bp150.217.1 chromedriver-debuginfo-75.0.3770.142-bp150.217.1 chromium-75.0.3770.142-bp150.217.1 chromium-debuginfo-75.0.3770.142-bp150.217.1 chromium-debugsource-75.0.3770.142-bp150.217.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.142-7.1 chromedriver-debuginfo-75.0.3770.142-7.1 chromium-75.0.3770.142-7.1 chromium-debuginfo-75.0.3770.142-7.1 chromium-debugsource-75.0.3770.142-7.1 References: https://www.suse.com/security/cve/CVE-2018-20073.html https://www.suse.com/security/cve/CVE-2019-5847.html https://www.suse.com/security/cve/CVE-2019-5848.html https://bugzilla.suse.com/1120892 https://bugzilla.suse.com/1141102 https://bugzilla.suse.com/1141649

1 0

openSUSE-SU-2019:1813-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1813-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird version 60.8 fixes the following issues: Security issues fixed: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). Non-security issued fixed: - Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1813=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1813=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-60.8.0-lp151.2.10.1 MozillaThunderbird-buildsymbols-60.8.0-lp151.2.10.1 MozillaThunderbird-debuginfo-60.8.0-lp151.2.10.1 MozillaThunderbird-debugsource-60.8.0-lp151.2.10.1 MozillaThunderbird-translations-common-60.8.0-lp151.2.10.1 MozillaThunderbird-translations-other-60.8.0-lp151.2.10.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.8.0-lp150.3.48.1 MozillaThunderbird-buildsymbols-60.8.0-lp150.3.48.1 MozillaThunderbird-debuginfo-60.8.0-lp150.3.48.1 MozillaThunderbird-debugsource-60.8.0-lp150.3.48.1 MozillaThunderbird-translations-common-60.8.0-lp150.3.48.1 MozillaThunderbird-translations-other-60.8.0-lp150.3.48.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1815-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1815-1 Rating: important References: #1120892 #1141102 #1141649 Cross-References: CVE-2018-20073 CVE-2019-5847 CVE-2019-5848 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium to version 75.0.3770.142 fixes the following issues: Security issue fixed: - CVE-2019-5847: V8 sealed/frozen elements cause crash (boo#1141649). - CVE-2019-5848: Font sizes may expose sensitive information (boo#1141649). - CVE-2018-20073: Fixed information leaks of URL metadata nad passwords via extended filesystem attributes (boo#1120892). Non-security fix: - Fixed a segfault on startup (boo#1141102). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1815=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.142-7.1 chromedriver-debuginfo-75.0.3770.142-7.1 chromium-75.0.3770.142-7.1 chromium-debuginfo-75.0.3770.142-7.1 chromium-debugsource-75.0.3770.142-7.1 References: https://www.suse.com/security/cve/CVE-2018-20073.html https://www.suse.com/security/cve/CVE-2019-5847.html https://www.suse.com/security/cve/CVE-2019-5848.html https://bugzilla.suse.com/1120892 https://bugzilla.suse.com/1141102 https://bugzilla.suse.com/1141649

