July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1818-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1818-1 Rating: moderate References: #1104595 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Add upstream patch to fix downloaded files (via http) getting an "invalid" modification time (boo#1104595, kde#374420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1818=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1818=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1818=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): kio-5.45.0-lp150.3.3.1 kio-core-5.45.0-lp150.3.3.1 kio-core-debuginfo-5.45.0-lp150.3.3.1 kio-debuginfo-5.45.0-lp150.3.3.1 kio-debugsource-5.45.0-lp150.3.3.1 kio-devel-5.45.0-lp150.3.3.1 kio-devel-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): kio-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kio-32bit-5.45.0-lp150.3.3.1 kio-32bit-debuginfo-5.45.0-lp150.3.3.1 kio-core-32bit-5.45.0-lp150.3.3.1 kio-core-32bit-debuginfo-5.45.0-lp150.3.3.1 kio-devel-32bit-5.45.0-lp150.3.3.1 kio-devel-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kio-5.45.0-bp150.3.3.1 kio-core-5.45.0-bp150.3.3.1 kio-core-debuginfo-5.45.0-bp150.3.3.1 kio-debuginfo-5.45.0-bp150.3.3.1 kio-debugsource-5.45.0-bp150.3.3.1 kio-devel-5.45.0-bp150.3.3.1 kio-devel-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kio-64bit-5.45.0-bp150.3.3.1 kio-64bit-debuginfo-5.45.0-bp150.3.3.1 kio-core-64bit-5.45.0-bp150.3.3.1 kio-core-64bit-debuginfo-5.45.0-bp150.3.3.1 kio-devel-64bit-5.45.0-bp150.3.3.1 kio-devel-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kio-lang-5.45.0-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-12.1 kio-5.26.0-11.1 kio-5.32.0-8.1 kio-core-5.20.0-12.1 kio-core-5.26.0-11.1 kio-core-5.32.0-8.1 kio-core-debuginfo-5.32.0-8.1 kio-debuginfo-5.32.0-8.1 kio-debugsource-5.32.0-8.1 kio-devel-5.20.0-12.1 kio-devel-5.26.0-11.1 kio-devel-5.32.0-8.1 kio-devel-debuginfo-5.32.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-12.1 kio-lang-5.26.0-11.1 kio-lang-5.32.0-8.1 References: https://bugzilla.suse.com/1104595

1 0

openSUSE-RU-2019:1818-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1818-1 Rating: moderate References: #1104595 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Add upstream patch to fix downloaded files (via http) getting an "invalid" modification time (boo#1104595, kde#374420) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1818=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-12.1 kio-5.26.0-11.1 kio-5.32.0-8.1 kio-core-5.20.0-12.1 kio-core-5.26.0-11.1 kio-core-5.32.0-8.1 kio-core-debuginfo-5.32.0-8.1 kio-debuginfo-5.32.0-8.1 kio-debugsource-5.32.0-8.1 kio-devel-5.20.0-12.1 kio-devel-5.26.0-11.1 kio-devel-5.32.0-8.1 kio-devel-debuginfo-5.32.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-12.1 kio-lang-5.26.0-11.1 kio-lang-5.32.0-8.1 References: https://bugzilla.suse.com/1104595

1 0

openSUSE-RU-2019:1817-1: moderate: Recommended update for NetworkManager
by maintenance＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1817-1 Rating: moderate References: #1129587 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager fixes the following issues: - Add CAP_SYS_ADMIN which netconfig needs to call setdomainname. (bsc#1129587). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1817=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): NetworkManager-1.10.6-lp150.4.9.1 NetworkManager-debuginfo-1.10.6-lp150.4.9.1 NetworkManager-debugsource-1.10.6-lp150.4.9.1 NetworkManager-devel-1.10.6-lp150.4.9.1 libnm-glib-vpn1-1.10.6-lp150.4.9.1 libnm-glib-vpn1-debuginfo-1.10.6-lp150.4.9.1 libnm-glib4-1.10.6-lp150.4.9.1 libnm-glib4-debuginfo-1.10.6-lp150.4.9.1 libnm-util2-1.10.6-lp150.4.9.1 libnm-util2-debuginfo-1.10.6-lp150.4.9.1 libnm0-1.10.6-lp150.4.9.1 libnm0-debuginfo-1.10.6-lp150.4.9.1 typelib-1_0-NM-1_0-1.10.6-lp150.4.9.1 typelib-1_0-NMClient-1_0-1.10.6-lp150.4.9.1 typelib-1_0-NetworkManager-1_0-1.10.6-lp150.4.9.1 - openSUSE Leap 15.0 (noarch): NetworkManager-branding-upstream-1.10.6-lp150.4.9.1 NetworkManager-lang-1.10.6-lp150.4.9.1 - openSUSE Leap 15.0 (x86_64): NetworkManager-devel-32bit-1.10.6-lp150.4.9.1 libnm-glib-vpn1-32bit-1.10.6-lp150.4.9.1 libnm-glib-vpn1-32bit-debuginfo-1.10.6-lp150.4.9.1 libnm-glib4-32bit-1.10.6-lp150.4.9.1 libnm-glib4-32bit-debuginfo-1.10.6-lp150.4.9.1 libnm-util2-32bit-1.10.6-lp150.4.9.1 libnm-util2-32bit-debuginfo-1.10.6-lp150.4.9.1 References: https://bugzilla.suse.com/1129587

1 0

openSUSE-SU-2019:1816-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1816-1 Rating: moderate References: #1040109 #1040113 #1040115 Cross-References: CVE-2017-9111 CVE-2017-9113 CVE-2017-9115 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2017-9111: Fixed an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h (bsc#1040109). - CVE-2017-9113: Fixed an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp (bsc#1040113). - CVE-2017-9115: Fixed an invalid write of size 2 in the = operator function inhalf.h (bsc#1040115). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1816=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp150.2.6.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp150.2.6.1 openexr-2.2.1-lp150.2.6.1 openexr-debuginfo-2.2.1-lp150.2.6.1 openexr-debugsource-2.2.1-lp150.2.6.1 openexr-devel-2.2.1-lp150.2.6.1 openexr-doc-2.2.1-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp150.2.6.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp150.2.6.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2017-9111.html https://www.suse.com/security/cve/CVE-2017-9113.html https://www.suse.com/security/cve/CVE-2017-9115.html https://bugzilla.suse.com/1040109 https://bugzilla.suse.com/1040113 https://bugzilla.suse.com/1040115

1 0

openSUSE-SU-2019:1815-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1815-1 Rating: important References: #1120892 #1141102 #1141649 Cross-References: CVE-2018-20073 CVE-2019-5847 CVE-2019-5848 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium to version 75.0.3770.142 fixes the following issues: Security issue fixed: - CVE-2019-5847: V8 sealed/frozen elements cause crash (boo#1141649). - CVE-2019-5848: Font sizes may expose sensitive information (boo#1141649). - CVE-2018-20073: Fixed information leaks of URL metadata nad passwords via extended filesystem attributes (boo#1120892). Non-security fix: - Fixed a segfault on startup (boo#1141102). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1815=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1815=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1815=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1815=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.142-lp151.2.12.4 chromedriver-debuginfo-75.0.3770.142-lp151.2.12.4 chromium-75.0.3770.142-lp151.2.12.4 chromium-debuginfo-75.0.3770.142-lp151.2.12.4 chromium-debugsource-75.0.3770.142-lp151.2.12.4 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.142-lp150.221.4 chromedriver-debuginfo-75.0.3770.142-lp150.221.4 chromium-75.0.3770.142-lp150.221.4 chromium-debuginfo-75.0.3770.142-lp150.221.4 chromium-debugsource-75.0.3770.142-lp150.221.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.142-bp150.217.1 chromedriver-debuginfo-75.0.3770.142-bp150.217.1 chromium-75.0.3770.142-bp150.217.1 chromium-debuginfo-75.0.3770.142-bp150.217.1 chromium-debugsource-75.0.3770.142-bp150.217.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.142-7.1 chromedriver-debuginfo-75.0.3770.142-7.1 chromium-75.0.3770.142-7.1 chromium-debuginfo-75.0.3770.142-7.1 chromium-debugsource-75.0.3770.142-7.1 References: https://www.suse.com/security/cve/CVE-2018-20073.html https://www.suse.com/security/cve/CVE-2019-5847.html https://www.suse.com/security/cve/CVE-2019-5848.html https://bugzilla.suse.com/1120892 https://bugzilla.suse.com/1141102 https://bugzilla.suse.com/1141649

1 0

openSUSE-SU-2019:1813-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1813-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird version 60.8 fixes the following issues: Security issues fixed: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). Non-security issued fixed: - Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1813=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1813=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-60.8.0-lp151.2.10.1 MozillaThunderbird-buildsymbols-60.8.0-lp151.2.10.1 MozillaThunderbird-debuginfo-60.8.0-lp151.2.10.1 MozillaThunderbird-debugsource-60.8.0-lp151.2.10.1 MozillaThunderbird-translations-common-60.8.0-lp151.2.10.1 MozillaThunderbird-translations-other-60.8.0-lp151.2.10.1 - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.8.0-lp150.3.48.1 MozillaThunderbird-buildsymbols-60.8.0-lp150.3.48.1 MozillaThunderbird-debuginfo-60.8.0-lp150.3.48.1 MozillaThunderbird-debugsource-60.8.0-lp150.3.48.1 MozillaThunderbird-translations-common-60.8.0-lp150.3.48.1 MozillaThunderbird-translations-other-60.8.0-lp150.3.48.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1815-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1815-1 Rating: important References: #1120892 #1141102 #1141649 Cross-References: CVE-2018-20073 CVE-2019-5847 CVE-2019-5848 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium to version 75.0.3770.142 fixes the following issues: Security issue fixed: - CVE-2019-5847: V8 sealed/frozen elements cause crash (boo#1141649). - CVE-2019-5848: Font sizes may expose sensitive information (boo#1141649). - CVE-2018-20073: Fixed information leaks of URL metadata nad passwords via extended filesystem attributes (boo#1120892). Non-security fix: - Fixed a segfault on startup (boo#1141102). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1815=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.142-7.1 chromedriver-debuginfo-75.0.3770.142-7.1 chromium-75.0.3770.142-7.1 chromium-debuginfo-75.0.3770.142-7.1 chromium-debugsource-75.0.3770.142-7.1 References: https://www.suse.com/security/cve/CVE-2018-20073.html https://www.suse.com/security/cve/CVE-2019-5847.html https://www.suse.com/security/cve/CVE-2019-5848.html https://bugzilla.suse.com/1120892 https://bugzilla.suse.com/1141102 https://bugzilla.suse.com/1141649

1 0

openSUSE-SU-2019:1814-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 30 Jul '19

