July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1714-1: moderate: Recommended update for gitlint
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for gitlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1714-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gitlint fixes the following issues: Update to v0.11.0: * make it work with openSUSE Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1714=1 Package List: - openSUSE Leap 15.1 (noarch): python2-gitlint-0.11.0-lp151.3.3.1 python3-gitlint-0.11.0-lp151.3.3.1 References:

1 0

openSUSE-RU-2019:1711-1: moderate: Recommended update for dolphin
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for dolphin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1711-1 Rating: moderate References: #1139359 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dolphin fixes the following issues: - Updated Lithuanian translations (boo#1139359). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1711=1 Package List: - openSUSE Leap 15.1 (x86_64): dolphin-18.12.3-lp151.2.4.1 dolphin-debuginfo-18.12.3-lp151.2.4.1 dolphin-debugsource-18.12.3-lp151.2.4.1 dolphin-devel-18.12.3-lp151.2.4.1 dolphin-part-18.12.3-lp151.2.4.1 dolphin-part-debuginfo-18.12.3-lp151.2.4.1 libdolphinvcs5-18.12.3-lp151.2.4.1 libdolphinvcs5-debuginfo-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (noarch): dolphin-part-lang-18.12.3-lp151.2.4.1 References: https://bugzilla.suse.com/1139359

1 0

openSUSE-SU-2019:1721-1: important: Security update for bubblewrap
by opensuse-security＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Security Update: Security update for bubblewrap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1721-1 Rating: important References: #1136958 Cross-References: CVE-2019-12439 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bubblewrap fixes the following issues: Security issue fixed: - CVE-2019-12439: Fixed insecure use of /tmp (bsc#1136958). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1721=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bubblewrap-0.2.0-lp150.2.3.1 bubblewrap-debuginfo-0.2.0-lp150.2.3.1 bubblewrap-debugsource-0.2.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12439.html https://bugzilla.suse.com/1136958