1 0

openSUSE-SU-2019:1814-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1814-1 Rating: important References: #1097248 #1098050 #1112097 #1113894 #1115041 #1116050 #1130503 #1130588 #1132379 #1132439 #1132827 #1133289 #1133492 #1141801 Cross-References: CVE-2018-0734 CVE-2018-11763 CVE-2018-11784 CVE-2018-3288 CVE-2018-3289 CVE-2018-3290 CVE-2018-3291 CVE-2018-3292 CVE-2018-3293 CVE-2018-3294 CVE-2018-3295 CVE-2018-3296 CVE-2018-3297 CVE-2018-3298 CVE-2019-1543 CVE-2019-2446 CVE-2019-2448 CVE-2019-2450 CVE-2019-2451 CVE-2019-2508 CVE-2019-2509 CVE-2019-2511 CVE-2019-2525 CVE-2019-2527 CVE-2019-2554 CVE-2019-2555 CVE-2019-2556 CVE-2019-2574 CVE-2019-2656 CVE-2019-2657 CVE-2019-2678 CVE-2019-2679 CVE-2019-2680 CVE-2019-2690 CVE-2019-2696 CVE-2019-2703 CVE-2019-2721 CVE-2019-2722 CVE-2019-2723 CVE-2019-2848 CVE-2019-2850 CVE-2019-2859 CVE-2019-2863 CVE-2019-2864 CVE-2019-2865 CVE-2019-2866 CVE-2019-2867 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2877 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: This update for virtualbox to version 6.0.10 fixes the following issues: Security issues fixed: - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864 CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848 CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2850 (boo#1141801) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1814=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1814=1 Package List: - openSUSE Leap 15.1 (x86_64): python3-virtualbox-6.0.10-lp151.2.6.1 python3-virtualbox-debuginfo-6.0.10-lp151.2.6.1 virtualbox-6.0.10-lp151.2.6.1 virtualbox-debuginfo-6.0.10-lp151.2.6.1 virtualbox-debugsource-6.0.10-lp151.2.6.1 virtualbox-devel-6.0.10-lp151.2.6.1 virtualbox-guest-kmp-default-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-guest-kmp-default-debuginfo-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-guest-tools-6.0.10-lp151.2.6.1 virtualbox-guest-tools-debuginfo-6.0.10-lp151.2.6.1 virtualbox-guest-x11-6.0.10-lp151.2.6.1 virtualbox-guest-x11-debuginfo-6.0.10-lp151.2.6.1 virtualbox-host-kmp-default-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-host-kmp-default-debuginfo-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-qt-6.0.10-lp151.2.6.1 virtualbox-qt-debuginfo-6.0.10-lp151.2.6.1 virtualbox-vnc-6.0.10-lp151.2.6.1 virtualbox-websrv-6.0.10-lp151.2.6.1 virtualbox-websrv-debuginfo-6.0.10-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): virtualbox-guest-desktop-icons-6.0.10-lp151.2.6.1 virtualbox-guest-source-6.0.10-lp151.2.6.1 virtualbox-host-source-6.0.10-lp151.2.6.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-6.0.10-lp150.4.36.1 virtualbox-guest-source-6.0.10-lp150.4.36.1 virtualbox-host-source-6.0.10-lp150.4.36.1 - openSUSE Leap 15.0 (x86_64): python3-virtualbox-6.0.10-lp150.4.36.1 python3-virtualbox-debuginfo-6.0.10-lp150.4.36.1 virtualbox-6.0.10-lp150.4.36.1 virtualbox-debuginfo-6.0.10-lp150.4.36.1 virtualbox-debugsource-6.0.10-lp150.4.36.1 virtualbox-devel-6.0.10-lp150.4.36.1 virtualbox-guest-kmp-default-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-guest-kmp-default-debuginfo-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-guest-tools-6.0.10-lp150.4.36.1 virtualbox-guest-tools-debuginfo-6.0.10-lp150.4.36.1 virtualbox-guest-x11-6.0.10-lp150.4.36.1 virtualbox-guest-x11-debuginfo-6.0.10-lp150.4.36.1 virtualbox-host-kmp-default-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-host-kmp-default-debuginfo-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-qt-6.0.10-lp150.4.36.1 virtualbox-qt-debuginfo-6.0.10-lp150.4.36.1 virtualbox-vnc-6.0.10-lp150.4.36.1 virtualbox-websrv-6.0.10-lp150.4.36.1 virtualbox-websrv-debuginfo-6.0.10-lp150.4.36.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-11763.html https://www.suse.com/security/cve/CVE-2018-11784.html https://www.suse.com/security/cve/CVE-2018-3288.html https://www.suse.com/security/cve/CVE-2018-3289.html https://www.suse.com/security/cve/CVE-2018-3290.html https://www.suse.com/security/cve/CVE-2018-3291.html https://www.suse.com/security/cve/CVE-2018-3292.html https://www.suse.com/security/cve/CVE-2018-3293.html https://www.suse.com/security/cve/CVE-2018-3294.html https://www.suse.com/security/cve/CVE-2018-3295.html https://www.suse.com/security/cve/CVE-2018-3296.html https://www.suse.com/security/cve/CVE-2018-3297.html https://www.suse.com/security/cve/CVE-2018-3298.html https://www.suse.com/security/cve/CVE-2019-1543.html https://www.suse.com/security/cve/CVE-2019-2446.html https://www.suse.com/security/cve/CVE-2019-2448.html https://www.suse.com/security/cve/CVE-2019-2450.html https://www.suse.com/security/cve/CVE-2019-2451.html https://www.suse.com/security/cve/CVE-2019-2508.html https://www.suse.com/security/cve/CVE-2019-2509.html https://www.suse.com/security/cve/CVE-2019-2511.html https://www.suse.com/security/cve/CVE-2019-2525.html https://www.suse.com/security/cve/CVE-2019-2527.html https://www.suse.com/security/cve/CVE-2019-2554.html https://www.suse.com/security/cve/CVE-2019-2555.html https://www.suse.com/security/cve/CVE-2019-2556.html https://www.suse.com/security/cve/CVE-2019-2574.html https://www.suse.com/security/cve/CVE-2019-2656.html https://www.suse.com/security/cve/CVE-2019-2657.html https://www.suse.com/security/cve/CVE-2019-2678.html https://www.suse.com/security/cve/CVE-2019-2679.html https://www.suse.com/security/cve/CVE-2019-2680.html https://www.suse.com/security/cve/CVE-2019-2690.html https://www.suse.com/security/cve/CVE-2019-2696.html https://www.suse.com/security/cve/CVE-2019-2703.html https://www.suse.com/security/cve/CVE-2019-2721.html https://www.suse.com/security/cve/CVE-2019-2722.html https://www.suse.com/security/cve/CVE-2019-2723.html https://www.suse.com/security/cve/CVE-2019-2848.html https://www.suse.com/security/cve/CVE-2019-2850.html https://www.suse.com/security/cve/CVE-2019-2859.html https://www.suse.com/security/cve/CVE-2019-2863.html https://www.suse.com/security/cve/CVE-2019-2864.html https://www.suse.com/security/cve/CVE-2019-2865.html https://www.suse.com/security/cve/CVE-2019-2866.html https://www.suse.com/security/cve/CVE-2019-2867.html https://www.suse.com/security/cve/CVE-2019-2873.html https://www.suse.com/security/cve/CVE-2019-2874.html https://www.suse.com/security/cve/CVE-2019-2875.html https://www.suse.com/security/cve/CVE-2019-2876.html https://www.suse.com/security/cve/CVE-2019-2877.html https://bugzilla.suse.com/1097248 https://bugzilla.suse.com/1098050 https://bugzilla.suse.com/1112097 https://bugzilla.suse.com/1113894 https://bugzilla.suse.com/1115041 https://bugzilla.suse.com/1116050 https://bugzilla.suse.com/1130503 https://bugzilla.suse.com/1130588 https://bugzilla.suse.com/1132379 https://bugzilla.suse.com/1132439 https://bugzilla.suse.com/1132827 https://bugzilla.suse.com/1133289 https://bugzilla.suse.com/1133492 https://bugzilla.suse.com/1141801