30 Jul '19

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1814-1 Rating: important References: #1097248 #1098050 #1112097 #1113894 #1115041 #1116050 #1130503 #1130588 #1132379 #1132439 #1132827 #1133289 #1133492 #1141801 Cross-References: CVE-2018-0734 CVE-2018-11763 CVE-2018-11784 CVE-2018-3288 CVE-2018-3289 CVE-2018-3290 CVE-2018-3291 CVE-2018-3292 CVE-2018-3293 CVE-2018-3294 CVE-2018-3295 CVE-2018-3296 CVE-2018-3297 CVE-2018-3298 CVE-2019-1543 CVE-2019-2446 CVE-2019-2448 CVE-2019-2450 CVE-2019-2451 CVE-2019-2508 CVE-2019-2509 CVE-2019-2511 CVE-2019-2525 CVE-2019-2527 CVE-2019-2554 CVE-2019-2555 CVE-2019-2556 CVE-2019-2574 CVE-2019-2656 CVE-2019-2657 CVE-2019-2678 CVE-2019-2679 CVE-2019-2680 CVE-2019-2690 CVE-2019-2696 CVE-2019-2703 CVE-2019-2721 CVE-2019-2722 CVE-2019-2723 CVE-2019-2848 CVE-2019-2850 CVE-2019-2859 CVE-2019-2863 CVE-2019-2864 CVE-2019-2865 CVE-2019-2866 CVE-2019-2867 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2877 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: This update for virtualbox to version 6.0.10 fixes the following issues: Security issues fixed: - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864 CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848 CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2850 (boo#1141801) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1814=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1814=1 Package List: - openSUSE Leap 15.1 (x86_64): python3-virtualbox-6.0.10-lp151.2.6.1 python3-virtualbox-debuginfo-6.0.10-lp151.2.6.1 virtualbox-6.0.10-lp151.2.6.1 virtualbox-debuginfo-6.0.10-lp151.2.6.1 virtualbox-debugsource-6.0.10-lp151.2.6.1 virtualbox-devel-6.0.10-lp151.2.6.1 virtualbox-guest-kmp-default-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-guest-kmp-default-debuginfo-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-guest-tools-6.0.10-lp151.2.6.1 virtualbox-guest-tools-debuginfo-6.0.10-lp151.2.6.1 virtualbox-guest-x11-6.0.10-lp151.2.6.1 virtualbox-guest-x11-debuginfo-6.0.10-lp151.2.6.1 virtualbox-host-kmp-default-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-host-kmp-default-debuginfo-6.0.10_k4.12.14_lp151.28.10-lp151.2.6.1 virtualbox-qt-6.0.10-lp151.2.6.1 virtualbox-qt-debuginfo-6.0.10-lp151.2.6.1 virtualbox-vnc-6.0.10-lp151.2.6.1 virtualbox-websrv-6.0.10-lp151.2.6.1 virtualbox-websrv-debuginfo-6.0.10-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): virtualbox-guest-desktop-icons-6.0.10-lp151.2.6.1 virtualbox-guest-source-6.0.10-lp151.2.6.1 virtualbox-host-source-6.0.10-lp151.2.6.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-6.0.10-lp150.4.36.1 virtualbox-guest-source-6.0.10-lp150.4.36.1 virtualbox-host-source-6.0.10-lp150.4.36.1 - openSUSE Leap 15.0 (x86_64): python3-virtualbox-6.0.10-lp150.4.36.1 python3-virtualbox-debuginfo-6.0.10-lp150.4.36.1 virtualbox-6.0.10-lp150.4.36.1 virtualbox-debuginfo-6.0.10-lp150.4.36.1 virtualbox-debugsource-6.0.10-lp150.4.36.1 virtualbox-devel-6.0.10-lp150.4.36.1 virtualbox-guest-kmp-default-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-guest-kmp-default-debuginfo-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-guest-tools-6.0.10-lp150.4.36.1 virtualbox-guest-tools-debuginfo-6.0.10-lp150.4.36.1 virtualbox-guest-x11-6.0.10-lp150.4.36.1 virtualbox-guest-x11-debuginfo-6.0.10-lp150.4.36.1 virtualbox-host-kmp-default-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-host-kmp-default-debuginfo-6.0.10_k4.12.14_lp150.12.67-lp150.4.36.1 virtualbox-qt-6.0.10-lp150.4.36.1 virtualbox-qt-debuginfo-6.0.10-lp150.4.36.1 virtualbox-vnc-6.0.10-lp150.4.36.1 virtualbox-websrv-6.0.10-lp150.4.36.1 virtualbox-websrv-debuginfo-6.0.10-lp150.4.36.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-11763.html https://www.suse.com/security/cve/CVE-2018-11784.html https://www.suse.com/security/cve/CVE-2018-3288.html https://www.suse.com/security/cve/CVE-2018-3289.html https://www.suse.com/security/cve/CVE-2018-3290.html https://www.suse.com/security/cve/CVE-2018-3291.html https://www.suse.com/security/cve/CVE-2018-3292.html https://www.suse.com/security/cve/CVE-2018-3293.html https://www.suse.com/security/cve/CVE-2018-3294.html https://www.suse.com/security/cve/CVE-2018-3295.html https://www.suse.com/security/cve/CVE-2018-3296.html https://www.suse.com/security/cve/CVE-2018-3297.html https://www.suse.com/security/cve/CVE-2018-3298.html https://www.suse.com/security/cve/CVE-2019-1543.html https://www.suse.com/security/cve/CVE-2019-2446.html https://www.suse.com/security/cve/CVE-2019-2448.html https://www.suse.com/security/cve/CVE-2019-2450.html https://www.suse.com/security/cve/CVE-2019-2451.html https://www.suse.com/security/cve/CVE-2019-2508.html https://www.suse.com/security/cve/CVE-2019-2509.html https://www.suse.com/security/cve/CVE-2019-2511.html https://www.suse.com/security/cve/CVE-2019-2525.html https://www.suse.com/security/cve/CVE-2019-2527.html https://www.suse.com/security/cve/CVE-2019-2554.html https://www.suse.com/security/cve/CVE-2019-2555.html https://www.suse.com/security/cve/CVE-2019-2556.html https://www.suse.com/security/cve/CVE-2019-2574.html https://www.suse.com/security/cve/CVE-2019-2656.html https://www.suse.com/security/cve/CVE-2019-2657.html https://www.suse.com/security/cve/CVE-2019-2678.html https://www.suse.com/security/cve/CVE-2019-2679.html https://www.suse.com/security/cve/CVE-2019-2680.html https://www.suse.com/security/cve/CVE-2019-2690.html https://www.suse.com/security/cve/CVE-2019-2696.html https://www.suse.com/security/cve/CVE-2019-2703.html https://www.suse.com/security/cve/CVE-2019-2721.html https://www.suse.com/security/cve/CVE-2019-2722.html https://www.suse.com/security/cve/CVE-2019-2723.html https://www.suse.com/security/cve/CVE-2019-2848.html https://www.suse.com/security/cve/CVE-2019-2850.html https://www.suse.com/security/cve/CVE-2019-2859.html https://www.suse.com/security/cve/CVE-2019-2863.html https://www.suse.com/security/cve/CVE-2019-2864.html https://www.suse.com/security/cve/CVE-2019-2865.html https://www.suse.com/security/cve/CVE-2019-2866.html https://www.suse.com/security/cve/CVE-2019-2867.html https://www.suse.com/security/cve/CVE-2019-2873.html https://www.suse.com/security/cve/CVE-2019-2874.html https://www.suse.com/security/cve/CVE-2019-2875.html https://www.suse.com/security/cve/CVE-2019-2876.html https://www.suse.com/security/cve/CVE-2019-2877.html https://bugzilla.suse.com/1097248 https://bugzilla.suse.com/1098050 https://bugzilla.suse.com/1112097 https://bugzilla.suse.com/1113894 https://bugzilla.suse.com/1115041 https://bugzilla.suse.com/1116050 https://bugzilla.suse.com/1130503 https://bugzilla.suse.com/1130588 https://bugzilla.suse.com/1132379 https://bugzilla.suse.com/1132439 https://bugzilla.suse.com/1132827 https://bugzilla.suse.com/1133289 https://bugzilla.suse.com/1133492 https://bugzilla.suse.com/1141801

1 0

openSUSE-SU-2019:1811-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 29 Jul '19

29 Jul '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1811-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). mozilla-nss to version 3.44.1: * Added IPSEC IKE support to softoken * Many new FIPS test cases This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1811=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.44.1-lp150.2.24.1 libfreebl3-debuginfo-3.44.1-lp150.2.24.1 libfreebl3-hmac-3.44.1-lp150.2.24.1 libsoftokn3-3.44.1-lp150.2.24.1 libsoftokn3-debuginfo-3.44.1-lp150.2.24.1 libsoftokn3-hmac-3.44.1-lp150.2.24.1 mozilla-nss-3.44.1-lp150.2.24.1 mozilla-nss-certs-3.44.1-lp150.2.24.1 mozilla-nss-certs-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-debugsource-3.44.1-lp150.2.24.1 mozilla-nss-devel-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-tools-3.44.1-lp150.2.24.1 mozilla-nss-tools-debuginfo-3.44.1-lp150.2.24.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.44.1-lp150.2.24.1 libfreebl3-32bit-debuginfo-3.44.1-lp150.2.24.1 libfreebl3-hmac-32bit-3.44.1-lp150.2.24.1 libsoftokn3-32bit-3.44.1-lp150.2.24.1 libsoftokn3-32bit-debuginfo-3.44.1-lp150.2.24.1 libsoftokn3-hmac-32bit-3.44.1-lp150.2.24.1 mozilla-nss-32bit-3.44.1-lp150.2.24.1 mozilla-nss-32bit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-certs-32bit-3.44.1-lp150.2.24.1 mozilla-nss-certs-32bit-debuginfo-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-32bit-3.44.1-lp150.2.24.1 mozilla-nss-sysinit-32bit-debuginfo-3.44.1-lp150.2.24.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1808-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 25 Jul '19

25 Jul '19

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1808-1 Rating: moderate References: #1111966 #1131055 #1136085 Cross-References: CVE-2019-0199 CVE-2019-0221 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for tomcat to version 9.0.21 fixes the following issues: Security issues fixed: - CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055). - CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085). Non-security issues fixed: - Increase maximum number of threads and open files for tomcat (bsc#1111966). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1808=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.21-lp151.3.3.1 tomcat-admin-webapps-9.0.21-lp151.3.3.1 tomcat-docs-webapp-9.0.21-lp151.3.3.1 tomcat-el-3_0-api-9.0.21-lp151.3.3.1 tomcat-embed-9.0.21-lp151.3.3.1 tomcat-javadoc-9.0.21-lp151.3.3.1 tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1 tomcat-jsvc-9.0.21-lp151.3.3.1 tomcat-lib-9.0.21-lp151.3.3.1 tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1 tomcat-webapps-9.0.21-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-0199.html https://www.suse.com/security/cve/CVE-2019-0221.html https://bugzilla.suse.com/1111966 https://bugzilla.suse.com/1131055 https://bugzilla.suse.com/1136085

