July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1689-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1689-1 Rating: moderate References: #1137496 #1137497 Cross-References: CVE-2019-11768 CVE-2019-12616 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.0.1: * Several issues with SYSTEM VERSIONING tables * Fixed json encode error in export * Fixed JavaScript events not activating on input (sql bookmark issue) * Show Designer combo boxes when adding a constraint * Fix edit view * Fixed invalid default value for bit field * Fix several errors relating to GIS data types * Fixed javascript error PMA_messages is not defined * Fixed import XML data with leading zeros * Fixed php notice, added support for 'DELETE HISTORY' table privilege (MariaDB >= 10.3.4) * Fixed MySQL 8.0.0 issues with GIS display * Fixed "Server charset" in "Database server" tab showing wrong information * Fixed can not copy user on Percona Server 5.7 * Updated sql-parser to version 4.3.2, which fixes several parsing and linting problems - boo#1137497 / PMASA-2019-4 / CVE-2019-12616 / CWE-661: Fixed CSRF vulnerability in login form https://www.phpmyadmin.net/security/PMASA-2019-4/ - boo#1137496 / PMASA-2019-3 / CVE-2019-11768 / CWE-661: Fixed SQL injection in Designer feature https://www.phpmyadmin.net/security/PMASA-2019-3/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1689=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1689=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.9.0.1-31.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.0.1-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.0.1-lp150.31.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.0.1-bp150.31.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.0.1-31.1 References: https://www.suse.com/security/cve/CVE-2019-11768.html https://www.suse.com/security/cve/CVE-2019-12616.html https://bugzilla.suse.com/1137496 https://bugzilla.suse.com/1137497

1 0

openSUSE-SU-2019:1690-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1690-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1690=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1690=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.1.3-33.1 irssi-debuginfo-1.1.3-33.1 irssi-debugsource-1.1.3-33.1 irssi-devel-1.1.3-33.1 - openSUSE Leap 15.1 (x86_64): irssi-1.1.3-lp151.2.3.1 irssi-debuginfo-1.1.3-lp151.2.3.1 irssi-debugsource-1.1.3-lp151.2.3.1 irssi-devel-1.1.3-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): irssi-1.1.3-lp150.33.1 irssi-debuginfo-1.1.3-lp150.33.1 irssi-debugsource-1.1.3-lp150.33.1 irssi-devel-1.1.3-lp150.33.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-bp150.33.1 irssi-devel-1.1.3-bp150.33.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-33.1 irssi-devel-1.1.3-33.1 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-SU-2019:1689-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1689-1 Rating: moderate References: #1137496 #1137497 Cross-References: CVE-2019-11768 CVE-2019-12616 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.0.1: * Several issues with SYSTEM VERSIONING tables * Fixed json encode error in export * Fixed JavaScript events not activating on input (sql bookmark issue) * Show Designer combo boxes when adding a constraint * Fix edit view * Fixed invalid default value for bit field * Fix several errors relating to GIS data types * Fixed javascript error PMA_messages is not defined * Fixed import XML data with leading zeros * Fixed php notice, added support for 'DELETE HISTORY' table privilege (MariaDB >= 10.3.4) * Fixed MySQL 8.0.0 issues with GIS display * Fixed "Server charset" in "Database server" tab showing wrong information * Fixed can not copy user on Percona Server 5.7 * Updated sql-parser to version 4.3.2, which fixes several parsing and linting problems - boo#1137497 / PMASA-2019-4 / CVE-2019-12616 / CWE-661: Fixed CSRF vulnerability in login form https://www.phpmyadmin.net/security/PMASA-2019-4/ - boo#1137496 / PMASA-2019-3 / CVE-2019-11768 / CWE-661: Fixed SQL injection in Designer feature https://www.phpmyadmin.net/security/PMASA-2019-3/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1689=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.9.0.1-31.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.0.1-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.0.1-lp150.31.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.0.1-bp150.31.1 References: https://www.suse.com/security/cve/CVE-2019-11768.html https://www.suse.com/security/cve/CVE-2019-12616.html https://bugzilla.suse.com/1137496 https://bugzilla.suse.com/1137497