1 0

openSUSE-SU-2019:1811-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 29 Jul '19

29 Jul '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1811-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). mozilla-nss to version 3.44.1: * Added IPSEC IKE support to softoken * Many new FIPS test cases This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1811=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.44.1-lp150.2.24.1 libfreebl3-debuginfo-3.44.1-lp150.2.24.1 libfreebl3-hmac-3.44.1-lp150.2.24.1 libsoftokn3-3.44.1-lp150.2.24.1 libsoftokn3-debuginfo-3.44.1-lp150.2.24.1 libsoftokn3-hmac-3.44.1-lp150.2.24.1 mozilla-nss-3.44.1-lp150.2.24.1 mozilla-nss-certs-3.44.1-lp150.2.24.1 mozilla-nss-certs-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-debugsource-3.44.1-lp150.2.24.1 mozilla-nss-devel-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-tools-3.44.1-lp150.2.24.1 mozilla-nss-tools-debuginfo-3.44.1-lp150.2.24.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.44.1-lp150.2.24.1 libfreebl3-32bit-debuginfo-3.44.1-lp150.2.24.1 libfreebl3-hmac-32bit-3.44.1-lp150.2.24.1 libsoftokn3-32bit-3.44.1-lp150.2.24.1 libsoftokn3-32bit-debuginfo-3.44.1-lp150.2.24.1 libsoftokn3-hmac-32bit-3.44.1-lp150.2.24.1 mozilla-nss-32bit-3.44.1-lp150.2.24.1 mozilla-nss-32bit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-certs-32bit-3.44.1-lp150.2.24.1 mozilla-nss-certs-32bit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-32bit-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-32bit-debuginfo-3.44.1-lp150.2.24.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1808-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 25 Jul '19