1 0

openSUSE-RU-2019:1807-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1807-1 Rating: moderate References: #1099674 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner to version 1.1.4 fixes the following issues: - Exclude stuff from openstack macros (boo#1099674). - Replace 'http' with 'https' in URL (boo#1099674). - Replace legacy packageand() with 'and' expression (boo#1099674). - Replace pwdutils with shadow in Requires (boo#1099674). - Add openstack_cleanup_prep to bracketing excludes (boo#1099674). - Do not curlify yast_metainfo and yast_check (boo#1099674). - Fixup the eating of Source lines with whitespace (boo#1099674). - Document '#nospeccleaner' tag (boo#1099674). - Various small fixes (boo#1099674). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1807=1 Package List: - openSUSE Backports SLE-15 (noarch): spec-cleaner-1.1.4-bp150.64.1 spec-cleaner-format_spec_file-1.1.4-bp150.64.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:1804-1: important: Recommended update for grub2
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1804-1 Rating: important References: #1134287 #1139345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Fix a regression introduced by the previous update which could prevent booting on ppc64. (bsc#1134287, bsc#1139345). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1804=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): grub2-2.02-lp150.13.26.1 grub2-branding-upstream-2.02-lp150.13.26.1 grub2-debuginfo-2.02-lp150.13.26.1 grub2-debugsource-2.02-lp150.13.26.1 grub2-i386-pc-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (noarch): grub2-snapper-plugin-2.02-lp150.13.26.1 grub2-systemd-sleep-plugin-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (x86_64): grub2-x86_64-efi-2.02-lp150.13.26.1 grub2-x86_64-xen-2.02-lp150.13.26.1 - openSUSE Leap 15.0 (i586): grub2-i386-efi-2.02-lp150.13.26.1 grub2-i386-xen-2.02-lp150.13.26.1 References: https://bugzilla.suse.com/1134287 https://bugzilla.suse.com/1139345

1 0

openSUSE-RU-2019:1803-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1803-1 Rating: moderate References: #1099674 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner to version 1.1.4 fixes the following issues: - Exclude stuff from openstack macros (boo#1099674). - Replace 'http' with 'https' in URL (boo#1099674). - Replace legacy packageand() with 'and' expression (boo#1099674). - Replace pwdutils with shadow in Requires (boo#1099674). - Add openstack_cleanup_prep to bracketing excludes (boo#1099674). - Do not curlify yast_metainfo and yast_check (boo#1099674). - Fixup the eating of Source lines with whitespace (boo#1099674). - Document '#nospeccleaner' tag (boo#1099674). - Various small fixes (boo#1099674). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1803=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1803=1 Package List: - openSUSE Leap 15.1 (noarch): spec-cleaner-1.1.4-lp151.2.3.1 spec-cleaner-format_spec_file-1.1.4-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): spec-cleaner-1.1.4-lp150.64.1 spec-cleaner-format_spec_file-1.1.4-lp150.64.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:1802-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1802-1 Rating: moderate References: #1124564 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvme-cli fixes the following issues: - Add script to determine host NQN based on the system UUID - Add new udev rule for NetApp E-Series and adjust udev rule naming scheme accordingly. (bsc#1124564) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1802=1 Package List: - openSUSE Leap 15.1 (x86_64): nvme-cli-1.7-lp151.5.6.1 nvme-cli-debuginfo-1.7-lp151.5.6.1 nvme-cli-debugsource-1.7-lp151.5.6.1 nvme-cli-regress-script-1.7-lp151.5.6.1 References: https://bugzilla.suse.com/1124564

1 0

openSUSE-SU-2019:1805-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1805-1 Rating: important References: #1111331 Cross-References: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061d->0000061f Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000714->00000718 Xeon E3/E5, Core X This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1805=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20190618-lp150.2.24.1 References: https://www.suse.com/security/cve/CVE-2018-12126.html https://www.suse.com/security/cve/CVE-2018-12127.html https://www.suse.com/security/cve/CVE-2018-12130.html https://www.suse.com/security/cve/CVE-2019-11091.html https://bugzilla.suse.com/1111331

1 0

openSUSE-SU-2019:1806-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1806-1 Rating: important References: #1111331 Cross-References: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061d->0000061f Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000714->00000718 Xeon E3/E5, Core X ---- new platforms ---------------------------------------- VLV C0 6-37-8/02 00000838 Atom Z series VLV C0 6-37-8/0C 00000838 Celeron N2xxx, Pentium N35xx VLV D0 6-37-9/0F 0000090c Atom E38xx CHV C0 6-4c-3/01 00000368 Atom X series CHV D0 6-4c-4/01 00000411 Atom X series Readded what missing in last update: BDX-ML B0/M0/R0 6-4f-1/ef 0b00002e->00000036 Xeon E5/E7 v4; Core i7-69xx/68xx This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1806=1 Package List: - openSUSE Leap 15.1 (x86_64): ucode-intel-20190618-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12126.html https://www.suse.com/security/cve/CVE-2018-12127.html https://www.suse.com/security/cve/CVE-2018-12130.html https://www.suse.com/security/cve/CVE-2019-11091.html https://bugzilla.suse.com/1111331

1 0

openSUSE-RU-2019:1801-1: moderate: Recommended update for openslp
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for openslp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1801-1 Rating: moderate References: #1117969 #1136136 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openslp fixes the following issues: - Use tcp connects to talk with other directory agents (DAs) (bsc#1117969) - Fix segfault in predicate match if a registered service has a malformed attribute list (bsc#1136136) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1801=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1801=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): openslp-2.0.0-lp151.7.3.1 openslp-debuginfo-2.0.0-lp151.7.3.1 openslp-debugsource-2.0.0-lp151.7.3.1 openslp-devel-2.0.0-lp151.7.3.1 openslp-server-2.0.0-lp151.7.3.1 openslp-server-debuginfo-2.0.0-lp151.7.3.1 - openSUSE Leap 15.1 (x86_64): openslp-32bit-2.0.0-lp151.7.3.1 openslp-32bit-debuginfo-2.0.0-lp151.7.3.1 - openSUSE Leap 15.0 (i586 x86_64): openslp-2.0.0-lp150.10.1 openslp-debuginfo-2.0.0-lp150.10.1 openslp-debugsource-2.0.0-lp150.10.1 openslp-devel-2.0.0-lp150.10.1 openslp-server-2.0.0-lp150.10.1 openslp-server-debuginfo-2.0.0-lp150.10.1 - openSUSE Leap 15.0 (x86_64): openslp-32bit-2.0.0-lp150.10.1 openslp-32bit-debuginfo-2.0.0-lp150.10.1 References: https://bugzilla.suse.com/1117969 https://bugzilla.suse.com/1136136

1 0

openSUSE-SU-2019:1800-1: moderate: Security update for libsass
by opensuse-security＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Security Update: Security update for libsass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1800-1 Rating: moderate References: #1096894 #1118301 #1118346 #1118348 #1118349 #1118351 #1119789 #1121943 #1121944 #1121945 #1133200 #1133201 Cross-References: CVE-2018-11499 CVE-2018-19797 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 CVE-2018-20821 CVE-2018-20822 CVE-2019-6283 CVE-2019-6284 CVE-2019-6286 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1800=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libsass-3_6_1-1-3.6.1-bp150.3.3.1 libsass-devel-3.6.1-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11499.html https://www.suse.com/security/cve/CVE-2018-19797.html https://www.suse.com/security/cve/CVE-2018-19827.html https://www.suse.com/security/cve/CVE-2018-19837.html https://www.suse.com/security/cve/CVE-2018-19838.html https://www.suse.com/security/cve/CVE-2018-19839.html https://www.suse.com/security/cve/CVE-2018-20190.html https://www.suse.com/security/cve/CVE-2018-20821.html https://www.suse.com/security/cve/CVE-2018-20822.html https://www.suse.com/security/cve/CVE-2019-6283.html https://www.suse.com/security/cve/CVE-2019-6284.html https://www.suse.com/security/cve/CVE-2019-6286.html https://bugzilla.suse.com/1096894 https://bugzilla.suse.com/1118301 https://bugzilla.suse.com/1118346 https://bugzilla.suse.com/1118348 https://bugzilla.suse.com/1118349 https://bugzilla.suse.com/1118351 https://bugzilla.suse.com/1119789 https://bugzilla.suse.com/1121943 https://bugzilla.suse.com/1121944 https://bugzilla.suse.com/1121945 https://bugzilla.suse.com/1133200 https://bugzilla.suse.com/1133201

1 0

openSUSE-RU-2019:1799-1: moderate: Recommended update for tracker
by maintenance＠opensuse.org 24 Jul '19

24 Jul '19

openSUSE Recommended Update: Recommended update for tracker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1799-1 Rating: moderate References: #1123869 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tracker provides the following fixes: - Delete TrackerResource elements one by one. (bsc#1123869) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1799=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1799=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtracker-common-2_0-2.0.3-lp151.6.3.1 libtracker-common-2_0-debuginfo-2.0.3-lp151.6.3.1 libtracker-control-2_0-0-2.0.3-lp151.6.3.1 libtracker-control-2_0-0-debuginfo-2.0.3-lp151.6.3.1 libtracker-miner-2_0-0-2.0.3-lp151.6.3.1 libtracker-miner-2_0-0-debuginfo-2.0.3-lp151.6.3.1 libtracker-sparql-2_0-0-2.0.3-lp151.6.3.1 libtracker-sparql-2_0-0-debuginfo-2.0.3-lp151.6.3.1 tracker-2.0.3-lp151.6.3.1 tracker-debuginfo-2.0.3-lp151.6.3.1 tracker-debugsource-2.0.3-lp151.6.3.1 tracker-devel-2.0.3-lp151.6.3.1 typelib-1_0-Tracker-2_0-2.0.3-lp151.6.3.1 typelib-1_0-TrackerControl-2_0-2.0.3-lp151.6.3.1 typelib-1_0-TrackerMiner-2_0-2.0.3-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): tracker-lang-2.0.3-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): libtracker-common-2_0-2.0.3-lp150.4.6.1 libtracker-common-2_0-debuginfo-2.0.3-lp150.4.6.1 libtracker-control-2_0-0-2.0.3-lp150.4.6.1 libtracker-control-2_0-0-debuginfo-2.0.3-lp150.4.6.1 libtracker-miner-2_0-0-2.0.3-lp150.4.6.1 libtracker-miner-2_0-0-debuginfo-2.0.3-lp150.4.6.1 libtracker-sparql-2_0-0-2.0.3-lp150.4.6.1 libtracker-sparql-2_0-0-debuginfo-2.0.3-lp150.4.6.1 tracker-2.0.3-lp150.4.6.1 tracker-debuginfo-2.0.3-lp150.4.6.1 tracker-debugsource-2.0.3-lp150.4.6.1 tracker-devel-2.0.3-lp150.4.6.1 typelib-1_0-Tracker-2_0-2.0.3-lp150.4.6.1 typelib-1_0-TrackerControl-2_0-2.0.3-lp150.4.6.1 typelib-1_0-TrackerMiner-2_0-2.0.3-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): tracker-lang-2.0.3-lp150.4.6.1 References: https://bugzilla.suse.com/1123869