1 0

openSUSE-SU-2019:1716-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1716-1 Rating: important References: #1051510 #1071995 #1088047 #1094555 #1098633 #1106383 #1106751 #1109137 #1114279 #1119532 #1120423 #1124167 #1127155 #1128902 #1128910 #1131645 #1132154 #1132390 #1133401 #1133738 #1134303 #1134395 #1135296 #1135556 #1135642 #1136157 #1136935 #1137103 #1137194 #1137625 #1137728 #1137884 #1138589 #1138719 #1139771 #1139782 #1139865 #1140133 #1140328 #1140405 #1140424 #1140428 #1140575 #1140577 #1140637 #1140658 #1140715 #1140719 #1140726 #1140727 #1140728 #1140814 Cross-References: CVE-2018-16871 CVE-2018-20836 CVE-2019-10126 CVE-2019-10638 CVE-2019-10639 CVE-2019-11599 CVE-2019-12614 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 45 fixes is now available. Description: The openSUSE Leap 15.0 was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-10638: A device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses (bnc#1140575). - CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace (bnc#1140577). - CVE-2018-20836: There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395). - CVE-2019-10126: A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences (bnc#1136935). - CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c (bnc#1131645 1133738). - CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c where there was an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194). - CVE-2018-16871: A flaw was found in NFS where an attacker who is able to mount an exported NFS filesystem was able to trigger a null pointer dereference by an invalid NFS sequence. (bnc#1137103). The following non-security bugs were fixed: - 6lowpan: Off by one handling ->nexthdr (bsc#1051510). - added De0-Nanos-SoC board support (and others based on Altera SOC). - Add sample kernel-default-base spec file (FATE#326579, jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - Add sample kernel-default-base spec file (jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - af_key: unconditionally clone on broadcast (bsc#1051510). - alsa: firewire-lib/fireworks: fix miss detection of received MIDI messages (bsc#1051510). - alsa: hda - Force polling mode on CNL for fixing codec communication (bsc#1051510). - alsa: hda/realtek: Add quirks for several Clevo notebook barebones (bsc#1051510). - alsa: hda/realtek - Change front mic location for Lenovo M710q (bsc#1051510). - alsa: line6: Fix write on zero-sized buffer (bsc#1051510). - alsa: seq: fix incorrect order of dest_client/dest_ports arguments (bsc#1051510). - alsa: usb-audio: fix sign unintended sign extension on left shifts (bsc#1051510). - apparmor: enforce nullbyte at end of tag string (bsc#1051510). - audit: fix a memory leak bug (bsc#1051510). - ax25: fix inconsistent lock state in ax25_destroy_timer (bsc#1051510). - blk-mq: free hw queue's resource in hctx's release handler (bsc#1140637). - block: Fix a NULL pointer dereference in generic_make_request() (bsc#1139771). - bluetooth: Fix faulty expression for minimum encryption key size check (bsc#1140328). - can: af_can: Fix error path of can_init() (bsc#1051510). - can: flexcan: fix timeout when set small bitrate (bsc#1051510). - can: purge socket error queue on sock destruct (bsc#1051510). - ceph: flush dirty inodes before proceeding with remount (bsc#1140405). - cfg80211: fix memory leak of wiphy device name (bsc#1051510). - clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288 (bsc#1051510). - clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider (bsc#1051510). - coresight: etb10: Fix handling of perf mode (bsc#1051510). - coresight: etm4x: Add support to enable ETMv4.2 (bsc#1051510). - cpu/topology: Export die_id (jsc#SLE-5454). - crypto: algapi - guard against uninitialized spawn list in crypto_remove_spawns (bsc#1133401). - crypto: cryptd - Fix skcipher instance memory leak (bsc#1051510). - crypto: user - prevent operating on larval algorithms (bsc#1133401). - device core: Consolidate locking and unlocking of parent and device (bsc#1106383). - dmaengine: imx-sdma: remove BD_INTR for channel0 (bsc#1051510). - dm, dax: Fix detection of DAX support (bsc#1139782). - doc: Cope with the deprecation of AutoReporter (bsc#1051510). - Do not provide kernel-default from kernel-default-base (boo#1132154, bsc#1106751). - Do not provide kernel-default-srchash from kernel-default-base. - Do not restrict NFSv4.2 on openSUSE (bsc#1138719). - driver core: Establish order of operations for device_add and device_del via bitflag (bsc#1106383). - driver core: Probe devices asynchronously instead of the driver (bsc#1106383). - drivers/base: Introduce kill_device() (bsc#1139865). - drivers/base: kABI fixes for struct device_private (bsc#1106383). - drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var (bsc#1051510). - drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' (bsc#1051510). - drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() (bsc#1051510). - drivers: thermal: tsens: Do not print error message on -EPROBE_DEFER (bsc#1051510). - drm/arm/hdlcd: Allow a bit of clock tolerance (bsc#1051510). - drm/i915/gvt: ignore unexpected pvinfo write (bsc#1051510). - EDAC/mc: Fix edac_mc_find() in case no device is found (bsc#1114279). - ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code() (bsc#1071995). - ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code() (bsc#1071995 fate#323487). - genirq: Prevent use-after-free and work list corruption (bsc#1051510). - genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent() (bsc#1051510). - genwqe: Prevent an integer overflow in the ioctl (bsc#1051510). - hwmon/coretemp: Cosmetic: Rename internal variables to zones from packages (jsc#SLE-5454). - hwmon/coretemp: Support multi-die/package (jsc#SLE-5454). - hwmon: (k10temp) 27C Offset needed for Threadripper2 (FATE#327735). - hwmon: (k10temp) Add Hygon Dhyana support (FATE#327735). - hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics (FATE#327735). - hwmon: (k10temp) Add support for family 17h (FATE#327735). - hwmon: (k10temp) Add support for Stoney Ridge and Bristol Ridge CPUs (FATE#327735). - hwmon: (k10temp) Add support for temperature offsets (FATE#327735). - hwmon: (k10temp) Add temperature offset for Ryzen 1900X (FATE#327735). - hwmon: (k10temp) Add temperature offset for Ryzen 2700X (FATE#327735). - hwmon: (k10temp) Correct model name for Ryzen 1600X (FATE#327735). - hwmon: (k10temp) Display both Tctl and Tdie (FATE#327735). - hwmon: (k10temp) Fix reading critical temperature register (FATE#327735). - hwmon: (k10temp) Make function get_raw_temp static (FATE#327735). - hwmon: (k10temp) Move chip specific code into probe function (FATE#327735). - hwmon: (k10temp) Only apply temperature offset if result is positive (FATE#327735). - hwmon: (k10temp) Support all Family 15h Model 6xh and Model 7xh processors (FATE#327735). - hwmon: k10temp: Support Threadripper 2920X, 2970WX; simplify offset table (FATE#327735). - hwmon: (k10temp) Use API function to access System Management Network (FATE#327735). - hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs (). - hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs (FATE#327735). - i2c: acorn: fix i2c warning (bsc#1135642). - i2c-piix4: Add Hygon Dhyana SMBus support (FATE#327735). - ibmveth: Update ethtool settings to reflect virtual properties (bsc#1136157, LTC#177197). - input: synaptics - enable SMBus on ThinkPad E480 and E580 (bsc#1051510). - input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD (bsc#1051510). - Install extra rpm scripts for kernel subpackaging (FATE#326579, jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - Install extra rpm scripts for kernel subpackaging (jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - kabi fixup blk_mq_register_dev() (bsc#1140637). - kabi: x86/topology: Add CPUID.1F multi-die/package support (jsc#SLE-5454). - kabi: x86/topology: Define topology_logical_die_id() (jsc#SLE-5454). - kvm: x86: Include CPUID leaf 0x8000001e in kvm's supported CPUID (bsc#1114279). - kvm: x86: Include multiple indices with CPUID leaf 0x8000001d (bsc#1114279). - libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk (bsc#1051510). - libnvdimm/bus: Prevent duplicate device_unregister() calls (bsc#1139865). - libnvdimm, pfn: Fix over-trim in trim_pfn_device() (bsc#1140719). - mac80211: Do not use stack memory with scatterlist for GMAC (bsc#1051510). - mac80211: drop robust management frames from unknown TA (bsc#1051510). - mac80211: handle deauthentication/disassociation from TDLS peer (bsc#1051510). - media: v4l2-ioctl: clear fields in s_parm (bsc#1051510). - mISDN: make sure device name is NUL terminated (bsc#1051510). - mmc: core: Prevent processing SDIO IRQs when the card is suspended (bsc#1051510). - module: Fix livepatch/ftrace module text permissions race (bsc#1071995). - module: Fix livepatch/ftrace module text permissions race (bsc#1071995 fate#323487). - net: mvpp2: prs: Fix parser range for VID filtering (bsc#1098633). - net: mvpp2: prs: Use the correct helpers when removing all VID filters (bsc#1098633). - net: mvpp2: Use strscpy to handle stat strings (bsc#1098633). - nfit/ars: Allow root to busy-poll the ARS state machine (bsc#1140814). - nfit/ars: Avoid stale ARS results (jsc#SLE-5433). - nfit/ars: Introduce scrub_flags (jsc#SLE-5433). - ntp: Allow TAI-UTC offset to be set to zero (bsc#1135642). - nvme: copy MTFA field from identify controller (bsc#1140715). - nvme-rdma: fix double freeing of async event data (bsc#1120423). - nvme-rdma: fix possible double free of controller async event buffer (bsc#1120423). - ocfs2: try to reuse extent block in dealloc without meta_alloc (bsc#1128902). - pci: PM: Skip devices in D0 for suspend-to-idle (bsc#1051510). - pci: rpadlpar: Fix leaked device_node references in add/remove paths (bsc#1051510). - perf/x86/intel/cstate: Support multi-die/package (jsc#SLE-5454). - perf/x86/intel/rapl: Cosmetic rename internal variables in response to multi-die/pkg support (jsc#SLE-5454). - perf/x86/intel/rapl: Support multi-die/package (jsc#SLE-5454). - perf/x86/intel/uncore: Cosmetic renames in response to multi-die/pkg support (jsc#SLE-5454). - perf/x86/intel/uncore: Support multi-die/package (jsc#SLE-5454). - powercap/intel_rapl: Simplify rapl_find_package() (jsc#SLE-5454). - powercap/intel_rapl: Support multi-die/package (jsc#SLE-5454). - powercap/intel_rapl: Update RAPL domain name and debug messages (jsc#SLE-5454). - powerpc/perf: Add PM_LD_MISS_L1 and PM_BR_2PATH to power9 event list (bsc#1137728, LTC#178106). - powerpc/perf: Add POWER9 alternate PM_RUN_CYC and PM_RUN_INST_CMPL events (bsc#1137728, LTC#178106). - powerpc/rtas: retry when cpu offline races with suspend/migration (bsc#1140428, LTC#178808). - ppp: mppe: Add softdep to arc4 (bsc#1088047). - qmi_wwan: add network device usage statistics for qmimux devices (bsc#1051510). - qmi_wwan: add support for QMAP padding in the RX path (bsc#1051510). - qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode (bsc#1051510). - qmi_wwan: extend permitted QMAP mux_id value range (bsc#1051510). - rapidio: fix a NULL pointer dereference when create_workqueue() fails (bsc#1051510). - ras/CEC: Convert the timer callback to a workqueue (bsc#1114279). - ras/CEC: Fix binary search function (bsc#1114279). - Refresh patches.fixes/scsi-Introduce-scsi_start_queue.patch (bsc#1119532). - Remove the previous subpackage infrastructure. This partially reverts commit 9b3ca32c11854156b2f950ff5e26131377d8445e ("Add kernel-subpackage-build.spec (FATE#326579).") - Replace the bluetooth fix with the upstream commit (bsc#1135556) - Revert "Drop multiversion(kernel) from the KMP template ()" (bsc#1109137). - Revert "Drop multiversion(kernel) from the KMP template (fate#323189)" (bsc#1109137). This reverts commit 71504d805c1340f68715ad41958e5ef35da2c351. - Revert "KMPs: obsolete older KMPs of the same flavour (bsc#1127155, bsc#1109137)." - Revert "KMPs: provide and conflict a kernel version specific KMP name" - Revert "Revert "Drop multiversion(kernel) from the KMP template ()"" - Revert "Revert "Drop multiversion(kernel) from the KMP template (fate#323189)"" This feature was requested for SLE15 but aws reverted in packaging and master. - Revert "s390/jump_label: Use "jdd" constraint on gcc9 (bsc#1138589)." - Revert "Sign non-x86 kernels when possible (boo#1134303)" This reverts commit bac621c6704610562ebd9e74ae5ad85ca8025681. - Revert "svm: Fix AVIC incomplete IPI emulation" (bsc#1140133). - rpm: Add arm64 dtb-allwinner subpackage 4.10 added arch/arm64/boot/dts/allwinner/. - rpm: Add arm64 dtb-zte subpackage 4.9 added arch/arm64/boot/dts/zte/. - rpm/kernel-binary.spec.in: Add back kernel-binary-base subpackage (jsc#SLE-3853). - rpm/kernel-binary.spec.in: Build livepatch support in SUSE release projects (bsc#1124167). - rpm/kernel-subpackage-build: handle arm kernel zImage. - rpm/kernel-subpackage-spec: only provide firmware actually present in subpackage. - rpm/package-descriptions: fix typo in kernel-azure - rpm/post.sh: correct typo in err msg (bsc#1137625) - s390/dasd: fix using offset into zero size array error (bsc#1051510). - s390/jump_label: Use "jdd" constraint on gcc9 (bsc#1138589). - s390/qeth: fix race when initializing the IP address table (bsc#1051510). - s390/qeth: fix VLAN attribute in bridge_hostnotify udev event (bsc#1051510). - s390/setup: fix early warning messages (bsc#1051510). - s390/virtio: handle find on invalid queue gracefully (bsc#1051510). - sbitmap: fix improper use of smp_mb__before_atomic() (bsc#1140658). - scripts/git_sort/git_sort.py: add djbw/nvdimm nvdimm-pending. - scripts/git_sort/git_sort.py: add nvdimm/libnvdimm-fixes - scsi: core: add new RDAC LENOVO/DE_Series device (bsc#1132390). - scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() (bsc#1140727). - scsi: qla2xxx: Fix FC-AL connection target discovery (bsc#1094555). - scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines (bsc#1140728). - scsi: qla2xxx: Fix N2N target discovery with Local loop (bsc#1094555). - scsi: target/iblock: Fix overrun in WRITE SAME emulation (bsc#1140424). - scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() (bsc#1135296). - scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove (bsc#1051510). - scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host (bsc#1051510). - scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices (bsc#1051510). - scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs) (bsc#1051510). - smb3: Fix endian warning (bsc#1137884). - soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher (bsc#1051510). - soc: rockchip: Set the proper PWM for rk3288 (bsc#1051510). - staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest (bsc#1051510). - svm: Add warning message for AVIC IPI invalid target (bsc#1140133). - svm: Fix AVIC incomplete IPI emulation (bsc#1140133). - sysctl: handle overflow in proc_get_long (bsc#1051510). - thermal: rcar_gen3_thermal: disable interrupt in .remove (bsc#1051510). - thermal/x86_pkg_temp_thermal: Cosmetic: Rename internal variables to zones from packages (jsc#SLE-5454). - thermal/x86_pkg_temp_thermal: Support multi-die/package (jsc#SLE-5454). - tmpfs: fix link accounting when a tmpfile is linked in (bsc#1051510). - tmpfs: fix uninitialized return value in shmem_link (bsc#1051510). - topology: Create core_cpus and die_cpus sysfs attributes (jsc#SLE-5454). - topology: Create package_cpus sysfs attribute (jsc#SLE-5454). - tracing/snapshot: Resize spare buffer if size changed (bsc#1140726). - Trim build dependencies of sample subpackage spec file (FATE#326579, jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - Trim build dependencies of sample subpackage spec file (jsc#SLE-4117, jsc#SLE-3853, bsc#1128910). - tty: max310x: Fix external crystal register setup (bsc#1051510). - usb: chipidea: udc: workaround for endpoint conflict issue (bsc#1135642). - usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression) (bsc#1135642). - usb: Fix chipmunk-like voice when using Logitech C270 for recording audio (bsc#1051510). - usbnet: ipheth: fix racing condition (bsc#1051510). - usb: serial: fix initial-termios handling (bsc#1135642). - usb: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode (bsc#1051510). - usb: serial: option: add Telit 0x1260 and 0x1261 compositions (bsc#1051510). - usb: serial: pl2303: add Allied Telesis VT-Kit3 (bsc#1051510). - usb: serial: pl2303: fix tranceiver suspend mode (bsc#1135642). - usb: usb-storage: Add new ID to ums-realtek (bsc#1051510). - usb: xhci: avoid null pointer deref when bos field is NULL (bsc#1135642). - vfio: ccw: only free cp on final interrupt (bsc#1051510). - vlan: disable SIOCSHWTSTAMP in container (bsc#1051510). - x86/amd_nb: Add support for Raven Ridge CPUs (). - x86/amd_nb: Add support for Raven Ridge CPUs (FATE#327735). - x86/CPU/AMD: Do not force the CPB cap when running under a hypervisor (bsc#1114279). - x86/cpufeatures: Carve out CQM features retrieval (jsc#SLE-5382). - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (jsc#SLE-5382). - x86/cpufeatures: Enumerate the new AVX512 BFLOAT16 instructions (jsc#SLE-5382). - x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors (). - x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors (fate#327735). - x86/mce: Fix machine_check_poll() tests for error types (bsc#1114279). - x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback (bsc#1114279). - x86/microcode: Fix microcode hotplug state (bsc#1114279). - x86/microcode: Fix the ancient deprecated microcode loading method (bsc#1114279). - x86/mm/mem_encrypt: Disable all instrumentation for early SME setup (bsc#1114279). - x86/smpboot: Rename match_die() to match_pkg() (jsc#SLE-5454). - x86/speculation/mds: Revert CPU buffer clear on double fault exit (bsc#1114279). - x86/topology: Add CPUID.1F multi-die/package support (jsc#SLE-5454). - x86/topology: Create topology_max_die_per_package() (jsc#SLE-5454). - x86/topology: Define topology_die_id() (jsc#SLE-5454). - x86/topology: Define topology_logical_die_id() (jsc#SLE-5454). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1716=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-devel-4.12.14-lp150.12.67.1 kernel-docs-4.12.14-lp150.12.67.1 kernel-docs-html-4.12.14-lp150.12.67.1 kernel-macros-4.12.14-lp150.12.67.1 kernel-source-4.12.14-lp150.12.67.1 kernel-source-vanilla-4.12.14-lp150.12.67.1 - openSUSE Leap 15.0 (x86_64): kernel-debug-4.12.14-lp150.12.67.1 kernel-debug-base-4.12.14-lp150.12.67.1 kernel-debug-base-debuginfo-4.12.14-lp150.12.67.1 kernel-debug-debuginfo-4.12.14-lp150.12.67.1 kernel-debug-debugsource-4.12.14-lp150.12.67.1 kernel-debug-devel-4.12.14-lp150.12.67.1 kernel-debug-devel-debuginfo-4.12.14-lp150.12.67.1 kernel-default-4.12.14-lp150.12.67.1 kernel-default-base-4.12.14-lp150.12.67.1 kernel-default-base-debuginfo-4.12.14-lp150.12.67.1 kernel-default-debuginfo-4.12.14-lp150.12.67.1 kernel-default-debugsource-4.12.14-lp150.12.67.1 kernel-default-devel-4.12.14-lp150.12.67.1 kernel-default-devel-debuginfo-4.12.14-lp150.12.67.1 kernel-kvmsmall-4.12.14-lp150.12.67.1 kernel-kvmsmall-base-4.12.14-lp150.12.67.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.67.1 kernel-kvmsmall-debuginfo-4.12.14-lp150.12.67.1 kernel-kvmsmall-debugsource-4.12.14-lp150.12.67.1 kernel-kvmsmall-devel-4.12.14-lp150.12.67.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.67.1 kernel-obs-build-4.12.14-lp150.12.67.1 kernel-obs-build-debugsource-4.12.14-lp150.12.67.1 kernel-obs-qa-4.12.14-lp150.12.67.1 kernel-syms-4.12.14-lp150.12.67.1 kernel-vanilla-4.12.14-lp150.12.67.1 kernel-vanilla-base-4.12.14-lp150.12.67.1 kernel-vanilla-base-debuginfo-4.12.14-lp150.12.67.1 kernel-vanilla-debuginfo-4.12.14-lp150.12.67.1 kernel-vanilla-debugsource-4.12.14-lp150.12.67.1 kernel-vanilla-devel-4.12.14-lp150.12.67.1 kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.67.1 References: https://www.suse.com/security/cve/CVE-2018-16871.html https://www.suse.com/security/cve/CVE-2018-20836.html https://www.suse.com/security/cve/CVE-2019-10126.html https://www.suse.com/security/cve/CVE-2019-10638.html https://www.suse.com/security/cve/CVE-2019-10639.html https://www.suse.com/security/cve/CVE-2019-11599.html https://www.suse.com/security/cve/CVE-2019-12614.html https://bugzilla.suse.com/1051510 https://bugzilla.suse.com/1071995 https://bugzilla.suse.com/1088047 https://bugzilla.suse.com/1094555 https://bugzilla.suse.com/1098633 https://bugzilla.suse.com/1106383 https://bugzilla.suse.com/1106751 https://bugzilla.suse.com/1109137 https://bugzilla.suse.com/1114279 https://bugzilla.suse.com/1119532 https://bugzilla.suse.com/1120423 https://bugzilla.suse.com/1124167 https://bugzilla.suse.com/1127155 https://bugzilla.suse.com/1128902 https://bugzilla.suse.com/1128910 https://bugzilla.suse.com/1131645 https://bugzilla.suse.com/1132154 https://bugzilla.suse.com/1132390 https://bugzilla.suse.com/1133401 https://bugzilla.suse.com/1133738 https://bugzilla.suse.com/1134303 https://bugzilla.suse.com/1134395 https://bugzilla.suse.com/1135296 https://bugzilla.suse.com/1135556 https://bugzilla.suse.com/1135642 https://bugzilla.suse.com/1136157 https://bugzilla.suse.com/1136935 https://bugzilla.suse.com/1137103 https://bugzilla.suse.com/1137194 https://bugzilla.suse.com/1137625 https://bugzilla.suse.com/1137728 https://bugzilla.suse.com/1137884 https://bugzilla.suse.com/1138589 https://bugzilla.suse.com/1138719 https://bugzilla.suse.com/1139771 https://bugzilla.suse.com/1139782 https://bugzilla.suse.com/1139865 https://bugzilla.suse.com/1140133 https://bugzilla.suse.com/1140328 https://bugzilla.suse.com/1140405 https://bugzilla.suse.com/1140424 https://bugzilla.suse.com/1140428 https://bugzilla.suse.com/1140575 https://bugzilla.suse.com/1140577 https://bugzilla.suse.com/1140637 https://bugzilla.suse.com/1140658 https://bugzilla.suse.com/1140715 https://bugzilla.suse.com/1140719 https://bugzilla.suse.com/1140726 https://bugzilla.suse.com/1140727 https://bugzilla.suse.com/1140728 https://bugzilla.suse.com/1140814