25 Jul '19

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1808-1 Rating: moderate References: #1111966 #1131055 #1136085 Cross-References: CVE-2019-0199 CVE-2019-0221 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for tomcat to version 9.0.21 fixes the following issues: Security issues fixed: - CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055). - CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085). Non-security issues fixed: - Increase maximum number of threads and open files for tomcat (bsc#1111966). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1808=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.21-lp151.3.3.1 tomcat-admin-webapps-9.0.21-lp151.3.3.1 tomcat-docs-webapp-9.0.21-lp151.3.3.1 tomcat-el-3_0-api-9.0.21-lp151.3.3.1 tomcat-embed-9.0.21-lp151.3.3.1 tomcat-javadoc-9.0.21-lp151.3.3.1 tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1 tomcat-jsvc-9.0.21-lp151.3.3.1 tomcat-lib-9.0.21-lp151.3.3.1 tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1 tomcat-webapps-9.0.21-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-0199.html https://www.suse.com/security/cve/CVE-2019-0221.html https://bugzilla.suse.com/1111966 https://bugzilla.suse.com/1131055 https://bugzilla.suse.com/1136085

1 0

openSUSE-RU-2019:1807-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1807-1 Rating: moderate References: #1099674 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner to version 1.1.4 fixes the following issues: - Exclude stuff from openstack macros (boo#1099674). - Replace 'http' with 'https' in URL (boo#1099674). - Replace legacy packageand() with 'and' expression (boo#1099674). - Replace pwdutils with shadow in Requires (boo#1099674). - Add openstack_cleanup_prep to bracketing excludes (boo#1099674). - Do not curlify yast_metainfo and yast_check (boo#1099674). - Fixup the eating of Source lines with whitespace (boo#1099674). - Document '#nospeccleaner' tag (boo#1099674). - Various small fixes (boo#1099674). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1807=1 Package List: - openSUSE Backports SLE-15 (noarch): spec-cleaner-1.1.4-bp150.64.1 spec-cleaner-format_spec_file-1.1.4-bp150.64.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:1804-1: important: Recommended update for grub2
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1804-1 Rating: important References: #1134287 #1139345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Fix a regression introduced by the previous update which could prevent booting on ppc64. (bsc#1134287, bsc#1139345). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1804=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): grub2-2.02-lp150.13.26.1 grub2-branding-upstream-2.02-lp150.13.26.1 grub2-debuginfo-2.02-lp150.13.26.1 grub2-debugsource-2.02-lp150.13.26.1 grub2-i386-pc-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (noarch): grub2-snapper-plugin-2.02-lp150.13.26.1 grub2-systemd-sleep-plugin-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (x86_64): grub2-x86_64-efi-2.02-lp150.13.26.1 grub2-x86_64-xen-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (i586): grub2-i386-efi-2.02-lp150.13.26.1 grub2-i386-xen-2.02-lp150.13.26.1 References: https://bugzilla.suse.com/1134287 https://bugzilla.suse.com/1139345

1 0

openSUSE-RU-2019:1803-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1803-1 Rating: moderate References: #1099674 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner to version 1.1.4 fixes the following issues: - Exclude stuff from openstack macros (boo#1099674). - Replace 'http' with 'https' in URL (boo#1099674). - Replace legacy packageand() with 'and' expression (boo#1099674). - Replace pwdutils with shadow in Requires (boo#1099674). - Add openstack_cleanup_prep to bracketing excludes (boo#1099674). - Do not curlify yast_metainfo and yast_check (boo#1099674). - Fixup the eating of Source lines with whitespace (boo#1099674). - Document '#nospeccleaner' tag (boo#1099674). - Various small fixes (boo#1099674). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1803=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1803=1 Package List: - openSUSE Leap 15.1 (noarch): spec-cleaner-1.1.4-lp151.2.3.1 spec-cleaner-format_spec_file-1.1.4-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): spec-cleaner-1.1.4-lp150.64.1 spec-cleaner-format_spec_file-1.1.4-lp150.64.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:1802-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1802-1 Rating: moderate References: #1124564 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvme-cli fixes the following issues: - Add script to determine host NQN based on the system UUID - Add new udev rule for NetApp E-Series and adjust udev rule naming scheme accordingly. (bsc#1124564) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1802=1 Package List: - openSUSE Leap 15.1 (x86_64): nvme-cli-1.7-lp151.5.6.1 nvme-cli-debuginfo-1.7-lp151.5.6.1 nvme-cli-debugsource-1.7-lp151.5.6.1 nvme-cli-regress-script-1.7-lp151.5.6.1 References: https://bugzilla.suse.com/1124564