1 0

openSUSE-SU-2019:1796-1: important: Security update for neovim
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1796-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: neovim was updated to version 0.3.7: * CVE-2019-12735: source should check sandbox (boo#1137443) * genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: * options: properly reset directories on 'autochdir' * Remove MSVC optimization workaround for SHM_ALL * Make SHM_ALL to a variable instead of a compound literal #define * doc: mention "pynvim" module rename * screen: don't crash when drawing popupmenu with 'rightleft' option * look-behind match may use the wrong line number * :terminal : set topline based on window height * :recover : Fix crash on non-existent *.swp Version Update to version 0.3.4: * test: add tests for conceal cursor movement * display: unify ursorline and concealcursor redraw logic Version Update to version 0.3.3: * health/provider: Check for available pynvim when neovim mod is missing * python#CheckForModule: Use the given module string instead of hard-coding pynvim * (health.provider)/python: Import the neovim, rather than pynvim, module * TUI: Konsole DECSCUSR fixup Version Update to version 0.3.2:- * Features - clipboard: support Custom VimL functions (#9304) - win/TUI: improve terminal/console support (#9401) - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077) - support mapping in more places (#9299) - diff/highlight: show underline for low-priority CursorLine (#9028) - signs: Add "nuhml" argument (#9113) - clipboard: support Wayland (#9230) - TUI: add support for undercurl and underline color (#9052) - man.vim: soft (dynamic) wrap (#9023) * API - API: implement object namespaces (#6920) - API: implement nvim_win_set_buf() (#9100) - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180) - API: add nvim_buf_is_loaded() (#8660) - API: nvm_buf_get_offset_for_line (#8221) - API/UI: ext_newgrid, ext_histate (#8221) * UI - TUI: use BCE again more often (smoother resize) (#8806) - screen: add missing status redraw when redraw_later(CLEAR) was used (#9315) - TUI: clip invalid regions on resize (#8779) - TUI: improvements for scrolling and clearing (#9193) - TUI: disable clearing almost everywhere (#9143) - TUI: always use safe cursor movement after resize (#9079) - ui_options: also send when starting or from OptionSet (#9211) - TUI: Avoid reset_color_cursor_color in old VTE (#9191) - Don't erase screen on :hi Normal during startup (#9021) - TUI: Hint wrapped lines to terminals (#8915) * FIXES - RPC: turn errors from async calls into notifications - TUI: Restore terminal title via "title stacking" (#9407) - genappimage: Unset $ARGV0 at invocation (#9376) - TUI: Konsole 18.07.70 supports DECSCUSR (#9364) - provider: improve error message (#9344) - runtime/syntax: Fix highlighting of autogroup contents (#9328) - VimL/confirm(): Show dialog even if :silent (#9297) - clipboard: prefer xclip (#9302) - provider/nodejs: fix npm, yarn detection - channel: avoid buffering output when only terminal is active (#9218) - ruby: detect rbenv shims for other versions (#8733) - third party/unibilium: Fix parsing of extended capabilitiy entries (#9123) - jobstart(): Fix hang on non-executable cwd (#9204) - provide/nodejs: Simultaneously query npm and yarn (#9054) - undo: Fix infinite loop if undo_read_byte returns EOF (#2880) - 'swapfile: always show dialog' (#9034) - Add to the system-wide configuration file extension of runtimepath by /usr/share/vim/site, so that neovim uses other Vim plugins installed from packages. - Add /usr/share/vim/site tree of directories to be owned by neovim as well. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1796=1 Package List: - openSUSE Backports SLE-15 (noarch): neovim-lang-0.3.7-bp150.2.9.1 - openSUSE Backports SLE-15 (x86_64): neovim-0.3.7-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443

1 0

openSUSE-SU-2019:1792-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1792-1 Rating: moderate References: #1097073 #1125740 #1138939 Cross-References: CVE-2019-12904 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939) Other bugfixes: - Don't run full FIPS self-tests from constructor (bsc#1097073) - Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073) - Enforce the minimal RSA keygen size in fips mode (bsc#1125740) - avoid executing some tests twice. - Fixed a race condition in initialization. - Fixed env-script-interpreter in cavs_driver.pl - Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073) This helps during booting of the system in FIPS mode with insufficient entropy. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1792=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgcrypt-cavs-1.8.2-lp150.5.10.1 libgcrypt-cavs-debuginfo-1.8.2-lp150.5.10.1 libgcrypt-debugsource-1.8.2-lp150.5.10.1 libgcrypt-devel-1.8.2-lp150.5.10.1 libgcrypt-devel-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-1.8.2-lp150.5.10.1 libgcrypt20-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-1.8.2-lp150.5.10.1 - openSUSE Leap 15.0 (x86_64): libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-32bit-1.8.2-lp150.5.10.1 libgcrypt20-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-12904.html https://bugzilla.suse.com/1097073 https://bugzilla.suse.com/1125740 https://bugzilla.suse.com/1138939

1 0

openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le s390x x86_64): mumble-1.2.19-9.1 mumble-server-1.2.19-9.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334

1 0

openSUSE-SU-2019:1791-1: moderate: Security update for libsass
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libsass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1791-1 Rating: moderate References: #1096894 #1118301 #1118346 #1118348 #1118349 #1118351 #1119789 #1121943 #1121944 #1121945 #1133200 #1133201 Cross-References: CVE-2018-11499 CVE-2018-19797 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 CVE-2018-20821 CVE-2018-20822 CVE-2019-6283 CVE-2019-6284 CVE-2019-6286 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1791=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1791=1 Package List: - openSUSE Leap 15.1 (x86_64): libsass-3_6_1-1-3.6.1-lp151.3.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp151.3.3.1 libsass-debugsource-3.6.1-lp151.3.3.1 libsass-devel-3.6.1-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): libsass-3_6_1-1-3.6.1-lp150.2.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp150.2.3.1 libsass-debugsource-3.6.1-lp150.2.3.1 libsass-devel-3.6.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11499.html https://www.suse.com/security/cve/CVE-2018-19797.html https://www.suse.com/security/cve/CVE-2018-19827.html https://www.suse.com/security/cve/CVE-2018-19837.html https://www.suse.com/security/cve/CVE-2018-19838.html https://www.suse.com/security/cve/CVE-2018-19839.html https://www.suse.com/security/cve/CVE-2018-20190.html https://www.suse.com/security/cve/CVE-2018-20821.html https://www.suse.com/security/cve/CVE-2018-20822.html https://www.suse.com/security/cve/CVE-2019-6283.html https://www.suse.com/security/cve/CVE-2019-6284.html https://www.suse.com/security/cve/CVE-2019-6286.html https://bugzilla.suse.com/1096894 https://bugzilla.suse.com/1118301 https://bugzilla.suse.com/1118346 https://bugzilla.suse.com/1118348 https://bugzilla.suse.com/1118349 https://bugzilla.suse.com/1118351 https://bugzilla.suse.com/1119789 https://bugzilla.suse.com/1121943 https://bugzilla.suse.com/1121944 https://bugzilla.suse.com/1121945 https://bugzilla.suse.com/1133200 https://bugzilla.suse.com/1133201

1 0

openSUSE-SU-2019:1793-1: moderate: Security update for teeworlds
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for teeworlds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1793-1 Rating: moderate References: #1112910 #1131729 Cross-References: CVE-2018-18541 CVE-2019-10877 CVE-2019-10878 CVE-2019-10879 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for teeworlds fixes the following issues: - CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729) - CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution. - CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled. - CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910) - Update to version 0.7.3.1 * Colorful gametype and level icons in the browser instead of grayscale. * Add an option to use raw mouse inputs, revert to (0.6) relative mode by default. * Demo list marker indicator. * Restore ingame Player and Tee menus, add a warning that a reconnect is needed. * Emotes can now be cancelled by releasing the mouse in the middle of the circle. * Improve add friend text. * Add a confirmation for removing a filter * Add a "click a player to follow" hint * Also hint players which key they should press to set themselves ready. * fixed using correct array measurements when placing egg doodads * fixed demo recorder downloaded maps using the sha256 hash * show correct game release version in the start menu and console * Fix platform-specific client libraries for Linux * advanced scoreboard with game statistics * joystick support (experimental!) * copy paste (one-way) * bot cosmetics (a visual difference between players and NPCs) * chat commands (type / in chat) * players can change skin without leaving the server (again) * live automapper and complete rules for 0.7 tilesets * audio toggling HUD * an Easter surprise... * new gametypes: "last man standing" (LMS) and "last team standing" (LTS). survive by your own or as a team with limited weaponry * 64 players support. official gametypes are still restricted to 16 players maximum but allow more spectators * new skin system. build your own skins based on a variety of provided parts * enhanced security. all communications require a handshake and use a token to counter spoofing and reflection attacks * new maps: ctf8, dm3, lms1. Click to discover them! * animated background menu map: jungle, heavens (day/night themes, customisable in the map editor) * new design for the menus: added start menus, reworked server browser, settings * customisable gametype icons (browser). make your own! * chat overhaul, whispers (private messages) * composed binds (ctrl+, shift+, alt+) * scoreboard remodelled, now shows kills/deaths * demo markers * master server list cache (in case the masters are unreachable) * input separated from rendering (optimisation) * upgrade to SDL2. support for multiple monitors, non-english keyboards, and more * broadcasts overhaul, optional colours support * ready system, for competitive settings * server difficulty setting (casual, competitive, normal), shown in the browser * spectator mode improvements: follow flags, click on players * bot flags for modified servers: indicate NPCs, can be filtered out in the server browser * sharper graphics all around (no more tileset_borderfix and dilate) * refreshed the HUD, ninja cooldown, new mouse cursor * mapres update (higher resolution, fixes...) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1793=1 Package List: - openSUSE Leap 15.1 (x86_64): teeworlds-0.7.3.1-lp151.2.3.1 teeworlds-debuginfo-0.7.3.1-lp151.2.3.1 teeworlds-debugsource-0.7.3.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18541.html https://www.suse.com/security/cve/CVE-2019-10877.html https://www.suse.com/security/cve/CVE-2019-10878.html https://www.suse.com/security/cve/CVE-2019-10879.html https://bugzilla.suse.com/1112910 https://bugzilla.suse.com/1131729