1 0

openSUSE-SU-2019:1690-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1690-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1690=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-33.1 irssi-devel-1.1.3-33.1 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-RU-2019:1687-1: moderate: Recommended update for rclone
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for rclone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1687-1 Rating: moderate References: #1137685 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rclone fixes the following issues: rclone was updated to version 1.47.0. boo#1137685: - New backends - Backend for Koofr cloud storage service. (jaKa) - New Features - Resume downloads if the reader fails in copy (Nick Craig-Wood) - Use `--fast-list` for listing operations where it won't use more memory (Nick Craig-Wood) - Make `--files-from` traverse the destination unless `--no-traverse` is set (Nick Craig-Wood) - Make server side copy account bytes and obey `--max-transfer` (Nick Craig-Wood) - Add `--create-empty-src-dirs` flag and default to not creating empty dirs (ishuah) - Add client side TLS/SSL flags `--ca-cert`/`--client-cert`/`--client-key` (Nick Craig-Wood) - Implement `--suffix-keep-extension` for use with `--suffix` (Nick Craig-Wood) - serve dlna: Add connection manager service description to improve compatibility (Dan Walters) - lsf: Add 'e' format to show encrypted names and 'o' for original IDs (Nick Craig-Wood) - lsjson: Added `--files-only` and `--dirs-only` flags (calistri) - rc: Implement operations/publiclink the equivalent of `rclone link` (Nick Craig-Wood) - Bug Fixes - accounting: Fix total ETA when `--stats-unit bits` is in effect (Nick Craig-Wood) - Bash TAB completion - Use private custom func to fix clash between rclone and kubectl (Nick Craig-Wood) - Fix for remotes with underscores in their names (Six) - Fix completion of remotes (Florian Gamböck) - Fix autocompletion of remote paths with spaces (Danil Semelenov) - serve dlna: Fix root XML service descriptor (Dan Walters) - ncdu: Fix display corruption with Chinese characters (Nick Craig-Wood) - Add SIGTERM to signals which run the exit handlers on unix (Nick Craig-Wood) - rc: Reload filter when the options are set via the rc (Nick Craig-Wood) - VFS / Mount - Fix FreeBSD: Ignore Truncate if called with no readers and already the correct size (Nick Craig-Wood) - Read directory and check for a file before mkdir (Nick Craig-Wood) - Shorten the locking window for vfs/refresh (Nick Craig-Wood) - Azure Blob - Enable MD5 checksums when uploading files bigger than the "Cutoff" (Dr.Rx) - Fix SAS URL support (Nick Craig-Wood) - B2 - Allow manual configuration of backblaze downloadUrl (Vince) - Ignore already_hidden error on remove (Nick Craig-Wood) - Ignore malformed `src_last_modified_millis` (Nick Craig-Wood) - Drive - Add `--skip-checksum-gphotos` to ignore incorrect checksums on Google Photos (Nick Craig-Wood) - Allow server side move/copy between different remotes. (Fionera) - Add docs on team drives and `--fast-list` eventual consistency (Nestar47) - Fix imports of text files (Nick Craig-Wood) - Fix range requests on 0 length files (Nick Craig-Wood) - Fix creation of duplicates with server side copy (Nick Craig-Wood) - Dropbox - Retry blank errors to fix long listings (Nick Craig-Wood) - FTP - Add `--ftp-concurrency` to limit maximum number of connections (Nick Craig-Wood) - Google Cloud Storage - Fall back to default application credentials (marcintustin) - Allow bucket policy only buckets (Nick Craig-Wood) - HTTP - Add `--http-no-slash` for websites with directories with no slashes (Nick Craig-Wood) - Remove duplicates from listings (Nick Craig-Wood) - Fix socket leak on 404 errors (Nick Craig-Wood) - Jottacloud - Fix token refresh (Sebastian Bünger) - Add device registration (Oliver Heyme) - Onedrive - Implement graceful cancel of multipart uploads if rclone is interrupted (Cnly) - Always add trailing colon to path when addressing items, (Cnly) - Return errors instead of panic for invalid uploads (Fabian Möller) - S3 - Add support for "Glacier Deep Archive" storage class (Manu) - Update Dreamhost endpoint (Nick Craig-Wood) - Note incompatibility with CEPH Jewel (Nick Craig-Wood) - SFTP - Allow custom ssh client config (Alexandru Bumbacea) - Swift - Obey Retry-After to enable OVH restore from cold storage (Nick Craig-Wood) - Work around token expiry on CEPH (Nick Craig-Wood) - WebDAV - Allow IsCollection property to be integer or boolean (Nick Craig-Wood) - Fix race when creating directories (Nick Craig-Wood) - Fix About/df when reading the available/total returns 0 (Nick Craig-Wood) - Add bash-completion and zsh-completion support. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1687=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): rclone-1.47.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): rclone-bash-completion-1.47.0-bp150.3.3.1 rclone-zsh-completion-1.47.0-bp150.3.3.1 References: https://bugzilla.suse.com/1137685

1 0

openSUSE-RU-2019:1685-1: moderate: Recommended update for plasma5-pa
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-pa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1685-1 Rating: moderate References: #1012244 Affected Products: openSUSE Leap 42.3 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-pa fixes the following issues: - Fixed the notification volume slider always jumping back to 0 (boo#1012244, kde#383787) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1685=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1685=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): plasma5-pa-5.8.7-2.3.1 plasma5-pa-debuginfo-5.8.7-2.3.1 plasma5-pa-debugsource-5.8.7-2.3.1 - openSUSE Leap 42.3 (noarch): plasma5-pa-lang-5.8.7-2.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-pa-lang-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): plasma5-pa-5.8.7-5.1 References: https://bugzilla.suse.com/1012244