1 0

openSUSE-SU-2019:1805-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1805-1 Rating: important References: #1111331 Cross-References: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061d->0000061f Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000714->00000718 Xeon E3/E5, Core X This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1805=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20190618-lp150.2.24.1 References: https://www.suse.com/security/cve/CVE-2018-12126.html https://www.suse.com/security/cve/CVE-2018-12127.html https://www.suse.com/security/cve/CVE-2018-12130.html https://www.suse.com/security/cve/CVE-2019-11091.html https://bugzilla.suse.com/1111331

1 0

openSUSE-SU-2019:1806-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1806-1 Rating: important References: #1111331 Cross-References: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061d->0000061f Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000714->00000718 Xeon E3/E5, Core X ---- new platforms ---------------------------------------- VLV C0 6-37-8/02 00000838 Atom Z series VLV C0 6-37-8/0C 00000838 Celeron N2xxx, Pentium N35xx VLV D0 6-37-9/0F 0000090c Atom E38xx CHV C0 6-4c-3/01 00000368 Atom X series CHV D0 6-4c-4/01 00000411 Atom X series Readded what missing in last update: BDX-ML B0/M0/R0 6-4f-1/ef 0b00002e->00000036 Xeon E5/E7 v4; Core i7-69xx/68xx This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1806=1 Package List: - openSUSE Leap 15.1 (x86_64): ucode-intel-20190618-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12126.html https://www.suse.com/security/cve/CVE-2018-12127.html https://www.suse.com/security/cve/CVE-2018-12130.html https://www.suse.com/security/cve/CVE-2019-11091.html https://bugzilla.suse.com/1111331

1 0

openSUSE-RU-2019:1801-1: moderate: Recommended update for openslp
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for openslp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1801-1 Rating: moderate References: #1117969 #1136136 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openslp fixes the following issues: - Use tcp connects to talk with other directory agents (DAs) (bsc#1117969) - Fix segfault in predicate match if a registered service has a malformed attribute list (bsc#1136136) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1801=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1801=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): openslp-2.0.0-lp151.7.3.1 openslp-debuginfo-2.0.0-lp151.7.3.1 openslp-debugsource-2.0.0-lp151.7.3.1 openslp-devel-2.0.0-lp151.7.3.1 openslp-server-2.0.0-lp151.7.3.1 openslp-server-debuginfo-2.0.0-lp151.7.3.1 - openSUSE Leap 15.1 (x86_64): openslp-32bit-2.0.0-lp151.7.3.1 openslp-32bit-debuginfo-2.0.0-lp151.7.3.1 - openSUSE Leap 15.0 (i586 x86_64): openslp-2.0.0-lp150.10.1 openslp-debuginfo-2.0.0-lp150.10.1 openslp-debugsource-2.0.0-lp150.10.1 openslp-devel-2.0.0-lp150.10.1 openslp-server-2.0.0-lp150.10.1 openslp-server-debuginfo-2.0.0-lp150.10.1 - openSUSE Leap 15.0 (x86_64): openslp-32bit-2.0.0-lp150.10.1 openslp-32bit-debuginfo-2.0.0-lp150.10.1 References: https://bugzilla.suse.com/1117969 https://bugzilla.suse.com/1136136

1 0

openSUSE-SU-2019:1800-1: moderate: Security update for libsass
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for libsass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1800-1 Rating: moderate References: #1096894 #1118301 #1118346 #1118348 #1118349 #1118351 #1119789 #1121943 #1121944 #1121945 #1133200 #1133201 Cross-References: CVE-2018-11499 CVE-2018-19797 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 CVE-2018-20821 CVE-2018-20822 CVE-2019-6283 CVE-2019-6284 CVE-2019-6286 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1800=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libsass-3_6_1-1-3.6.1-bp150.3.3.1 libsass-devel-3.6.1-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11499.html https://www.suse.com/security/cve/CVE-2018-19797.html https://www.suse.com/security/cve/CVE-2018-19827.html https://www.suse.com/security/cve/CVE-2018-19837.html https://www.suse.com/security/cve/CVE-2018-19838.html https://www.suse.com/security/cve/CVE-2018-19839.html https://www.suse.com/security/cve/CVE-2018-20190.html https://www.suse.com/security/cve/CVE-2018-20821.html https://www.suse.com/security/cve/CVE-2018-20822.html https://www.suse.com/security/cve/CVE-2019-6283.html https://www.suse.com/security/cve/CVE-2019-6284.html https://www.suse.com/security/cve/CVE-2019-6286.html https://bugzilla.suse.com/1096894 https://bugzilla.suse.com/1118301 https://bugzilla.suse.com/1118346 https://bugzilla.suse.com/1118348 https://bugzilla.suse.com/1118349 https://bugzilla.suse.com/1118351 https://bugzilla.suse.com/1119789 https://bugzilla.suse.com/1121943 https://bugzilla.suse.com/1121944 https://bugzilla.suse.com/1121945 https://bugzilla.suse.com/1133200 https://bugzilla.suse.com/1133201