1 0

openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334

1 0

openSUSE-SU-2019:1797-1: moderate: Security update for live555
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for live555 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1797-1 Rating: moderate References: #1121995 #1124159 #1127341 Cross-References: CVE-2019-7314 CVE-2019-9215 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for live555 fixes the following issues: - CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341) - CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159) - Update to version 2019.06.28, - Convert to dynamic libraries (boo#1121995): + Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one. + Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before. + Split out shared library packages according the SLPP. - Use FAT LTO objects in order to provide proper static library. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1797=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1797=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1797=1 Package List: - openSUSE Leap 15.1 (x86_64): libBasicUsageEnvironment1-2019.06.28-lp151.2.3.1 libBasicUsageEnvironment1-debuginfo-2019.06.28-lp151.2.3.1 libUsageEnvironment3-2019.06.28-lp151.2.3.1 libUsageEnvironment3-debuginfo-2019.06.28-lp151.2.3.1 libgroupsock8-2019.06.28-lp151.2.3.1 libgroupsock8-debuginfo-2019.06.28-lp151.2.3.1 libliveMedia66-2019.06.28-lp151.2.3.1 libliveMedia66-debuginfo-2019.06.28-lp151.2.3.1 live555-2019.06.28-lp151.2.3.1 live555-debuginfo-2019.06.28-lp151.2.3.1 live555-debugsource-2019.06.28-lp151.2.3.1 live555-devel-2019.06.28-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): libBasicUsageEnvironment1-2019.06.28-lp150.12.1 libBasicUsageEnvironment1-debuginfo-2019.06.28-lp150.12.1 libUsageEnvironment3-2019.06.28-lp150.12.1 libUsageEnvironment3-debuginfo-2019.06.28-lp150.12.1 libgroupsock8-2019.06.28-lp150.12.1 libgroupsock8-debuginfo-2019.06.28-lp150.12.1 libliveMedia66-2019.06.28-lp150.12.1 libliveMedia66-debuginfo-2019.06.28-lp150.12.1 live555-2019.06.28-lp150.12.1 live555-debuginfo-2019.06.28-lp150.12.1 live555-debugsource-2019.06.28-lp150.12.1 live555-devel-2019.06.28-lp150.12.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libBasicUsageEnvironment1-2019.06.28-bp150.12.1 libUsageEnvironment3-2019.06.28-bp150.12.1 libgroupsock8-2019.06.28-bp150.12.1 libliveMedia66-2019.06.28-bp150.12.1 live555-2019.06.28-bp150.12.1 live555-devel-2019.06.28-bp150.12.1 References: https://www.suse.com/security/cve/CVE-2019-7314.html https://www.suse.com/security/cve/CVE-2019-9215.html https://bugzilla.suse.com/1121995 https://bugzilla.suse.com/1124159 https://bugzilla.suse.com/1127341

1 0

openSUSE-SU-2019:1795-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1795-1 Rating: moderate References: #1138425 #1138464 Cross-References: CVE-2019-11597 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11597: Fixed a heap-based buffer over-read in the WriteTIFFImage() (bsc#1138464). - Fixed a file content disclosure via SVG and WMF decoding (bsc#1138425). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1795=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1795=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ImageMagick-7.0.7.34-lp151.7.6.1 ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.6.1 ImageMagick-config-7-upstream-7.0.7.34-lp151.7.6.1 ImageMagick-debuginfo-7.0.7.34-lp151.7.6.1 ImageMagick-debugsource-7.0.7.34-lp151.7.6.1 ImageMagick-devel-7.0.7.34-lp151.7.6.1 ImageMagick-extra-7.0.7.34-lp151.7.6.1 ImageMagick-extra-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-devel-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.6.1 perl-PerlMagick-7.0.7.34-lp151.7.6.1 perl-PerlMagick-debuginfo-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.1 (noarch): ImageMagick-doc-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.1 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-devel-32bit-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.35.1 ImageMagick-config-7-SUSE-7.0.7.34-lp150.2.35.1 ImageMagick-config-7-upstream-7.0.7.34-lp150.2.35.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.35.1 ImageMagick-debugsource-7.0.7.34-lp150.2.35.1 ImageMagick-devel-7.0.7.34-lp150.2.35.1 ImageMagick-extra-7.0.7.34-lp150.2.35.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-devel-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.35.1 perl-PerlMagick-7.0.7.34-lp150.2.35.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.35.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.35.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.35.1 References: https://www.suse.com/security/cve/CVE-2019-11597.html https://bugzilla.suse.com/1138425 https://bugzilla.suse.com/1138464

1 0

openSUSE-RU-2019:1788-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 22 Jul '19

22 Jul '19

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1788-1 Rating: moderate References: #1127293 #928131 #940457 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Check/refresh zipl-kernel before hibernate on s390x. (bsc#940457) - Removing hardcoded 'vmlinuz'. - Try to refresh zipl-kernel on failed kexec. (bsc#1127293) - Fully support "previous" zipl-kernel with 'mem=1G' being available on dedicated entries. (bsc#928131) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1788=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): grub2-2.02-lp151.21.3.1 grub2-branding-upstream-2.02-lp151.21.3.1 grub2-debuginfo-2.02-lp151.21.3.1 grub2-debugsource-2.02-lp151.21.3.1 - openSUSE Leap 15.1 (noarch): grub2-i386-efi-2.02-lp151.21.3.1 grub2-i386-pc-2.02-lp151.21.3.1 grub2-i386-xen-2.02-lp151.21.3.1 grub2-snapper-plugin-2.02-lp151.21.3.1 grub2-systemd-sleep-plugin-2.02-lp151.21.3.1 grub2-x86_64-efi-2.02-lp151.21.3.1 grub2-x86_64-xen-2.02-lp151.21.3.1 References: https://bugzilla.suse.com/1127293 https://bugzilla.suse.com/928131 https://bugzilla.suse.com/940457

1 0

openSUSE-RU-2019:1790-1: moderate: Recommended update for libebml, libmatroska
by maintenance＠opensuse.org 22 Jul '19

22 Jul '19

openSUSE Recommended Update: Recommended update for libebml, libmatroska ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1790-1 Rating: moderate References: #1104354 #1141027 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libebml, libmatroska fixes the following issues: - Update libeml to version 1.3.9: * Fixed the handling of Unicode codepoints > U+FFFF * Some build system related changes * Fix memory leak (boo#1104354) - Update libmatroska to version 1.5.2: * KaxBlock: fixed a potential access to invalid memory due to invalid lace sizes read from invalid data. * KaxBlock: fixed a potential null pointer dereference triggerable by reading invalid data. (boo#1141027) * Compatibilty with libEBML 1.3.7 * Switched to cmake. * KaxBlockGroup, KaxSimpleBlock: fixed writing the block header * Setting the version number in the "KaxCodeVersion" variable * KaxSemantic: add new elements dealing with 360°/VR content and Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1790=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1790=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1790=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libebml-debugsource-1.3.9-lp151.2.3.1 libebml-devel-1.3.9-lp151.2.3.1 libebml4-1.3.9-lp151.2.3.1 libebml4-debuginfo-1.3.9-lp151.2.3.1 libmatroska-debugsource-1.5.2-lp151.2.3.1 libmatroska-devel-1.5.2-lp151.2.3.1 libmatroska6-1.5.2-lp151.2.3.1 libmatroska6-debuginfo-1.5.2-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libebml4-32bit-1.3.9-lp151.2.3.1 libebml4-32bit-debuginfo-1.3.9-lp151.2.3.1 libmatroska6-32bit-1.5.2-lp151.2.3.1 libmatroska6-32bit-debuginfo-1.5.2-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libebml-debugsource-1.3.9-lp150.12.1 libebml-devel-1.3.9-lp150.12.1 libebml4-1.3.9-lp150.12.1 libebml4-debuginfo-1.3.9-lp150.12.1 libmatroska-debugsource-1.5.2-lp150.3.3.1 libmatroska-devel-1.5.2-lp150.3.3.1 libmatroska6-1.5.2-lp150.3.3.1 libmatroska6-debuginfo-1.5.2-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libebml4-32bit-1.3.9-lp150.12.1 libebml4-32bit-debuginfo-1.3.9-lp150.12.1 libmatroska6-32bit-1.5.2-lp150.3.3.1 libmatroska6-32bit-debuginfo-1.5.2-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libebml-devel-1.3.9-bp150.12.1 libebml4-1.3.9-bp150.12.1 libmatroska-debugsource-1.5.2-bp150.3.3.1 libmatroska-devel-1.5.2-bp150.3.3.1 libmatroska6-1.5.2-bp150.3.3.1 libmatroska6-debuginfo-1.5.2-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libebml4-64bit-1.3.9-bp150.12.1 libmatroska6-64bit-1.5.2-bp150.3.3.1 libmatroska6-64bit-debuginfo-1.5.2-bp150.3.3.1 References: https://bugzilla.suse.com/1104354 https://bugzilla.suse.com/1141027

1 0

openSUSE-RU-2019:1789-1: moderate: Recommended update for kmymoney
by maintenance＠opensuse.org 22 Jul '19

22 Jul '19

openSUSE Recommended Update: Recommended update for kmymoney ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1789-1 Rating: moderate References: #1136300 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmymoney fixes the following issues: - Update to 5.0.5 - Bugs fixed: * Tag not shown in ledger if only an category is set (kde#352029) * Budgeted vs. Actual report: Budgeted values broken if ticks selected to Bi-Monthly, Quarterly or Yearly (kde#393752) * Can't edit loan account with institution of "Accounts with no institution assigned" (kde#402672) * OFX import targets the wrong account (kde#405206) * Show hidden accounts (kde#407021) * Invalid online statement balance shown (kde#407422) * 21st June 2019 shows as non-processing day when holiday calendar is configured (kde#407800) * KMyMoney crashes in LEAP15.1 (kde#407902, boo#1136300) * Categories with different currencies, no more rate (kde#407982) * Crash during CSV import (kde#408026) * Merging payees results in error and data loss if payee is in matched transaction (kde#408205) * AqBanking File Import does not allow to select account (kde#408494) * Gnucash importer ignores the accounts currencies (kde#409098) * Converted amount not entered into exchange rate editor (kde#409428) - Enhancements: * In Payees view, change "Default Account" tab to "Default Category" (kde#409089) - Fix incompatibilities in how schedules are saved compared to previous versions (kde#406082) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1789=1 Package List: - openSUSE Leap 15.1 (noarch): kmymoney-lang-5.0.5-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): kmymoney-5.0.5-lp151.2.3.1 kmymoney-debuginfo-5.0.5-lp151.2.3.1 kmymoney-debugsource-5.0.5-lp151.2.3.1 kmymoney-devel-5.0.5-lp151.2.3.1 References: https://bugzilla.suse.com/1136300

1 0

openSUSE-RU-2019:1787-1: moderate: Recommended update for machinery
by maintenance＠opensuse.org 22 Jul '19

22 Jul '19

openSUSE Recommended Update: Recommended update for machinery ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1787-1 Rating: moderate References: #1125785 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for machinery fixes the following issues: machinery was updated to version 1.24.1: * Fix HTML man page * Switch image building support from legacy Kiwi to Kiwi Next Generation * Allow newer json-schema releases than 2.2.5. Newer versions slow down parsing of manifests but newer Ruby versions have issues with old json schema releases. The performance issue is known upstream: (gh#ruby-json-schema/json-schema#261) * Fix machinery helper go version parsing (boo#1125785) * Improve parsing of SSH exceptions (gh#SUSE/machinery#2257) * Allow inspection of old 32-bit systems even when their architecture is reported as i586 or i386 This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1787=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): machinery-1.24.1-bp150.3.3.1 machinery-doc-1.24.1-bp150.3.3.1 References: https://bugzilla.suse.com/1125785