1 0

openSUSE-SU-2019:1688-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1688-1 Rating: moderate References: #1047218 #1084909 Cross-References: CVE-2018-16860 CVE-2019-12098 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: libheimdal was updated to version 7.7.0: + Bug fixes: - PKCS#11 hcrypto back-end: + initialize the p11_module_load function list + verify that not only is a mechanism present but that its mechanism info states that it offers the required encryption, decryption or digest services - krb5: + Starting with 7.6, Heimdal permitted requesting authenticated anonymous tickets. However, it did not verify that a KDC in fact returned an anonymous ticket when one was requested. + Cease setting the KDCOption reaquest_anonymous flag when issuing S4UProxy (constrained delegation) TGS requests. + when the Win2K PKINIT compatibility option is set, do not require krbtgt otherName to match when validating KDC certificate. + set PKINIT_BTMM flag per Apple implementation + use memset_s() instead of memset() - kdc: + When generating KRB5SignedPath in the AS, use the reply client name rather than the one from the request, so validation will work correctly in the TGS. + allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used an enctype with a different checksum. Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always HMAC_MD5, and that's what Windows and MIT clients send. In Heimdal both the client and kdc use instead the checksum of the TGT, and therefore work with each other but Windows and MIT clients fail against Heimdal KDC. Both Windows and MIT KDC would allow any keyed checksum to be used so Heimdal client work fine against it. Change Heimdal KDC to allow HMAC_MD5 even for non RC4 based TGT in order to support per-spec clients. + use memset_s() instead of memset() + Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy (constrained delegation) TGS Requests with the request anonymous flag set. These requests will be treated as S4UProxy requests and not anonymous requests. - HDB: + Set SQLite3 backend default page size to 8KB. + Add hdb_set_sync() method - kadmind: + disable HDB sync during database load avoiding unnecessary disk i/o. - ipropd: + disable HDB sync during receive_everything. Doing an fsync per-record when receiving the complete HDB is a performance disaster. Among other things, if the HDB is very large, then one slave receving a full HDB can cause other slaves to timeout and, if HDB write activity is high enough to cause iprop log truncation, then also need full syncs, which leads to a cycle of full syncs for all slaves until HDB write activity drops. Allowing the iprop log to be larger helps, but improving receive_everything() performance helps even more. - kinit: + Anonymous PKINIT tickets discard the realm information used to locate the issuing AS. Store the issuing realm in the credentials cache in order to locate a KDC which can renew them. + Do not leak the result of krb5_cc_get_config() when determining anonymous PKINIT start realm. - klist: + Show transited-policy-checked, ok-as-delegate and anonymous flags when listing credentials. - tests: + Regenerate certs so that they expire before the 2038 armageddon so the test suite will pass on 32-bit operating systems until the underlying issues can be resolved. - documentation: + rename verify-password to verify-password-quality + hprop default mode is encrypt + kadmind "all" permission does not include "get-keys" + verify-password-quality might not be stateless Version 7.6.0: + Security (#555): - CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum When the Heimdal KDC checks the checksum that is placed on the S4U2Self packet by the server to protect the requested principal against modification, it does not confirm that the checksum algorithm that protects the user name (principal) in the request is keyed. This allows a man-in-the-middle attacker who can intercept the request to the KDC to modify the packet by replacing the user name (principal) in the request with any desired user name (principal) that exists in the KDC and replace the checksum protecting that name with a CRC32 checksum (which requires no prior knowledge to compute). This would allow a S4U2Self ticket requested on behalf of user name (principal) user(a)EXAMPLE.COM to any service to be changed to a S4U2Self ticket with a user name (principal) of Administrator(a)EXAMPLE.COM. This ticket would then contain the PAC of the modified user name (principal). - CVE-2019-12098, client-only: RFC8062 Section 7 requires verification of the PA-PKINIT-KX key exchange when anonymous PKINIT is used. Failure to do so can permit an active attacker to become a man-in-the-middle. + Bug fixes: - Happy eyeballs: Don't wait for responses from known-unreachable KDCs. - kdc: + check return copy_Realm, copy_PrincipalName, copy_EncryptionKey - kinit: + cleanup temporary ccaches + see man page for "kinit --anonymous" command line syntax change - kdc: + Make anonymous AS-requests more RFC8062-compliant. Updated expired test certificates + Features: - kuser: support authenticated anonymous AS-REQs in kinit - kdc: support for anonymous TGS-REQs - kgetcred support for anonymous service tickets - Support builds with OpenSSL 1.1.1 This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1688=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libheimdal-7.7.0-bp150.2.3.1 libheimdal-devel-7.7.0-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16860.html https://www.suse.com/security/cve/CVE-2019-12098.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1084909

1 0

openSUSE-RU-2019:1686-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1686-1 Rating: moderate References: #1091191 Affected Products: openSUSE Leap 42.3 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - Fixed playing the login sound with Phonon 4.9+ when the sound file is specified as absolute file path (boo#1091191, kde#392725) - Adapted the BBC weather engine provider to changes in the RSS feed that broke it (kde#392510) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1686=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1686=1 Package List: - openSUSE Leap 42.3 (noarch): plasma5-workspace-lang-5.8.7-14.1 - openSUSE Leap 42.3 (x86_64): drkonqi5-5.8.7-14.1 drkonqi5-debuginfo-5.8.7-14.1 plasma5-workspace-5.8.7-14.1 plasma5-workspace-debuginfo-5.8.7-14.1 plasma5-workspace-debugsource-5.8.7-14.1 plasma5-workspace-devel-5.8.7-14.1 plasma5-workspace-libs-5.8.7-14.1 plasma5-workspace-libs-debuginfo-5.8.7-14.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-workspace-lang-5.8.6-11.1 plasma5-workspace-lang-5.8.7-11.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): drkonqi5-5.8.6-11.1 drkonqi5-5.8.7-11.1 drkonqi5-debuginfo-5.8.7-11.1 plasma5-workspace-5.8.6-11.1 plasma5-workspace-5.8.7-11.1 plasma5-workspace-debuginfo-5.8.7-11.1 plasma5-workspace-debugsource-5.8.7-11.1 plasma5-workspace-devel-5.8.6-11.1 plasma5-workspace-devel-5.8.7-11.1 plasma5-workspace-libs-5.8.6-11.1 plasma5-workspace-libs-5.8.7-11.1 plasma5-workspace-libs-debuginfo-5.8.7-11.1 References: https://bugzilla.suse.com/1091191