1 0

openSUSE-RU-2019:1799-1: moderate: Recommended update for tracker
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for tracker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1799-1 Rating: moderate References: #1123869 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tracker provides the following fixes: - Delete TrackerResource elements one by one. (bsc#1123869) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1799=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1799=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtracker-common-2_0-2.0.3-lp151.6.3.1 libtracker-common-2_0-debuginfo-2.0.3-lp151.6.3.1 libtracker-control-2_0-0-2.0.3-lp151.6.3.1 libtracker-control-2_0-0-debuginfo-2.0.3-lp151.6.3.1 libtracker-miner-2_0-0-2.0.3-lp151.6.3.1 libtracker-miner-2_0-0-debuginfo-2.0.3-lp151.6.3.1 libtracker-sparql-2_0-0-2.0.3-lp151.6.3.1 libtracker-sparql-2_0-0-debuginfo-2.0.3-lp151.6.3.1 tracker-2.0.3-lp151.6.3.1 tracker-debuginfo-2.0.3-lp151.6.3.1 tracker-debugsource-2.0.3-lp151.6.3.1 tracker-devel-2.0.3-lp151.6.3.1 typelib-1_0-Tracker-2_0-2.0.3-lp151.6.3.1 typelib-1_0-TrackerControl-2_0-2.0.3-lp151.6.3.1 typelib-1_0-TrackerMiner-2_0-2.0.3-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): tracker-lang-2.0.3-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): libtracker-common-2_0-2.0.3-lp150.4.6.1 libtracker-common-2_0-debuginfo-2.0.3-lp150.4.6.1 libtracker-control-2_0-0-2.0.3-lp150.4.6.1 libtracker-control-2_0-0-debuginfo-2.0.3-lp150.4.6.1 libtracker-miner-2_0-0-2.0.3-lp150.4.6.1 libtracker-miner-2_0-0-debuginfo-2.0.3-lp150.4.6.1 libtracker-sparql-2_0-0-2.0.3-lp150.4.6.1 libtracker-sparql-2_0-0-debuginfo-2.0.3-lp150.4.6.1 tracker-2.0.3-lp150.4.6.1 tracker-debuginfo-2.0.3-lp150.4.6.1 tracker-debugsource-2.0.3-lp150.4.6.1 tracker-devel-2.0.3-lp150.4.6.1 typelib-1_0-Tracker-2_0-2.0.3-lp150.4.6.1 typelib-1_0-TrackerControl-2_0-2.0.3-lp150.4.6.1 typelib-1_0-TrackerMiner-2_0-2.0.3-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): tracker-lang-2.0.3-lp150.4.6.1 References: https://bugzilla.suse.com/1123869