1 0

openSUSE-RU-2019:1786-1: moderate: Recommended update for python-relatorio
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for python-relatorio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1786-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-relatorio fixes the following issues: - python-magic added to requirements Update to version 0.8.1: * Add support for Python 3.7 * Escape invalid XML characters * Enforce closing tag to be the same directive as the opening * Use compression for zip file * Write mimetype as first file of the zip file This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1786=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-relatorio-0.8.1-bp150.3.3.1 python3-relatorio-0.8.1-bp150.3.3.1 References:

1 0

openSUSE-SU-2019:1785-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1785-1 Rating: moderate References: #1137825 Cross-References: CVE-2019-12387 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issue: Security issue fixed: - CVE-2019-12387: Fixed an improper sanitization of URIs or HTTP which could have allowed attackers to perfrom CRLF attacks (bsc#1137825). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1785=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-Twisted-doc-17.9.0-bp150.4.3.1 python2-Twisted-17.9.0-bp150.4.3.1 python3-Twisted-17.9.0-bp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-12387.html https://bugzilla.suse.com/1137825

1 0

openSUSE-RU-2019:1784-1: moderate: Recommended update for pure-ftpd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for pure-ftpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1784-1 Rating: moderate References: #1119187 #1136997 #547578 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for pure-ftpd fixes the following issues: - Add missing run-time dependency on system-user-ftp to ensure that user exits. [boo#1136997] - Add a configuration option that sets the process memory limit used by "ls" for globbing. The value can be specified as optional third argument to "-L" (or LimitRecursion in config file). Because it's optional, the old configuration files will still work without change with new binaries and update will be smooth. This change allows sites that store an extremely large set of files inside a single directory to tune their installation so that the "ls" command in that directory will succeed without exceeding the ftpd process memory limit. [boo#1119187] This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1784=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pure-ftpd-1.0.47-bp150.3.3.1 References: https://bugzilla.suse.com/1119187 https://bugzilla.suse.com/1136997 https://bugzilla.suse.com/547578

1 0

openSUSE-SU-2019:1782-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1782-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). mozilla-nss to version 3.44.1: * Added IPSEC IKE support to softoken * Many new FIPS test cases This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1782=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.44.1-lp151.2.3.1 libfreebl3-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-3.44.1-lp151.2.3.1 libsoftokn3-3.44.1-lp151.2.3.1 libsoftokn3-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-3.44.1-lp151.2.3.1 mozilla-nss-3.44.1-lp151.2.3.1 mozilla-nss-certs-3.44.1-lp151.2.3.1 mozilla-nss-certs-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debugsource-3.44.1-lp151.2.3.1 mozilla-nss-devel-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-tools-3.44.1-lp151.2.3.1 mozilla-nss-tools-debuginfo-3.44.1-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): MozillaFirefox-60.8.0-lp151.2.10.1 MozillaFirefox-branding-upstream-60.8.0-lp151.2.10.1 MozillaFirefox-buildsymbols-60.8.0-lp151.2.10.1 MozillaFirefox-debuginfo-60.8.0-lp151.2.10.1 MozillaFirefox-debugsource-60.8.0-lp151.2.10.1 MozillaFirefox-devel-60.8.0-lp151.2.10.1 MozillaFirefox-translations-common-60.8.0-lp151.2.10.1 MozillaFirefox-translations-other-60.8.0-lp151.2.10.1 libfreebl3-32bit-3.44.1-lp151.2.3.1 libfreebl3-32bit-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-debuginfo-3.44.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1781-1: important: Security update for bzip2
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for bzip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1781-1 Rating: important References: #1139083 Cross-References: CVE-2019-12900 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1781=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1781=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bzip2-1.0.6-lp151.5.6.1 bzip2-debuginfo-1.0.6-lp151.5.6.1 bzip2-debugsource-1.0.6-lp151.5.6.1 libbz2-1-1.0.6-lp151.5.6.1 libbz2-1-debuginfo-1.0.6-lp151.5.6.1 libbz2-devel-1.0.6-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libbz2-1-32bit-1.0.6-lp151.5.6.1 libbz2-1-32bit-debuginfo-1.0.6-lp151.5.6.1 libbz2-devel-32bit-1.0.6-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): bzip2-doc-1.0.6-lp151.5.6.1 - openSUSE Leap 15.0 (i586 x86_64): bzip2-1.0.6-lp150.4.6.1 bzip2-debuginfo-1.0.6-lp150.4.6.1 bzip2-debugsource-1.0.6-lp150.4.6.1 libbz2-1-1.0.6-lp150.4.6.1 libbz2-1-debuginfo-1.0.6-lp150.4.6.1 libbz2-devel-1.0.6-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): libbz2-1-32bit-1.0.6-lp150.4.6.1 libbz2-1-32bit-debuginfo-1.0.6-lp150.4.6.1 libbz2-devel-32bit-1.0.6-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): bzip2-doc-1.0.6-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1139083

1 0

openSUSE-RU-2019:1776-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1776-1 Rating: moderate References: #1140016 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for timezone fixes the following issues: Timezone database was updated to 2019b. (bsc#1140016): - Brazil no longer observes DST. - 'zic -b slim' outputs smaller TZif files. - Palestine's 2019 spring-forward transition was on 03-29, not 03-30. - Add info about the Crimea situation. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1776=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1776=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): timezone-2019b-lp151.2.3.1 timezone-debuginfo-2019b-lp151.2.3.1 timezone-debugsource-2019b-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): timezone-java-2019b-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): timezone-2019b-lp150.64.1 timezone-debuginfo-2019b-lp150.64.1 timezone-debugsource-2019b-lp150.64.1 References: https://bugzilla.suse.com/1140016

1 0

openSUSE-SU-2019:1777-1: moderate: Security update for expat
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1777-1 Rating: moderate References: #1139937 Cross-References: CVE-2018-20843 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for expat fixes the following issues: Security issue fixed: - CVE-2018-20843: Fixed a denial of service triggered by high resource consumption in the XML parser when XML names contain a large amount of colons (bsc#1139937). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1777=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1777=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): expat-2.2.5-lp151.3.3.1 expat-debuginfo-2.2.5-lp151.3.3.1 expat-debugsource-2.2.5-lp151.3.3.1 libexpat-devel-2.2.5-lp151.3.3.1 libexpat1-2.2.5-lp151.3.3.1 libexpat1-debuginfo-2.2.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): expat-32bit-debuginfo-2.2.5-lp151.3.3.1 libexpat-devel-32bit-2.2.5-lp151.3.3.1 libexpat1-32bit-2.2.5-lp151.3.3.1 libexpat1-32bit-debuginfo-2.2.5-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): expat-2.2.5-lp150.2.3.1 expat-debuginfo-2.2.5-lp150.2.3.1 expat-debugsource-2.2.5-lp150.2.3.1 libexpat-devel-2.2.5-lp150.2.3.1 libexpat1-2.2.5-lp150.2.3.1 libexpat1-debuginfo-2.2.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): expat-32bit-debuginfo-2.2.5-lp150.2.3.1 libexpat-devel-32bit-2.2.5-lp150.2.3.1 libexpat1-32bit-2.2.5-lp150.2.3.1 libexpat1-32bit-debuginfo-2.2.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20843.html https://bugzilla.suse.com/1139937

1 0

openSUSE-SU-2019:1780-1: moderate: Security update for clementine
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for clementine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1780-1 Rating: moderate References: #1103041 Cross-References: CVE-2018-14332 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for clementine fixes the following issues: - CVE-2018-14332: Fixed a NULL ptr dereference (crash) in the moodbar pipeline (boo#1103041) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1780=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1780=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1780=1 Package List: - openSUSE Leap 15.1 (x86_64): clementine-1.3.1-lp151.3.3.1 clementine-debuginfo-1.3.1-lp151.3.3.1 clementine-debugsource-1.3.1-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): clementine-1.3.1-lp150.2.3.1 clementine-debuginfo-1.3.1-lp150.2.3.1 clementine-debugsource-1.3.1-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): clementine-1.3.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14332.html https://bugzilla.suse.com/1103041

1 0

openSUSE-SU-2019:1775-1: important: Security update for znc
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for znc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1775-1 Rating: important References: #1130360 #1138572 Cross-References: CVE-2019-12816 CVE-2019-9917 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for znc to version 1.7.4 fixes the following issues: Security issues fixed: - CVE-2019-12816: Fixed a remote code execution in Modules.cpp (boo#1138572). - CVE-2019-9917: Fixed a denial of service on invalid encoding (boo#1130360). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1775=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1775=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1775=1 Package List: - openSUSE Leap 15.1 (x86_64): znc-1.7.4-lp151.2.3.1 znc-debuginfo-1.7.4-lp151.2.3.1 znc-debugsource-1.7.4-lp151.2.3.1 znc-devel-1.7.4-lp151.2.3.1 znc-perl-1.7.4-lp151.2.3.1 znc-perl-debuginfo-1.7.4-lp151.2.3.1 znc-python3-1.7.4-lp151.2.3.1 znc-python3-debuginfo-1.7.4-lp151.2.3.1 znc-tcl-1.7.4-lp151.2.3.1 znc-tcl-debuginfo-1.7.4-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): znc-lang-1.7.4-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): znc-lang-1.7.4-lp150.28.1 - openSUSE Leap 15.0 (x86_64): znc-1.7.4-lp150.28.1 znc-debuginfo-1.7.4-lp150.28.1 znc-debugsource-1.7.4-lp150.28.1 znc-devel-1.7.4-lp150.28.1 znc-perl-1.7.4-lp150.28.1 znc-perl-debuginfo-1.7.4-lp150.28.1 znc-python3-1.7.4-lp150.28.1 znc-python3-debuginfo-1.7.4-lp150.28.1 znc-tcl-1.7.4-lp150.28.1 znc-tcl-debuginfo-1.7.4-lp150.28.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): znc-1.7.4-bp150.2.6.1 znc-devel-1.7.4-bp150.2.6.1 znc-perl-1.7.4-bp150.2.6.1 znc-python3-1.7.4-bp150.2.6.1 znc-tcl-1.7.4-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): znc-lang-1.7.4-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12816.html https://www.suse.com/security/cve/CVE-2019-9917.html https://bugzilla.suse.com/1130360 https://bugzilla.suse.com/1138572