1 0

openSUSE-SU-2019:1723-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1723-1 Rating: moderate References: #1139924 Cross-References: CVE-2019-0199 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat to version 9.0.21 fixes the following issues: Security issue fixed: - CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1723=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.21-lp150.2.22.1 tomcat-admin-webapps-9.0.21-lp150.2.22.1 tomcat-docs-webapp-9.0.21-lp150.2.22.1 tomcat-el-3_0-api-9.0.21-lp150.2.22.1 tomcat-embed-9.0.21-lp150.2.22.1 tomcat-javadoc-9.0.21-lp150.2.22.1 tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1 tomcat-jsvc-9.0.21-lp150.2.22.1 tomcat-lib-9.0.21-lp150.2.22.1 tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1 tomcat-webapps-9.0.21-lp150.2.22.1 References: https://www.suse.com/security/cve/CVE-2019-0199.html https://bugzilla.suse.com/1139924

1 0

openSUSE-RU-2019:1715-1: moderate: Recommended update for spectacle
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for spectacle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1715-1 Rating: moderate References: #1139359 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spectacle fixes the following issues: - Updated Lithuanian translations (boo#1139359). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1715=1 Package List: - openSUSE Leap 15.1 (x86_64): spectacle-18.12.3-lp151.2.4.1 spectacle-debuginfo-18.12.3-lp151.2.4.1 spectacle-debugsource-18.12.3-lp151.2.4.1 spectacle-doc-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (noarch): spectacle-lang-18.12.3-lp151.2.4.1 References: https://bugzilla.suse.com/1139359

1 0

openSUSE-SU-2019:1708-1: moderate: Security update for libu2f-host, pam_u2f
by opensuse-security＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Security Update: Security update for libu2f-host, pam_u2f ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1708-1 Rating: moderate References: #1128140 #1135727 #1135729 Cross-References: CVE-2019-12209 CVE-2019-12210 CVE-2019-9578 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues: Security issues fixed for libu2f-host: - CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140). Security issues fixed for pam_u2f: - CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729). - CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1708=1 Package List: - openSUSE Leap 15.1 (x86_64): libu2f-host-debuginfo-1.1.6-lp151.2.6.1 libu2f-host-debugsource-1.1.6-lp151.2.6.1 libu2f-host-devel-1.1.6-lp151.2.6.1 libu2f-host-doc-1.1.6-lp151.2.6.1 libu2f-host0-1.1.6-lp151.2.6.1 libu2f-host0-debuginfo-1.1.6-lp151.2.6.1 pam_u2f-1.0.8-lp151.2.3.1 pam_u2f-debuginfo-1.0.8-lp151.2.3.1 pam_u2f-debugsource-1.0.8-lp151.2.3.1 u2f-host-1.1.6-lp151.2.6.1 u2f-host-debuginfo-1.1.6-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12209.html https://www.suse.com/security/cve/CVE-2019-12210.html https://www.suse.com/security/cve/CVE-2019-9578.html https://bugzilla.suse.com/1128140 https://bugzilla.suse.com/1135727 https://bugzilla.suse.com/1135729

1 0

openSUSE-RU-2019:1712-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1712-1 Rating: moderate References: #1104595 #1139359 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for kio fixes the following issues: - Updated translations for da eu gl id ja ko lt nn pa pl pt_BR ru sk languages based on KDE Frameworks 5.59 translations - Add upstream patch to fix downloaded files (via http) getting an "invalid" modification time (boo#1104595, kde#374420) - Updated Lithuanian translations, the included ones KDE Frameworks 5.55 were rather incomplete (boo#1139359). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1712=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): kio-5.55.0-lp151.3.3.1 kio-core-5.55.0-lp151.3.3.1 kio-core-debuginfo-5.55.0-lp151.3.3.1 kio-debuginfo-5.55.0-lp151.3.3.1 kio-debugsource-5.55.0-lp151.3.3.1 kio-devel-5.55.0-lp151.3.3.1 kio-devel-debuginfo-5.55.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): kio-lang-5.55.0-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): kio-32bit-5.55.0-lp151.3.3.1 kio-32bit-debuginfo-5.55.0-lp151.3.3.1 kio-core-32bit-5.55.0-lp151.3.3.1 kio-core-32bit-debuginfo-5.55.0-lp151.3.3.1 kio-devel-32bit-5.55.0-lp151.3.3.1 kio-devel-32bit-debuginfo-5.55.0-lp151.3.3.1 References: https://bugzilla.suse.com/1104595 https://bugzilla.suse.com/1139359