1 0

openSUSE-SU-2019:1796-1: important: Security update for neovim
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1796-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: neovim was updated to version 0.3.7: * CVE-2019-12735: source should check sandbox (boo#1137443) * genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: * options: properly reset directories on 'autochdir' * Remove MSVC optimization workaround for SHM_ALL * Make SHM_ALL to a variable instead of a compound literal #define * doc: mention "pynvim" module rename * screen: don't crash when drawing popupmenu with 'rightleft' option * look-behind match may use the wrong line number * :terminal : set topline based on window height * :recover : Fix crash on non-existent *.swp Version Update to version 0.3.4: * test: add tests for conceal cursor movement * display: unify ursorline and concealcursor redraw logic Version Update to version 0.3.3: * health/provider: Check for available pynvim when neovim mod is missing * python#CheckForModule: Use the given module string instead of hard-coding pynvim * (health.provider)/python: Import the neovim, rather than pynvim, module * TUI: Konsole DECSCUSR fixup Version Update to version 0.3.2:- * Features - clipboard: support Custom VimL functions (#9304) - win/TUI: improve terminal/console support (#9401) - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077) - support mapping in more places (#9299) - diff/highlight: show underline for low-priority CursorLine (#9028) - signs: Add "nuhml" argument (#9113) - clipboard: support Wayland (#9230) - TUI: add support for undercurl and underline color (#9052) - man.vim: soft (dynamic) wrap (#9023) * API - API: implement object namespaces (#6920) - API: implement nvim_win_set_buf() (#9100) - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180) - API: add nvim_buf_is_loaded() (#8660) - API: nvm_buf_get_offset_for_line (#8221) - API/UI: ext_newgrid, ext_histate (#8221) * UI - TUI: use BCE again more often (smoother resize) (#8806) - screen: add missing status redraw when redraw_later(CLEAR) was used (#9315) - TUI: clip invalid regions on resize (#8779) - TUI: improvements for scrolling and clearing (#9193) - TUI: disable clearing almost everywhere (#9143) - TUI: always use safe cursor movement after resize (#9079) - ui_options: also send when starting or from OptionSet (#9211) - TUI: Avoid reset_color_cursor_color in old VTE (#9191) - Don't erase screen on :hi Normal during startup (#9021) - TUI: Hint wrapped lines to terminals (#8915) * FIXES - RPC: turn errors from async calls into notifications - TUI: Restore terminal title via "title stacking" (#9407) - genappimage: Unset $ARGV0 at invocation (#9376) - TUI: Konsole 18.07.70 supports DECSCUSR (#9364) - provider: improve error message (#9344) - runtime/syntax: Fix highlighting of autogroup contents (#9328) - VimL/confirm(): Show dialog even if :silent (#9297) - clipboard: prefer xclip (#9302) - provider/nodejs: fix npm, yarn detection - channel: avoid buffering output when only terminal is active (#9218) - ruby: detect rbenv shims for other versions (#8733) - third party/unibilium: Fix parsing of extended capabilitiy entries (#9123) - jobstart(): Fix hang on non-executable cwd (#9204) - provide/nodejs: Simultaneously query npm and yarn (#9054) - undo: Fix infinite loop if undo_read_byte returns EOF (#2880) - 'swapfile: always show dialog' (#9034) - Add to the system-wide configuration file extension of runtimepath by /usr/share/vim/site, so that neovim uses other Vim plugins installed from packages. - Add /usr/share/vim/site tree of directories to be owned by neovim as well. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1796=1 Package List: - openSUSE Backports SLE-15 (noarch): neovim-lang-0.3.7-bp150.2.9.1 - openSUSE Backports SLE-15 (x86_64): neovim-0.3.7-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443

1 0

openSUSE-SU-2019:1792-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1792-1 Rating: moderate References: #1097073 #1125740 #1138939 Cross-References: CVE-2019-12904 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939) Other bugfixes: - Don't run full FIPS self-tests from constructor (bsc#1097073) - Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073) - Enforce the minimal RSA keygen size in fips mode (bsc#1125740) - avoid executing some tests twice. - Fixed a race condition in initialization. - Fixed env-script-interpreter in cavs_driver.pl - Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073) This helps during booting of the system in FIPS mode with insufficient entropy. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1792=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgcrypt-cavs-1.8.2-lp150.5.10.1 libgcrypt-cavs-debuginfo-1.8.2-lp150.5.10.1 libgcrypt-debugsource-1.8.2-lp150.5.10.1 libgcrypt-devel-1.8.2-lp150.5.10.1 libgcrypt-devel-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-1.8.2-lp150.5.10.1 libgcrypt20-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-1.8.2-lp150.5.10.1 - openSUSE Leap 15.0 (x86_64): libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-32bit-1.8.2-lp150.5.10.1 libgcrypt20-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-12904.html https://bugzilla.suse.com/1097073 https://bugzilla.suse.com/1125740 https://bugzilla.suse.com/1138939

1 0

openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le s390x x86_64): mumble-1.2.19-9.1 mumble-server-1.2.19-9.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334