1 0

openSUSE-RU-2019:1685-1: moderate: Recommended update for plasma5-pa
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-pa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1685-1 Rating: moderate References: #1012244 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-pa fixes the following issues: - Fixed the notification volume slider always jumping back to 0 (boo#1012244, kde#383787) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1685=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): plasma5-pa-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-pa-lang-5.8.7-5.1 References: https://bugzilla.suse.com/1012244

1 0

openSUSE-RU-2019:1686-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1686-1 Rating: moderate References: #1091191 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - Fixed playing the login sound with Phonon 4.9+ when the sound file is specified as absolute file path (boo#1091191, kde#392725) - Adapted the BBC weather engine provider to changes in the RSS feed that broke it (kde#392510) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1686=1 Package List: - openSUSE Leap 42.3 (noarch): plasma5-workspace-lang-5.8.7-14.1 - openSUSE Leap 42.3 (x86_64): drkonqi5-5.8.7-14.1 drkonqi5-debuginfo-5.8.7-14.1 plasma5-workspace-5.8.7-14.1 plasma5-workspace-debuginfo-5.8.7-14.1 plasma5-workspace-debugsource-5.8.7-14.1 plasma5-workspace-devel-5.8.7-14.1 plasma5-workspace-libs-5.8.7-14.1 plasma5-workspace-libs-debuginfo-5.8.7-14.1 References: https://bugzilla.suse.com/1091191

1 0

openSUSE-SU-2019:1682-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1682-1 Rating: moderate References: #1047218 #1084909 Cross-References: CVE-2018-16860 CVE-2019-12098 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: libheimdal was updated to version 7.7.0: + Bug fixes: - PKCS#11 hcrypto back-end: + initialize the p11_module_load function list + verify that not only is a mechanism present but that its mechanism info states that it offers the required encryption, decryption or digest services - krb5: + Starting with 7.6, Heimdal permitted requesting authenticated anonymous tickets. However, it did not verify that a KDC in fact returned an anonymous ticket when one was requested. + Cease setting the KDCOption reaquest_anonymous flag when issuing S4UProxy (constrained delegation) TGS requests. + when the Win2K PKINIT compatibility option is set, do not require krbtgt otherName to match when validating KDC certificate. + set PKINIT_BTMM flag per Apple implementation + use memset_s() instead of memset() - kdc: + When generating KRB5SignedPath in the AS, use the reply client name rather than the one from the request, so validation will work correctly in the TGS. + allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used an enctype with a different checksum. Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always HMAC_MD5, and that's what Windows and MIT clients send. In Heimdal both the client and kdc use instead the checksum of the TGT, and therefore work with each other but Windows and MIT clients fail against Heimdal KDC. Both Windows and MIT KDC would allow any keyed checksum to be used so Heimdal client work fine against it. Change Heimdal KDC to allow HMAC_MD5 even for non RC4 based TGT in order to support per-spec clients. + use memset_s() instead of memset() + Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy (constrained delegation) TGS Requests with the request anonymous flag set. These requests will be treated as S4UProxy requests and not anonymous requests. - HDB: + Set SQLite3 backend default page size to 8KB. + Add hdb_set_sync() method - kadmind: + disable HDB sync during database load avoiding unnecessary disk i/o. - ipropd: + disable HDB sync during receive_everything. Doing an fsync per-record when receiving the complete HDB is a performance disaster. Among other things, if the HDB is very large, then one slave receving a full HDB can cause other slaves to timeout and, if HDB write activity is high enough to cause iprop log truncation, then also need full syncs, which leads to a cycle of full syncs for all slaves until HDB write activity drops. Allowing the iprop log to be larger helps, but improving receive_everything() performance helps even more. - kinit: + Anonymous PKINIT tickets discard the realm information used to locate the issuing AS. Store the issuing realm in the credentials cache in order to locate a KDC which can renew them. + Do not leak the result of krb5_cc_get_config() when determining anonymous PKINIT start realm. - klist: + Show transited-policy-checked, ok-as-delegate and anonymous flags when listing credentials. - tests: + Regenerate certs so that they expire before the 2038 armageddon so the test suite will pass on 32-bit operating systems until the underlying issues can be resolved. - documentation: + rename verify-password to verify-password-quality + hprop default mode is encrypt + kadmind "all" permission does not include "get-keys" + verify-password-quality might not be stateless Version 7.6.0: + Security (#555): - CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum When the Heimdal KDC checks the checksum that is placed on the S4U2Self packet by the server to protect the requested principal against modification, it does not confirm that the checksum algorithm that protects the user name (principal) in the request is keyed. This allows a man-in-the-middle attacker who can intercept the request to the KDC to modify the packet by replacing the user name (principal) in the request with any desired user name (principal) that exists in the KDC and replace the checksum protecting that name with a CRC32 checksum (which requires no prior knowledge to compute). This would allow a S4U2Self ticket requested on behalf of user name (principal) user(a)EXAMPLE.COM to any service to be changed to a S4U2Self ticket with a user name (principal) of Administrator(a)EXAMPLE.COM. This ticket would then contain the PAC of the modified user name (principal). - CVE-2019-12098, client-only: RFC8062 Section 7 requires verification of the PA-PKINIT-KX key exchange when anonymous PKINIT is used. Failure to do so can permit an active attacker to become a man-in-the-middle. + Bug fixes: - Happy eyeballs: Don't wait for responses from known-unreachable KDCs. - kdc: + check return copy_Realm, copy_PrincipalName, copy_EncryptionKey - kinit: + cleanup temporary ccaches + see man page for "kinit --anonymous" command line syntax change - kdc: + Make anonymous AS-requests more RFC8062-compliant. Updated expired test certificates + Features: - kuser: support authenticated anonymous AS-REQs in kinit - kdc: support for anonymous TGS-REQs - kgetcred support for anonymous service tickets - Support builds with OpenSSL 1.1.1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1682=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1682=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1682=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libheimdal-7.7.0-12.1 libheimdal-debuginfo-7.7.0-12.1 libheimdal-debugsource-7.7.0-12.1 libheimdal-devel-7.7.0-12.1 - openSUSE Leap 15.1 (x86_64): libheimdal-7.7.0-lp151.3.3.1 libheimdal-debuginfo-7.7.0-lp151.3.3.1 libheimdal-debugsource-7.7.0-lp151.3.3.1 libheimdal-devel-7.7.0-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): libheimdal-7.7.0-lp150.2.3.1 libheimdal-debuginfo-7.7.0-lp150.2.3.1 libheimdal-debugsource-7.7.0-lp150.2.3.1 libheimdal-devel-7.7.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16860.html https://www.suse.com/security/cve/CVE-2019-12098.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1084909