1 0

openSUSE-RU-2019:1713-1: moderate: Recommended update for clustduct
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for clustduct ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1713-1 Rating: moderate References: #1138296 #1138326 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for clustduct fixes the following issues: Updated to version v0.0.4 which includes several fixes (boo#1138326, boo#1138296): * description * option handling * renamed kiwi description Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1713=1 Package List: - openSUSE Leap 15.1 (x86_64): clustduct-0.0.4-lp151.2.3.1 References: https://bugzilla.suse.com/1138296 https://bugzilla.suse.com/1138326

1 0

openSUSE-RU-2019:1724-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 19 Jul '19

19 Jul '19

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1724-1 Rating: moderate References: #1133594 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvme-cli provides the following fixes: - Increase size of ONTAP namespace path variable. - Fix failing service on devices without fc-hardware. (bsc#1133594) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1724=1 Package List: - openSUSE Leap 15.1 (x86_64): nvme-cli-1.7-lp151.5.3.1 nvme-cli-debuginfo-1.7-lp151.5.3.1 nvme-cli-debugsource-1.7-lp151.5.3.1 References: https://bugzilla.suse.com/1133594

1 0

openSUSE-RU-2019:1704-1: moderate: Recommended update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula
by maintenance＠opensuse.org 15 Jul '19

15 Jul '19

openSUSE Recommended Update: Recommended update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1704-1 Rating: moderate References: #1137989 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula fixes the following issues: Changes in saphanabootstrap-formula: - Create package version 0.2.1. (boo#1137989, jsc#SLE-4143) Changes in habootstrap-formula: - Create package version 0.2.1. (boo#1137989, jsc#SLE-4031) Changes in salt-shaptools: - Create package version 0.2.1. (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) Changes in python-shaptools: - Create package version 0.2.1. (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1704=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1704=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1704=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1704=1 Package List: - openSUSE Leap 15.1 (noarch): habootstrap-formula-0.2.1-lp151.4.1 python2-shaptools-0.2.1-lp151.2.1 python3-shaptools-0.2.1-lp151.2.1 salt-shaptools-0.2.1-lp151.2.1 saphanabootstrap-formula-0.2.1-lp151.4.1 - openSUSE Leap 15.0 (noarch): habootstrap-formula-0.2.1-lp150.3.1 python2-shaptools-0.2.1-lp150.2.1 python3-shaptools-0.2.1-lp150.2.1 salt-shaptools-0.2.1-lp150.2.1 saphanabootstrap-formula-0.2.1-lp150.3.1 - openSUSE Backports SLE-15 (noarch): habootstrap-formula-0.2.1-bp150.2.1 python2-shaptools-0.2.1-bp150.2.1 python3-shaptools-0.2.1-bp150.2.1 salt-shaptools-0.2.1-bp150.2.1 saphanabootstrap-formula-0.2.1-bp150.2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): habootstrap-formula-0.2.1-3.1 python-shaptools-0.2.1-2.1 python3-shaptools-0.2.1-2.1 salt-shaptools-0.2.1-2.1 saphanabootstrap-formula-0.2.1-3.1 References: https://bugzilla.suse.com/1137989

1 0

openSUSE-RU-2019:1704-1: moderate: Recommended update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula
by maintenance＠opensuse.org 15 Jul '19

15 Jul '19

openSUSE Recommended Update: Recommended update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1704-1 Rating: moderate References: #1137989 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula fixes the following issues: Changes in saphanabootstrap-formula: - Create package version 0.2.1. (boo#1137989, jsc#SLE-4143) Changes in habootstrap-formula: - Create package version 0.2.1. (boo#1137989, jsc#SLE-4031) Changes in salt-shaptools: - Create package version 0.2.1. (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) Changes in python-shaptools: - Create package version 0.2.1. (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1704=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): habootstrap-formula-0.2.1-3.1 python-shaptools-0.2.1-2.1 python3-shaptools-0.2.1-2.1 salt-shaptools-0.2.1-2.1 saphanabootstrap-formula-0.2.1-3.1 References: https://bugzilla.suse.com/1137989

1 0

openSUSE-SU-2019:1702-1: moderate: Security update for monitoring-plugins
by opensuse-security＠opensuse.org 14 Jul '19