1 0

openSUSE-SU-2019:1791-1: moderate: Security update for libsass
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libsass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1791-1 Rating: moderate References: #1096894 #1118301 #1118346 #1118348 #1118349 #1118351 #1119789 #1121943 #1121944 #1121945 #1133200 #1133201 Cross-References: CVE-2018-11499 CVE-2018-19797 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 CVE-2018-20821 CVE-2018-20822 CVE-2019-6283 CVE-2019-6284 CVE-2019-6286 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1791=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1791=1 Package List: - openSUSE Leap 15.1 (x86_64): libsass-3_6_1-1-3.6.1-lp151.3.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp151.3.3.1 libsass-debugsource-3.6.1-lp151.3.3.1 libsass-devel-3.6.1-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): libsass-3_6_1-1-3.6.1-lp150.2.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp150.2.3.1 libsass-debugsource-3.6.1-lp150.2.3.1 libsass-devel-3.6.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11499.html https://www.suse.com/security/cve/CVE-2018-19797.html https://www.suse.com/security/cve/CVE-2018-19827.html https://www.suse.com/security/cve/CVE-2018-19837.html https://www.suse.com/security/cve/CVE-2018-19838.html https://www.suse.com/security/cve/CVE-2018-19839.html https://www.suse.com/security/cve/CVE-2018-20190.html https://www.suse.com/security/cve/CVE-2018-20821.html https://www.suse.com/security/cve/CVE-2018-20822.html https://www.suse.com/security/cve/CVE-2019-6283.html https://www.suse.com/security/cve/CVE-2019-6284.html https://www.suse.com/security/cve/CVE-2019-6286.html https://bugzilla.suse.com/1096894 https://bugzilla.suse.com/1118301 https://bugzilla.suse.com/1118346 https://bugzilla.suse.com/1118348 https://bugzilla.suse.com/1118349 https://bugzilla.suse.com/1118351 https://bugzilla.suse.com/1119789 https://bugzilla.suse.com/1121943 https://bugzilla.suse.com/1121944 https://bugzilla.suse.com/1121945 https://bugzilla.suse.com/1133200 https://bugzilla.suse.com/1133201

1 0

openSUSE-SU-2019:1793-1: moderate: Security update for teeworlds
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for teeworlds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1793-1 Rating: moderate References: #1112910 #1131729 Cross-References: CVE-2018-18541 CVE-2019-10877 CVE-2019-10878 CVE-2019-10879 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for teeworlds fixes the following issues: - CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729) - CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution. - CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled. - CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910) - Update to version 0.7.3.1 * Colorful gametype and level icons in the browser instead of grayscale. * Add an option to use raw mouse inputs, revert to (0.6) relative mode by default. * Demo list marker indicator. * Restore ingame Player and Tee menus, add a warning that a reconnect is needed. * Emotes can now be cancelled by releasing the mouse in the middle of the circle. * Improve add friend text. * Add a confirmation for removing a filter * Add a "click a player to follow" hint * Also hint players which key they should press to set themselves ready. * fixed using correct array measurements when placing egg doodads * fixed demo recorder downloaded maps using the sha256 hash * show correct game release version in the start menu and console * Fix platform-specific client libraries for Linux * advanced scoreboard with game statistics * joystick support (experimental!) * copy paste (one-way) * bot cosmetics (a visual difference between players and NPCs) * chat commands (type / in chat) * players can change skin without leaving the server (again) * live automapper and complete rules for 0.7 tilesets * audio toggling HUD * an Easter surprise... * new gametypes: "last man standing" (LMS) and "last team standing" (LTS). survive by your own or as a team with limited weaponry * 64 players support. official gametypes are still restricted to 16 players maximum but allow more spectators * new skin system. build your own skins based on a variety of provided parts * enhanced security. all communications require a handshake and use a token to counter spoofing and reflection attacks * new maps: ctf8, dm3, lms1. Click to discover them! * animated background menu map: jungle, heavens (day/night themes, customisable in the map editor) * new design for the menus: added start menus, reworked server browser, settings * customisable gametype icons (browser). make your own! * chat overhaul, whispers (private messages) * composed binds (ctrl+, shift+, alt+) * scoreboard remodelled, now shows kills/deaths * demo markers * master server list cache (in case the masters are unreachable) * input separated from rendering (optimisation) * upgrade to SDL2. support for multiple monitors, non-english keyboards, and more * broadcasts overhaul, optional colours support * ready system, for competitive settings * server difficulty setting (casual, competitive, normal), shown in the browser * spectator mode improvements: follow flags, click on players * bot flags for modified servers: indicate NPCs, can be filtered out in the server browser * sharper graphics all around (no more tileset_borderfix and dilate) * refreshed the HUD, ninja cooldown, new mouse cursor * mapres update (higher resolution, fixes...) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1793=1 Package List: - openSUSE Leap 15.1 (x86_64): teeworlds-0.7.3.1-lp151.2.3.1 teeworlds-debuginfo-0.7.3.1-lp151.2.3.1 teeworlds-debugsource-0.7.3.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18541.html https://www.suse.com/security/cve/CVE-2019-10877.html https://www.suse.com/security/cve/CVE-2019-10878.html https://www.suse.com/security/cve/CVE-2019-10879.html https://bugzilla.suse.com/1112910 https://bugzilla.suse.com/1131729

1 0

openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334

1 0