1 0

openSUSE-SU-2019:1771-1: important: Security update for ruby-bundled-gems-rpmhelper, ruby2.5
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for ruby-bundled-gems-rpmhelper, ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1771-1 Rating: important References: #1082007 #1082008 #1082009 #1082010 #1082011 #1082014 #1082058 #1087433 #1087434 #1087436 #1087437 #1087440 #1087441 #1112530 #1112532 #1130028 #1130611 #1130617 #1130620 #1130622 #1130623 #1130627 #1133790 Cross-References: CVE-2017-17742 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079 CVE-2018-16395 CVE-2018-16396 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 21 vulnerabilities and has two fixes is now available. Description: This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues: Changes in ruby2.5: Update to 2.5.5 and 2.5.4: https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed: - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed: - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1771=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1771=1 Package List: - openSUSE Leap 15.1 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp151.2.1 ruby2.5-doc-ri-2.5.5-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libruby2_5-2_5-2.5.5-lp151.4.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-2.5.5-lp151.4.3.1 ruby2.5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-debugsource-2.5.5-lp151.4.3.1 ruby2.5-devel-2.5.5-lp151.4.3.1 ruby2.5-devel-extra-2.5.5-lp151.4.3.1 ruby2.5-doc-2.5.5-lp151.4.3.1 ruby2.5-stdlib-2.5.5-lp151.4.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp150.2.1 ruby2.5-doc-ri-2.5.5-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libruby2_5-2_5-2.5.5-lp150.3.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-2.5.5-lp150.3.3.1 ruby2.5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-debugsource-2.5.5-lp150.3.3.1 ruby2.5-devel-2.5.5-lp150.3.3.1 ruby2.5-devel-extra-2.5.5-lp150.3.3.1 ruby2.5-doc-2.5.5-lp150.3.3.1 ruby2.5-stdlib-2.5.5-lp150.3.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-17742.html https://www.suse.com/security/cve/CVE-2018-1000073.html https://www.suse.com/security/cve/CVE-2018-1000074.html https://www.suse.com/security/cve/CVE-2018-1000075.html https://www.suse.com/security/cve/CVE-2018-1000076.html https://www.suse.com/security/cve/CVE-2018-1000077.html https://www.suse.com/security/cve/CVE-2018-1000078.html https://www.suse.com/security/cve/CVE-2018-1000079.html https://www.suse.com/security/cve/CVE-2018-16395.html https://www.suse.com/security/cve/CVE-2018-16396.html https://www.suse.com/security/cve/CVE-2018-6914.html https://www.suse.com/security/cve/CVE-2018-8777.html https://www.suse.com/security/cve/CVE-2018-8778.html https://www.suse.com/security/cve/CVE-2018-8779.html https://www.suse.com/security/cve/CVE-2018-8780.html https://www.suse.com/security/cve/CVE-2019-8320.html https://www.suse.com/security/cve/CVE-2019-8321.html https://www.suse.com/security/cve/CVE-2019-8322.html https://www.suse.com/security/cve/CVE-2019-8323.html https://www.suse.com/security/cve/CVE-2019-8324.html https://www.suse.com/security/cve/CVE-2019-8325.html https://bugzilla.suse.com/1082007 https://bugzilla.suse.com/1082008 https://bugzilla.suse.com/1082009 https://bugzilla.suse.com/1082010 https://bugzilla.suse.com/1082011 https://bugzilla.suse.com/1082014 https://bugzilla.suse.com/1082058 https://bugzilla.suse.com/1087433 https://bugzilla.suse.com/1087434 https://bugzilla.suse.com/1087436 https://bugzilla.suse.com/1087437 https://bugzilla.suse.com/1087440 https://bugzilla.suse.com/1087441 https://bugzilla.suse.com/1112530 https://bugzilla.suse.com/1112532 https://bugzilla.suse.com/1130028 https://bugzilla.suse.com/1130611 https://bugzilla.suse.com/1130617 https://bugzilla.suse.com/1130620 https://bugzilla.suse.com/1130622 https://bugzilla.suse.com/1130623 https://bugzilla.suse.com/1130627 https://bugzilla.suse.com/1133790

1 0

openSUSE-RU-2019:1772-1: moderate: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1772-1 Rating: moderate References: #1137264 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update ships the OpenJDK LTS version 11 in the java-11-openjdk packages. (FATE#326347 bsc#1137264) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1772=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1772=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.3.0-lp151.3.3.1 java-11-openjdk-accessibility-11.0.3.0-lp151.3.3.1 java-11-openjdk-accessibility-debuginfo-11.0.3.0-lp151.3.3.1 java-11-openjdk-debuginfo-11.0.3.0-lp151.3.3.1 java-11-openjdk-debugsource-11.0.3.0-lp151.3.3.1 java-11-openjdk-demo-11.0.3.0-lp151.3.3.1 java-11-openjdk-devel-11.0.3.0-lp151.3.3.1 java-11-openjdk-headless-11.0.3.0-lp151.3.3.1 java-11-openjdk-jmods-11.0.3.0-lp151.3.3.1 java-11-openjdk-src-11.0.3.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.3.0-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.3.0-lp150.2.22.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.3.0-lp150.2.22.1 java-11-openjdk-accessibility-11.0.3.0-lp150.2.22.1 java-11-openjdk-accessibility-debuginfo-11.0.3.0-lp150.2.22.1 java-11-openjdk-debuginfo-11.0.3.0-lp150.2.22.1 java-11-openjdk-debugsource-11.0.3.0-lp150.2.22.1 java-11-openjdk-demo-11.0.3.0-lp150.2.22.1 java-11-openjdk-devel-11.0.3.0-lp150.2.22.1 java-11-openjdk-headless-11.0.3.0-lp150.2.22.1 java-11-openjdk-jmods-11.0.3.0-lp150.2.22.1 java-11-openjdk-src-11.0.3.0-lp150.2.22.1 References: https://bugzilla.suse.com/1137264

1 0

openSUSE-RU-2019:1774-1: moderate: Recommended update for pure-ftpd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for pure-ftpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1774-1 Rating: moderate References: #1119187 #1136997 #547578 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for pure-ftpd fixes the following issues: - Add missing run-time dependency on system-user-ftp to ensure that user exits. [boo#1136997] - Add a configuration option that sets the process memory limit used by "ls" for globbing. The value can be specified as optional third argument to "-L" (or LimitRecursion in config file). Because it's optional, the old configuration files will still work without change with new binaries and update will be smooth. This change allows sites that store an extremely large set of files inside a single directory to tune their installation so that the "ls" command in that directory will succeed without exceeding the ftpd process memory limit. [boo#1119187] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1774=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1774=1 Package List: - openSUSE Leap 15.1 (x86_64): pure-ftpd-1.0.47-lp151.5.3.1 pure-ftpd-debuginfo-1.0.47-lp151.5.3.1 pure-ftpd-debugsource-1.0.47-lp151.5.3.1 - openSUSE Leap 15.0 (x86_64): pure-ftpd-1.0.47-lp150.2.3.1 pure-ftpd-debuginfo-1.0.47-lp150.2.3.1 pure-ftpd-debugsource-1.0.47-lp150.2.3.1 References: https://bugzilla.suse.com/1119187 https://bugzilla.suse.com/1136997 https://bugzilla.suse.com/547578

1 0

openSUSE-SU-2019:1773-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1773-1 Rating: moderate References: #1134689 #1138034 Cross-References: CVE-2019-10130 CVE-2019-10164 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034). - CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689). Bug fixes: - For a complete list of fixes check the release notes. * https://www.postgresql.org/docs/10/release-10-9.html * https://www.postgresql.org/docs/10/release-10-8.html * https://www.postgresql.org/docs/10/release-10-7.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1773=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1773=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libecpg6-10.9-lp151.2.3.1 libecpg6-debuginfo-10.9-lp151.2.3.1 libpq5-10.9-lp151.2.3.1 libpq5-debuginfo-10.9-lp151.2.3.1 postgresql10-10.9-lp151.2.3.1 postgresql10-contrib-10.9-lp151.2.3.1 postgresql10-contrib-debuginfo-10.9-lp151.2.3.1 postgresql10-debuginfo-10.9-lp151.2.3.1 postgresql10-debugsource-10.9-lp151.2.3.1 postgresql10-devel-10.9-lp151.2.3.1 postgresql10-devel-debuginfo-10.9-lp151.2.3.1 postgresql10-plperl-10.9-lp151.2.3.1 postgresql10-plperl-debuginfo-10.9-lp151.2.3.1 postgresql10-plpython-10.9-lp151.2.3.1 postgresql10-plpython-debuginfo-10.9-lp151.2.3.1 postgresql10-pltcl-10.9-lp151.2.3.1 postgresql10-pltcl-debuginfo-10.9-lp151.2.3.1 postgresql10-server-10.9-lp151.2.3.1 postgresql10-server-debuginfo-10.9-lp151.2.3.1 postgresql10-test-10.9-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): postgresql10-docs-10.9-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libecpg6-32bit-10.9-lp151.2.3.1 libecpg6-32bit-debuginfo-10.9-lp151.2.3.1 libpq5-32bit-10.9-lp151.2.3.1 libpq5-32bit-debuginfo-10.9-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.9-lp150.3.10.1 libecpg6-debuginfo-10.9-lp150.3.10.1 libpq5-10.9-lp150.3.10.1 libpq5-debuginfo-10.9-lp150.3.10.1 postgresql10-10.9-lp150.3.10.1 postgresql10-contrib-10.9-lp150.3.10.1 postgresql10-contrib-debuginfo-10.9-lp150.3.10.1 postgresql10-debuginfo-10.9-lp150.3.10.1 postgresql10-debugsource-10.9-lp150.3.10.1 postgresql10-devel-10.9-lp150.3.10.1 postgresql10-devel-debuginfo-10.9-lp150.3.10.1 postgresql10-plperl-10.9-lp150.3.10.1 postgresql10-plperl-debuginfo-10.9-lp150.3.10.1 postgresql10-plpython-10.9-lp150.3.10.1 postgresql10-plpython-debuginfo-10.9-lp150.3.10.1 postgresql10-pltcl-10.9-lp150.3.10.1 postgresql10-pltcl-debuginfo-10.9-lp150.3.10.1 postgresql10-server-10.9-lp150.3.10.1 postgresql10-server-debuginfo-10.9-lp150.3.10.1 postgresql10-test-10.9-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.9-lp150.3.10.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.9-lp150.3.10.1 libecpg6-32bit-debuginfo-10.9-lp150.3.10.1 libpq5-32bit-10.9-lp150.3.10.1 libpq5-32bit-debuginfo-10.9-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-10130.html https://www.suse.com/security/cve/CVE-2019-10164.html https://bugzilla.suse.com/1134689 https://bugzilla.suse.com/1138034