14 Jul '19

openSUSE Security Update: Security update for monitoring-plugins ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1702-1 Rating: moderate References: #1132350 #1132903 #1133107 #498669 #519240 #640367 #677711 #778970 #789428 #847229 #859105 #914486 Cross-References: CVE-2007-5623 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves one vulnerability and has 11 fixes is now available. Description: This update adds monitoring-plugins to PackageHub 15, for use by various monitoring solutions. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1702=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): monitoring-plugins-2.2-bp150.2.1 monitoring-plugins-all-2.2-bp150.2.1 monitoring-plugins-breeze-2.2-bp150.2.1 monitoring-plugins-by_ssh-2.2-bp150.2.1 monitoring-plugins-cluster-2.2-bp150.2.1 monitoring-plugins-common-2.2-bp150.2.1 monitoring-plugins-cups-2.2-bp150.2.1 monitoring-plugins-dbi-2.2-bp150.2.1 monitoring-plugins-dbi-mysql-2.2-bp150.2.1 monitoring-plugins-dbi-pgsql-2.2-bp150.2.1 monitoring-plugins-dbi-sqlite3-2.2-bp150.2.1 monitoring-plugins-dhcp-2.2-bp150.2.1 monitoring-plugins-dig-2.2-bp150.2.1 monitoring-plugins-disk-2.2-bp150.2.1 monitoring-plugins-disk_smb-2.2-bp150.2.1 monitoring-plugins-dns-2.2-bp150.2.1 monitoring-plugins-dummy-2.2-bp150.2.1 monitoring-plugins-extras-2.2-bp150.2.1 monitoring-plugins-file_age-2.2-bp150.2.1 monitoring-plugins-flexlm-2.2-bp150.2.1 monitoring-plugins-fping-2.2-bp150.2.1 monitoring-plugins-hpjd-2.2-bp150.2.1 monitoring-plugins-http-2.2-bp150.2.1 monitoring-plugins-icmp-2.2-bp150.2.1 monitoring-plugins-ide_smart-2.2-bp150.2.1 monitoring-plugins-ifoperstatus-2.2-bp150.2.1 monitoring-plugins-ifstatus-2.2-bp150.2.1 monitoring-plugins-ircd-2.2-bp150.2.1 monitoring-plugins-ldap-2.2-bp150.2.1 monitoring-plugins-load-2.2-bp150.2.1 monitoring-plugins-log-2.2-bp150.2.1 monitoring-plugins-mailq-2.2-bp150.2.1 monitoring-plugins-mrtg-2.2-bp150.2.1 monitoring-plugins-mrtgtraf-2.2-bp150.2.1 monitoring-plugins-mysql-2.2-bp150.2.1 monitoring-plugins-nagios-2.2-bp150.2.1 monitoring-plugins-nt-2.2-bp150.2.1 monitoring-plugins-ntp_peer-2.2-bp150.2.1 monitoring-plugins-ntp_time-2.2-bp150.2.1 monitoring-plugins-nwstat-2.2-bp150.2.1 monitoring-plugins-oracle-2.2-bp150.2.1 monitoring-plugins-overcr-2.2-bp150.2.1 monitoring-plugins-pgsql-2.2-bp150.2.1 monitoring-plugins-ping-2.2-bp150.2.1 monitoring-plugins-procs-2.2-bp150.2.1 monitoring-plugins-radius-2.2-bp150.2.1 monitoring-plugins-real-2.2-bp150.2.1 monitoring-plugins-rpc-2.2-bp150.2.1 monitoring-plugins-smtp-2.2-bp150.2.1 monitoring-plugins-snmp-2.2-bp150.2.1 monitoring-plugins-ssh-2.2-bp150.2.1 monitoring-plugins-swap-2.2-bp150.2.1 monitoring-plugins-tcp-2.2-bp150.2.1 monitoring-plugins-time-2.2-bp150.2.1 monitoring-plugins-ups-2.2-bp150.2.1 monitoring-plugins-users-2.2-bp150.2.1 monitoring-plugins-wave-2.2-bp150.2.1 - openSUSE Backports SLE-15 (aarch64 ppc64le x86_64): monitoring-plugins-sensors-2.2-bp150.2.1 References: https://www.suse.com/security/cve/CVE-2007-5623.html https://bugzilla.suse.com/1132350 https://bugzilla.suse.com/1132903 https://bugzilla.suse.com/1133107 https://bugzilla.suse.com/498669 https://bugzilla.suse.com/519240 https://bugzilla.suse.com/640367 https://bugzilla.suse.com/677711 https://bugzilla.suse.com/778970 https://bugzilla.suse.com/789428 https://bugzilla.suse.com/847229 https://bugzilla.suse.com/859105 https://bugzilla.suse.com/914486

1 0

openSUSE-SU-2019:1703-1: moderate: Security update for helm
by opensuse-security＠opensuse.org 14 Jul '19

14 Jul '19

openSUSE Security Update: Security update for helm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1703-1 Rating: moderate References: #1118897 #1118898 #1118899 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for helm to version 2.13.1 fixes the following issues: - set correct git_commit value so that 'helm version' reports correctly - added service file for helm-serve - Require golang 1.10.6 or newer - Tiller should only enforce what we expect from Helm - Keepalive config should be independent of TLS - Bump client side grpc max msg size - Update deprecated grpc dial timeout - Includes fixes which allow Helm to correctly recognize resources created using the K8S 1.8/1.9 API namespaces Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1703=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): helm-2.13.1-5.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899

1 0

openSUSE-RU-2019:1701-1: moderate: Recommended update for obs-service-replace_using_package_version
by maintenance＠opensuse.org 13 Jul '19

13 Jul '19

openSUSE Recommended Update: Recommended update for obs-service-replace_using_package_version ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1701-1 Rating: moderate References: #1139343 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for obs-service-replace_using_package_version fixes the following issues: - New patch_update and offset parameters. (bsc#1139343) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1701=1 Package List: - openSUSE Backports SLE-15 (noarch): obs-service-replace_using_package_version-0.0.3-bp150.7.1 References: https://bugzilla.suse.com/1139343

1 0

openSUSE-RU-2019:1700-1: moderate: Recommended update for obs-service-replace_using_package_version
by maintenance＠opensuse.org 12 Jul '19

12 Jul '19

openSUSE Recommended Update: Recommended update for obs-service-replace_using_package_version ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1700-1 Rating: moderate References: #1139343 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for obs-service-replace_using_package_version fixes the following issues: - New patch_update and offset parameters. (bsc#1139343) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1700=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1700=1 Package List: - openSUSE Leap 15.1 (noarch): obs-service-replace_using_package_version-0.0.3-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): obs-service-replace_using_package_version-0.0.3-lp150.7.1 References: https://bugzilla.suse.com/1139343

1 0

openSUSE-SU-2019:1697-1: important: Security update for gvfs
by opensuse-security＠opensuse.org 07 Jul '19

07 Jul '19

openSUSE Security Update: Security update for gvfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1697-1 Rating: important References: #1125433 #1136981 #1136986 #1136992 #1137930 Cross-References: CVE-2019-12447 CVE-2019-12448 CVE-2019-12449 CVE-2019-12795 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for gvfs fixes the following issues: Security issues fixed: - CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930). - CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986). - CVE-2019-12449: Fixed an improper handling of file's user and group ownership in daemon/gvfsbackendadmin.c (bsc#1136992). - CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981). Other issue addressed: - Drop polkit rules files that are only relevant for wheel group (bsc#1125433). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1697=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gvfs-1.34.2.1-lp151.6.3.1 gvfs-backend-afc-1.34.2.1-lp151.6.3.1 gvfs-backend-afc-debuginfo-1.34.2.1-lp151.6.3.1 gvfs-backend-samba-1.34.2.1-lp151.6.3.1 gvfs-backend-samba-debuginfo-1.34.2.1-lp151.6.3.1 gvfs-backends-1.34.2.1-lp151.6.3.1 gvfs-backends-debuginfo-1.34.2.1-lp151.6.3.1 gvfs-debuginfo-1.34.2.1-lp151.6.3.1 gvfs-debugsource-1.34.2.1-lp151.6.3.1 gvfs-devel-1.34.2.1-lp151.6.3.1 gvfs-fuse-1.34.2.1-lp151.6.3.1 gvfs-fuse-debuginfo-1.34.2.1-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): gvfs-32bit-1.34.2.1-lp151.6.3.1 gvfs-32bit-debuginfo-1.34.2.1-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): gvfs-lang-1.34.2.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-12447.html https://www.suse.com/security/cve/CVE-2019-12448.html https://www.suse.com/security/cve/CVE-2019-12449.html https://www.suse.com/security/cve/CVE-2019-12795.html https://bugzilla.suse.com/1125433 https://bugzilla.suse.com/1136981 https://bugzilla.suse.com/1136986 https://bugzilla.suse.com/1136992 https://bugzilla.suse.com/1137930