1 0

openSUSE-SU-2019:1683-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1683-1 Rating: moderate References: #1133204 #1133205 #1133498 #1133501 #1134075 #1135232 #1135236 #1136183 #1136732 #1138425 #1138464 Cross-References: CVE-2017-12805 CVE-2017-12806 CVE-2019-10131 CVE-2019-11470 CVE-2019-11472 CVE-2019-11505 CVE-2019-11506 CVE-2019-11597 CVE-2019-11598 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11597: Fixed a heap-based buffer over-read in the WriteTIFFImage() (bsc#1138464). - Fixed a file content disclosure via SVG and WMF decoding (bsc#1138425).- CVE-2019-11472: Fixed a denial of service in ReadXWDImage() (bsc#1133204). - CVE-2019-11470: Fixed a denial of service in ReadCINImage() (bsc#1133205). - CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABImage() (bsc#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the WritePDBImage() (bsc#1133501). - CVE-2019-10131: Fixed a off-by-one read in formatIPTCfromBuffer function in coders/meta.c (bsc#1134075). - CVE-2017-12806: Fixed a denial of service through memory exhaustion in format8BIM() (bsc#1135232). - CVE-2017-12805: Fixed a denial of service through memory exhaustion in ReadTIFFImage() (bsc#1135236). - CVE-2019-11598: Fixed a heap-based buffer over-read in WritePNMImage() (bsc#1136732) We also now disable PCL in the -SUSE configuration, as it also uses ghostscript for decoding (bsc#1136183) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1683=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-85.1 ImageMagick-config-6-SUSE-6.8.8.1-85.1 ImageMagick-config-6-upstream-6.8.8.1-85.1 ImageMagick-debuginfo-6.8.8.1-85.1 ImageMagick-debugsource-6.8.8.1-85.1 ImageMagick-devel-6.8.8.1-85.1 ImageMagick-extra-6.8.8.1-85.1 ImageMagick-extra-debuginfo-6.8.8.1-85.1 libMagick++-6_Q16-3-6.8.8.1-85.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-85.1 libMagick++-devel-6.8.8.1-85.1 libMagickCore-6_Q16-1-6.8.8.1-85.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-85.1 libMagickWand-6_Q16-1-6.8.8.1-85.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-85.1 perl-PerlMagick-6.8.8.1-85.1 perl-PerlMagick-debuginfo-6.8.8.1-85.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-85.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-85.1 libMagick++-6_Q16-3-32bit-6.8.8.1-85.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-85.1 libMagick++-devel-32bit-6.8.8.1-85.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-85.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-85.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-85.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-85.1 References: https://www.suse.com/security/cve/CVE-2017-12805.html https://www.suse.com/security/cve/CVE-2017-12806.html https://www.suse.com/security/cve/CVE-2019-10131.html https://www.suse.com/security/cve/CVE-2019-11470.html https://www.suse.com/security/cve/CVE-2019-11472.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://www.suse.com/security/cve/CVE-2019-11597.html https://www.suse.com/security/cve/CVE-2019-11598.html https://bugzilla.suse.com/1133204 https://bugzilla.suse.com/1133205 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501 https://bugzilla.suse.com/1134075 https://bugzilla.suse.com/1135232 https://bugzilla.suse.com/1135236 https://bugzilla.suse.com/1136183 https://bugzilla.suse.com/1136732 https://bugzilla.suse.com/1138425 https://bugzilla.suse.com/1138464