1 0

openSUSE-RU-2019:1761-1: moderate: Recommended update for gd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for gd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1761-1 Rating: moderate References: #1136574 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gd fixes the following issues: - Change order while installing splitted library. (bsc#1136574) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1761=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1761=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gd-2.2.5-lp151.6.3.1 gd-debuginfo-2.2.5-lp151.6.3.1 gd-debugsource-2.2.5-lp151.6.3.1 gd-devel-2.2.5-lp151.6.3.1 libgd3-2.2.5-lp151.6.3.1 libgd3-debuginfo-2.2.5-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): libgd3-32bit-2.2.5-lp151.6.3.1 libgd3-32bit-debuginfo-2.2.5-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): gd-2.2.5-lp150.11.1 gd-debuginfo-2.2.5-lp150.11.1 gd-debugsource-2.2.5-lp150.11.1 gd-devel-2.2.5-lp150.11.1 libgd3-2.2.5-lp150.11.1 libgd3-debuginfo-2.2.5-lp150.11.1 - openSUSE Leap 15.0 (x86_64): libgd3-32bit-2.2.5-lp150.11.1 libgd3-32bit-debuginfo-2.2.5-lp150.11.1 References: https://bugzilla.suse.com/1136574

1 0

openSUSE-SU-2019:1759-1: important: Security update for neovim
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1759-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: neovim was updated to version 0.3.7: * CVE-2019-12735: source should check sandbox (boo#1137443) * genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: * options: properly reset directories on 'autochdir' * Remove MSVC optimization workaround for SHM_ALL * Make SHM_ALL to a variable instead of a compound literal #define * doc: mention "pynvim" module rename * screen: don't crash when drawing popupmenu with 'rightleft' option * look-behind match may use the wrong line number * :terminal : set topline based on window height * :recover : Fix crash on non-existent *.swp Version Update to version 0.3.4: * test: add tests for conceal cursor movement * display: unify ursorline and concealcursor redraw logic Version Update to version 0.3.3: * health/provider: Check for available pynvim when neovim mod is missing * python#CheckForModule: Use the given module string instead of hard-coding pynvim * (health.provider)/python: Import the neovim, rather than pynvim, module * TUI: Konsole DECSCUSR fixup Version Update to version 0.3.2:- * Features - clipboard: support Custom VimL functions (#9304) - win/TUI: improve terminal/console support (#9401) - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077) - support mapping in more places (#9299) - diff/highlight: show underline for low-priority CursorLine (#9028) - signs: Add "nuhml" argument (#9113) - clipboard: support Wayland (#9230) - TUI: add support for undercurl and underline color (#9052) - man.vim: soft (dynamic) wrap (#9023) * API - API: implement object namespaces (#6920) - API: implement nvim_win_set_buf() (#9100) - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180) - API: add nvim_buf_is_loaded() (#8660) - API: nvm_buf_get_offset_for_line (#8221) - API/UI: ext_newgrid, ext_histate (#8221) * UI - TUI: use BCE again more often (smoother resize) (#8806) - screen: add missing status redraw when redraw_later(CLEAR) was used (#9315) - TUI: clip invalid regions on resize (#8779) - TUI: improvements for scrolling and clearing (#9193) - TUI: disable clearing almost everywhere (#9143) - TUI: always use safe cursor movement after resize (#9079) - ui_options: also send when starting or from OptionSet (#9211) - TUI: Avoid reset_color_cursor_color in old VTE (#9191) - Don't erase screen on :hi Normal during startup (#9021) - TUI: Hint wrapped lines to terminals (#8915) * FIXES - RPC: turn errors from async calls into notifications - TUI: Restore terminal title via "title stacking" (#9407) - genappimage: Unset $ARGV0 at invocation (#9376) - TUI: Konsole 18.07.70 supports DECSCUSR (#9364) - provider: improve error message (#9344) - runtime/syntax: Fix highlighting of autogroup contents (#9328) - VimL/confirm(): Show dialog even if :silent (#9297) - clipboard: prefer xclip (#9302) - provider/nodejs: fix npm, yarn detection - channel: avoid buffering output when only terminal is active (#9218) - ruby: detect rbenv shims for other versions (#8733) - third party/unibilium: Fix parsing of extended capabilitiy entries (#9123) - jobstart(): Fix hang on non-executable cwd (#9204) - provide/nodejs: Simultaneously query npm and yarn (#9054) - undo: Fix infinite loop if undo_read_byte returns EOF (#2880) - 'swapfile: always show dialog' (#9034) - Add to the system-wide configuration file extension of runtimepath by /usr/share/vim/site, so that neovim uses other Vim plugins installed from packages. - Add /usr/share/vim/site tree of directories to be owned by neovim as well. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1759=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1759=1 Package List: - openSUSE Leap 15.1 (x86_64): neovim-0.3.7-lp151.2.7.1 neovim-debuginfo-0.3.7-lp151.2.7.1 neovim-debugsource-0.3.7-lp151.2.7.1 - openSUSE Leap 15.1 (noarch): neovim-lang-0.3.7-lp151.2.7.1 - openSUSE Leap 15.0 (x86_64): neovim-0.3.7-lp150.13.1 neovim-debuginfo-0.3.7-lp150.13.1 neovim-debugsource-0.3.7-lp150.13.1 - openSUSE Leap 15.0 (noarch): neovim-lang-0.3.7-lp150.13.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443

1 0

openSUSE-SU-2019:1767-1: important: Security update for zeromq
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for zeromq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1767-1 Rating: important References: #1082318 #1140255 Cross-References: CVE-2019-13132 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for zeromq fixes the following issues: - CVE-2019-13132: An unauthenticated remote attacker could have exploited a stack overflow vulnerability on a server that is supposed to be protected by encryption and authentication to potentially gain a remote code execution. (bsc#1140255) - Correctly mark license files as licence instead of documentation (bsc#1082318) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1767=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1767=1 Package List: - openSUSE Leap 15.1 (x86_64): libzmq5-4.2.3-lp151.5.3.1 libzmq5-debuginfo-4.2.3-lp151.5.3.1 zeromq-debugsource-4.2.3-lp151.5.3.1 zeromq-devel-4.2.3-lp151.5.3.1 zeromq-tools-4.2.3-lp151.5.3.1 zeromq-tools-debuginfo-4.2.3-lp151.5.3.1 - openSUSE Leap 15.0 (x86_64): libzmq5-4.2.3-lp150.2.15.1 libzmq5-debuginfo-4.2.3-lp150.2.15.1 zeromq-debugsource-4.2.3-lp150.2.15.1 zeromq-devel-4.2.3-lp150.2.15.1 zeromq-tools-4.2.3-lp150.2.15.1 zeromq-tools-debuginfo-4.2.3-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2019-13132.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1140255

1 0

openSUSE-RU-2019:1769-1: moderate: Recommended update for python-relatorio
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for python-relatorio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1769-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-relatorio fixes the following issues: - python-magic added to requirements Update to version 0.8.1: * Add support for Python 3.7 * Escape invalid XML characters * Enforce closing tag to be the same directive as the opening * Use compression for zip file * Write mimetype as first file of the zip file Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1769=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1769=1 Package List: - openSUSE Leap 15.1 (noarch): python2-relatorio-0.8.1-lp151.3.3.1 python3-relatorio-0.8.1-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): python2-relatorio-0.8.1-lp150.2.3.1 python3-relatorio-0.8.1-lp150.2.3.1 References:

1 0

openSUSE-RU-2019:1762-1: moderate: Recommended update for perl-Tk
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for perl-Tk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1762-1 Rating: moderate References: #1134134 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Tk fixes the following issues: - Tk::Photo importer fails on some XPM files. (bsc#1134134) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1762=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1762=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): perl-Tk-804.034-lp151.3.3.1 perl-Tk-debuginfo-804.034-lp151.3.3.1 perl-Tk-debugsource-804.034-lp151.3.3.1 perl-Tk-devel-804.034-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): perl-Tk-804.034-lp150.2.3.1 perl-Tk-debuginfo-804.034-lp150.2.3.1 perl-Tk-debugsource-804.034-lp150.2.3.1 perl-Tk-devel-804.034-lp150.2.3.1 References: https://bugzilla.suse.com/1134134

1 0

openSUSE-SU-2019:1770-1: moderate: Security update for kernel-firmware
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1770-1 Rating: moderate References: #1136334 #1136498 #1139383 Cross-References: CVE-2019-9836 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for kernel-firmware fixes the following issues: kernel-firmware was updated to version 20190618: * cavium: Add firmware for CNN55XX crypto driver. * linux-firmware: Update firmware file for Intel Bluetooth 22161 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * linux-firmware: Update AMD SEV firmware (CVE-2019-9836, bsc#1139383) * linux-firmware: update licence text for Marvell firmware * linux-firmware: update firmware for mhdp8546 * linux-firmware: rsi: update firmware images for Redpine 9113 chipset * imx: sdma: update firmware to v3.5/v4.5 * nvidia: update GP10[2467] SEC2 RTOS with the one already used on GP108 * linux-firmware: Update firmware file for Intel Bluetooth 8265 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * amlogic: add video decoder firmwares * iwlwifi: update -46 firmwares for 22260 and 9000 series * iwlwifi: add firmware for 22260 and update 9000 series -46 firmwares * iwlwifi: add -46.ucode firmwares for 9000 series * amdgpu: update vega20 to the latest 19.10 firmware * amdgpu: update vega12 to the latest 19.10 firmware * amdgpu: update vega10 to the latest 19.10 firmware * amdgpu: update polaris11 to the latest 19.10 firmware * amdgpu: update polaris10 to the latest 19.10 firmware * amdgpu: update raven2 to the latest 19.10 firmware * amdgpu: update raven to the latest 19.10 firmware * amdgpu: update picasso to the latest 19.10 firmware * linux-firmware: update fw for qat devices * Mellanox: Add new mlxsw_spectrum firmware 13.2000.1122 * drm/i915/firmware: Add ICL HuC v8.4.3238 * drm/i915/firmware: Add ICL GuC v32.0.3 * drm/i915/firmware: Add GLK HuC v03.01.2893 * drm/i915/firmware: Add GLK GuC v32.0.3 * drm/i915/firmware: Add KBL GuC v32.0.3 * drm/i915/firmware: Add SKL GuC v32.0.3 * drm/i915/firmware: Add BXT GuC v32.0.3 * linux-firmware: Add firmware file for Intel Bluetooth 22161 * cxgb4: update firmware to revision 1.23.4.0 (bsc#1136334) * linux-firmware: Update NXP Management Complex firmware to version 10.14.3 * linux-firmware: add firmware for MT7615E * mediatek: update MT8173 VPU firmware to v1.1.2 [decoder] Enlarge struct vdec_pic_info to support more capture buffer plane and capture buffer format change. * linux-firmware: update Marvell 8797/8997 firmware images * nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.23 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1770=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1770=1 Package List: - openSUSE Leap 15.1 (noarch): kernel-firmware-20190618-lp151.2.6.1 ucode-amd-20190618-lp151.2.6.1 - openSUSE Leap 15.0 (noarch): kernel-firmware-20190618-lp150.2.19.1 ucode-amd-20190618-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-9836.html https://bugzilla.suse.com/1136334 https://bugzilla.suse.com/1136498 https://bugzilla.suse.com/1139383

1 0