1 0

openSUSE-RU-2019:1684-1: moderate: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1684-1 Rating: moderate References: #1048392 #1139409 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for release-notes-openSUSE fixes the following issues: release notes version 42.3.20190626 (tracked in boo#1139409): - Enable product deprecation notice - Updated translations (Arabic, Bulgarian, Catalan, Chinese (China), Chinese (Taiwan), Czech, Danish, Dutch, Finnish, French, Galician, German, Greek, Hindi, Indonesian, Italian, Japanese, Marathi, Polish, Portuguese (Brazil), Russian, Serbian, Slovak, Spanish, Swedish, Turkish, Ukrainian) - Document fixes and changed notes: - Removed "Dolphin/Konqueror: Extended Permission Bits" (boo#1048392) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1684=1 Package List: - openSUSE Leap 42.3 (noarch): release-notes-openSUSE-42.3.20190626-9.1 References: https://bugzilla.suse.com/1048392 https://bugzilla.suse.com/1139409

1 0

openSUSE-RU-2019:1681-1: moderate: Recommended update for cloud-init, dhcp
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for cloud-init, dhcp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1681-1 Rating: moderate References: #1087331 #1095627 #1097388 #1099340 #1101894 #1111427 #1114160 #1116767 #1119397 #1121878 #1123694 #1125950 #1125992 #1126101 #1132692 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 15 recommended fixes can now be installed. Description: This update for cloud-init, dhcp provides the following fixes: Changes to cloud-init: - When the user configures a new rules file for network devices, the rules may not apply immediately, so trigger udevadm. (bsc#1125950) - Fix the order of calls when writing routes so that the SUSE implementation of route config file writing has precedence over the default implementation. (bsc#1125992) - Use the proper name to designate IPv6 addresses in ifcfg-* files. (bsc#1126101) - Drop a '-' in the route file for the last column. (bsc#1123694) - Make sure the resulting resolv.conf file is not empty. (bsc#1119397) - Update to version 18.5 (bsc#1121878, bsc#1116767): * Add cloud-id binary to packages for SUSE. * azure: Accept variation in error msg from mount for ntfs volumes. * azure: Add apply_network_config option to disable network from IMDS. * azure: Add udev rules to create cloud-init Gen2 disk name symlinks. * azure: Detect vnet migration via netlink media change event. * azure: Fix a copy and paste error in error handling when reading azure ovf. * azure: Fix a regression introduced when persisting ephemeral dhcp lease. * azure: _poll_imds only retry on 404, failing on timeout. * azure: Remove /etc/netplan/90-hotplug-azure.yaml when net from IMDS. * azure: Report ready to fabric after reprovision and reduce logging. * azure: Retry imds polling on requests.Timeout. * config: On ubuntu select cloud archive mirrors for armel, armhf, arm64. * dhclient-hook: Clean it up, add tests and fix a bug on 'down' event. * doc: Change dns_nameserver property to dns_nameservers. * docs: Remove colon from network v1 config example. * instance-data: Add standard keys platform and subplatform. Refactor ec2. * instance-data: Fallback to instance-data.json if sensitive is absent. * logs: collect-logs ignore instance-data-sensitive.json on non-root user * net: Ephemeral*Network: Add connectivity check via URL. * net: Ignore nics that have "zero" mac address. * net: Render 'metric' values in per-subnet routes. * NoCloud: Allow top level 'network' key in network-config. * ovf: Fix ovf network config generation gateway/routes. * ovf: Identify label iso9660 filesystems with label 'OVF ENV'. * query: Better error when missing read permission on instance-data. * resizefs: Prefix discovered devpath with '/dev/' when path does not exist. * systemd: On SUSE ensure cloud-init.service runs before wicked. * tools: Add cloud-id command line utility. * Update detection of openSUSE variants. * write_files: Add support for appending to files. - Fix a decoding error that could cause persisting the metadata to fail. (bsc#1101894) - Fix a problem that could cause static network to be configured with BOOTPROTO=none. (bsc#1114160) - Changes from 18.4 (bsc#1087331, bsc#1097388, bsc#1111427, bsc#1095627): * Avoid Python 3 dependency when building for distros with Python 2 support. * Add dhcp-client as requirement as cloud-init uses dhclient to setup a temporary network for metadata retrieval. (fate#327672) * Use ds._crawled_metadata instance attribute if set when writing instance-data.json. * ec2: Update crawled metadata and add standardized keys. * lxd: Adjust to snap installed lxd. * Add support for Infiniband network interfaces (IPoIB). * cli: Add cloud-init query subcommand to query instance metadata. * stages: Fix bug causing datasource to have incorrect sys_cfg. * net_util: Ensure static configurations have netmask in translate_network result. * Fall back to root:root on syslog permissions if other options fail. * OpenStack: Support setting mac address on bond. * EphemeralIPv4Network: Be more explicit when adding default route. * OpenStack: Support reading of newer versions of metadata. * OpenStack: Fix a bug that was causing causing 'latest' version to be used from network. * user-data: Use jinja template to render instance-data.json in cloud-config. * config: Disable ssh access to a configured user account. * sysconfig: Refactor sysconfig to accept distro specific templates paths. * hyperv_reporting_handler: Simplify threaded publisher. * VMWare: Fix a network config bug in vm with static IPv4 and no gateway. * logging: Add logging config type hyperv for reporting via Azure KVP * Add datasource Oracle Compute Infrastructure (OCI). * azure: Allow azure to generate network configuration from IMDS per boot. * Scaleway: Add network configuration to the DataSource. * netplan: Correctly render macaddress on a bonds and bridges when provided. * tools: Add 'net-convert' subcommand command to 'cloud-init devel'. * Use typeset or local in profile.d scripts. * OpenNebula: Fix null gateway6. * tools: add '--debug' to tools/net-convert.py * update_metadata: A datasource can support network re-config every boot. * Retry on failed import of gpg receive keys. * tools: Fix run-container when neither source or binary package requested. - Changes from 18.3: * Explicitly prevent `sudo` access for user module. * lxd: Delete default network and detach device if lxd-init created them. * openstack: Avoid unneeded metadata probe on non-openstack platforms. * stages: Fix tracebacks if a module stage is undefined or empty. * Be safer on string/bytes when writing multipart user-data to disk. * Fix get_proc_env for pids that have non-utf8 content in environment. * netplan: Fix mtu if provided by network config for all rendered types. * subp: Support combine_capture argument. * util: Add get_linux_distro function to replace platform.dist * Do not use the systemd_prefix macro, not available in this environment. * openstack: Allow discovery in init-local using dhclient in a sandbox. * yaml_load/schema: Add invalid line and column nums to error message. * Azure: Ignore NTFS mount errors when checking ephemeral drive. * cc_mounts: Do not add devices to fstab that are already present. * ds-identify: Ensure that we have certain tokens in PATH. * read_file_or_url: Move to url_helper, fix bug in its FileResponse. * ds-identify: Recognize container-other as a container. * ds-identify: Remove duplicate call to is_ds_enabled. * azure: Add reported ready marker file. * netinfo: Fix netdev_pformat when a nic does not have an address assigned. * collect-logs: Add -v flag, write to stderr, limit journal to single boot. * IBMCloud: Disable config-drive and nocloud only if IBMCloud is enabled. * Add reporting events and log_time around early source of blocking time. * IBMCloud: recognize provisioning environment during debug boots. * net: Detect unstable network names and trigger a settle if needed. * sysconfig: dhcp6 subnet type should not imply dhcpv4. * schema: In validation, raise ImportError if strict but no jsonschema. * set_passwords: Add newline to end of sshd config, only restart if updated. * net: Depend on iproute2's ip instead of net-tools ifconfig or route. * renderer: Support unicode in render_from_file. * Implement ntp client spec with auto support for distro selection. * apport: Add Brightbox, IBM, LXD, and OpenTelekomCloud to list of clouds. * tests: Fix ec2 integration network metadata validation. * cc_resizefs, util: Handle no /dev/zfs. - The distribution indicator is set to SUSE during template expansion. Do not replace anything set to Ubuntu. - Do not run cloud-init after network-online, this breaks functionality in cloud-init. Certain parts of the code running in this phase expect to run before the network is on-line. - Root should not be enabled by default. Image builders/users that want root access by default should provide an appropriate configuration file during image build or image setup. - Set distribution default to OpenSUSE/SLES. (bsc#1099340) - Run metadata detection after network-online. (bsc#1097388) - Properly accumulate all the defined routes for a given network device. Previously only the last defined route was written to the routes file. (bsc#1132692) - Write the udev rules to a different file than the default. (bsc#1125950) - Settle udev if not all configured devices are in the device tree to avoid race a condition between udev and cloud-init. (bsc#1125950) Changes in dhcp: - No changes, just being released together to be included in CaaS Platform. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1681=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dhcp-4.3.3-11.9.1 dhcp-client-4.3.3-11.9.1 dhcp-client-debuginfo-4.3.3-11.9.1 dhcp-debuginfo-4.3.3-11.9.1 dhcp-debugsource-4.3.3-11.9.1 dhcp-devel-4.3.3-11.9.1 dhcp-doc-4.3.3-11.9.1 dhcp-relay-4.3.3-11.9.1 dhcp-relay-debuginfo-4.3.3-11.9.1 dhcp-server-4.3.3-11.9.1 dhcp-server-debuginfo-4.3.3-11.9.1 - openSUSE Leap 42.3 (x86_64): cloud-init-18.5-40.1 cloud-init-config-suse-18.5-40.1 cloud-init-doc-18.5-40.1 References: https://bugzilla.suse.com/1087331 https://bugzilla.suse.com/1095627 https://bugzilla.suse.com/1097388 https://bugzilla.suse.com/1099340 https://bugzilla.suse.com/1101894 https://bugzilla.suse.com/1111427 https://bugzilla.suse.com/1114160 https://bugzilla.suse.com/1116767 https://bugzilla.suse.com/1119397 https://bugzilla.suse.com/1121878 https://bugzilla.suse.com/1123694 https://bugzilla.suse.com/1125950 https://bugzilla.suse.com/1125992 https://bugzilla.suse.com/1126101 https://bugzilla.suse.com/1132692

1 0

openSUSE-RU-2019:1679-1: moderate: Recommended update for rapidjson
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for rapidjson ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1679-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rapidjson fixes the following issues: Added rapidjson version 1.1.0: * Added JSON Pointer * Added JSON Schema * Added relaxed JSON syntax (comment, trailing comma, NaN/Infinity) * Iterating array/object with C++11 Range-based for loop * Reduce memory overhead of each Value from 24 bytes to 16 bytes in x86-64 architecture. Full changeset at https://github.com/miloyip/rapidjson/releases/tag/v1.1.0 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1679=1 Package List: - openSUSE Leap 15.0 (noarch): rapidjson-devel-1.1.0-lp150.2.1 References:

1 0

openSUSE-RU-2019:1680-1: moderate: Recommended update for binutils
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for binutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1680-1 Rating: moderate References: #1137271 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for binutils fixes the following issues: - Add support for new IBM zSeries z13 instructions. (fate#327074, jsc#SLE-6206, bsc#1137271) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1680=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): binutils-2.31-22.1 binutils-debuginfo-2.31-22.1 binutils-debugsource-2.31-22.1 binutils-devel-2.31-22.1 binutils-gold-2.31-22.1 binutils-gold-debuginfo-2.31-22.1 cross-aarch64-binutils-2.31-22.1 cross-aarch64-binutils-debuginfo-2.31-22.1 cross-aarch64-binutils-debugsource-2.31-22.1 cross-arm-binutils-2.31-22.1 cross-arm-binutils-debuginfo-2.31-22.1 cross-arm-binutils-debugsource-2.31-22.1 cross-avr-binutils-2.31-22.1 cross-avr-binutils-debuginfo-2.31-22.1 cross-avr-binutils-debugsource-2.31-22.1 cross-hppa-binutils-2.31-22.1 cross-hppa-binutils-debuginfo-2.31-22.1 cross-hppa-binutils-debugsource-2.31-22.1 cross-hppa64-binutils-2.31-22.1 cross-hppa64-binutils-debuginfo-2.31-22.1 cross-hppa64-binutils-debugsource-2.31-22.1 cross-ia64-binutils-2.31-22.1 cross-ia64-binutils-debuginfo-2.31-22.1 cross-ia64-binutils-debugsource-2.31-22.1 cross-m68k-binutils-2.31-22.1 cross-m68k-binutils-debuginfo-2.31-22.1 cross-m68k-binutils-debugsource-2.31-22.1 cross-mips-binutils-2.31-22.1 cross-mips-binutils-debuginfo-2.31-22.1 cross-mips-binutils-debugsource-2.31-22.1 cross-ppc-binutils-2.31-22.1 cross-ppc-binutils-debuginfo-2.31-22.1 cross-ppc-binutils-debugsource-2.31-22.1 cross-ppc64-binutils-2.31-22.1 cross-ppc64-binutils-debuginfo-2.31-22.1 cross-ppc64-binutils-debugsource-2.31-22.1 cross-ppc64le-binutils-2.31-22.1 cross-ppc64le-binutils-debuginfo-2.31-22.1 cross-ppc64le-binutils-debugsource-2.31-22.1 cross-s390-binutils-2.31-22.1 cross-s390-binutils-debuginfo-2.31-22.1 cross-s390-binutils-debugsource-2.31-22.1 cross-s390x-binutils-2.31-22.1 cross-s390x-binutils-debuginfo-2.31-22.1 cross-s390x-binutils-debugsource-2.31-22.1 cross-sparc-binutils-2.31-22.1 cross-sparc-binutils-debuginfo-2.31-22.1 cross-sparc-binutils-debugsource-2.31-22.1 cross-sparc64-binutils-2.31-22.1 cross-sparc64-binutils-debuginfo-2.31-22.1 cross-sparc64-binutils-debugsource-2.31-22.1 cross-spu-binutils-2.31-22.1 cross-spu-binutils-debuginfo-2.31-22.1 cross-spu-binutils-debugsource-2.31-22.1 - openSUSE Leap 42.3 (x86_64): binutils-devel-32bit-2.31-22.1 cross-i386-binutils-2.31-22.1 cross-i386-binutils-debuginfo-2.31-22.1 cross-i386-binutils-debugsource-2.31-22.1 - openSUSE Leap 42.3 (i586): cross-x86_64-binutils-2.31-22.1 cross-x86_64-binutils-debuginfo-2.31-22.1 cross-x86_64-binutils-debugsource-2.31-22.1 References: https://bugzilla.suse.com/1137271

1 0

openSUSE-RU-2019:1678-1: moderate: Recommended update for trytond
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1678-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond fixes the following issues: trytond was updated to version 4.2.22 - Bugfix Release This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1678=1 Package List: - openSUSE Backports SLE-15 (noarch): trytond-4.2.22-bp150.2.19.1 References:

1 0