1 0

openSUSE-RU-2019:1696-1: moderate: Recommended update for kdepim-runtime
by maintenance＠opensuse.org 07 Jul '19

07 Jul '19

openSUSE Recommended Update: Recommended update for kdepim-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1696-1 Rating: moderate References: #1139721 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kdepim-runtime fixes the following issues: - Add Qt5NetworkAuth and qca-qt5 BuildRequires for OAuth2 support for the EWS resource (boo#1139721) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1696=1 Package List: - openSUSE Leap 15.1 (x86_64): kdepim-runtime-18.12.3-lp151.2.4.1 kdepim-runtime-debuginfo-18.12.3-lp151.2.4.1 kdepim-runtime-debugsource-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (noarch): kdepim-runtime-lang-18.12.3-lp151.2.4.1 References: https://bugzilla.suse.com/1139721

1 0

openSUSE-SU-2019:1699-1: important: Security update for gvfs
by opensuse-security＠opensuse.org 07 Jul '19

07 Jul '19

openSUSE Security Update: Security update for gvfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1699-1 Rating: important References: #1125433 #1136981 #1136986 #1136992 #1137930 Cross-References: CVE-2019-12447 CVE-2019-12448 CVE-2019-12449 CVE-2019-12795 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for gvfs fixes the following issues: Security issues fixed: - CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930). - CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986). - CVE-2019-12449: Fixed an improper handling of file's user and group ownership in daemon/gvfsbackendadmin.c (bsc#1136992). - CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981). Other issue addressed: - Drop polkit rules files that are only relevant for wheel group (bsc#1125433). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1699=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gvfs-1.34.2.1-lp150.3.10.1 gvfs-backend-afc-1.34.2.1-lp150.3.10.1 gvfs-backend-afc-debuginfo-1.34.2.1-lp150.3.10.1 gvfs-backend-samba-1.34.2.1-lp150.3.10.1 gvfs-backend-samba-debuginfo-1.34.2.1-lp150.3.10.1 gvfs-backends-1.34.2.1-lp150.3.10.1 gvfs-backends-debuginfo-1.34.2.1-lp150.3.10.1 gvfs-debuginfo-1.34.2.1-lp150.3.10.1 gvfs-debugsource-1.34.2.1-lp150.3.10.1 gvfs-devel-1.34.2.1-lp150.3.10.1 gvfs-fuse-1.34.2.1-lp150.3.10.1 gvfs-fuse-debuginfo-1.34.2.1-lp150.3.10.1 - openSUSE Leap 15.0 (x86_64): gvfs-32bit-1.34.2.1-lp150.3.10.1 gvfs-32bit-debuginfo-1.34.2.1-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): gvfs-lang-1.34.2.1-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-12447.html https://www.suse.com/security/cve/CVE-2019-12448.html https://www.suse.com/security/cve/CVE-2019-12449.html https://www.suse.com/security/cve/CVE-2019-12795.html https://bugzilla.suse.com/1125433 https://bugzilla.suse.com/1136981 https://bugzilla.suse.com/1136986 https://bugzilla.suse.com/1136992 https://bugzilla.suse.com/1137930

1 0

openSUSE-OU-2019:1698-1: Optional update for osc, openSUSE-release-tools
by maintenance＠opensuse.org 07 Jul '19

07 Jul '19

openSUSE Optional Update: Optional update for osc, openSUSE-release-tools ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:1698-1 Rating: low References: #1112920 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for osc, openSUSE-release-tools fixes the following issues: - Add new package openSUSE-release-tools in version 20190603.49a5e95b: * Support licensedigger as reviewer for SUSE and openSUSE * [ttm] remove ppc64 (BE) for TW bypass boo#1112920 - osc was updated to 0.165.1: * add Provides: %{use_python}-osc so that other packages can require the correct version (either python2-osc or python3-osc) * fix oscssl "urldefrag is not defined error" * osc release command now python3 compatible * add more decode logic in get_commitlog * osc add <dir> in compressed mode now works with python3 * osc getbinaries now prints the output instead of using the quiet mode as a default Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1698=1 Package List: - openSUSE Leap 15.1 (noarch): openSUSE-release-tools-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-abichecker-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-announcer-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-check-source-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-devel-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-leaper-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-maintenance-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-metrics-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-metrics-access-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-obs-operator-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-origin-manager-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-pkglistgen-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-repo-checker-20190603.49a5e95b-lp151.2.3.1 openSUSE-release-tools-staging-bot-20190603.49a5e95b-lp151.2.3.1 osc-0.165.1-lp151.2.3.1 osc-plugin-cycle-20190603.49a5e95b-lp151.2.3.1 osc-plugin-origin-20190603.49a5e95b-lp151.2.3.1 osc-plugin-staging-20190603.49a5e95b-lp151.2.3.1 osc-plugin-vdelreq-20190603.49a5e95b-lp151.2.3.1 osclib-20190603.49a5e95b-lp151.2.3.1 References: https://bugzilla.suse.com/1112920

1 0

openSUSE-RU-2019:1695-1: moderate: Recommended update for dovecot23
by maintenance＠opensuse.org 05 Jul '19

05 Jul '19

openSUSE Recommended Update: Recommended update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1695-1 Rating: moderate References: #1134242 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dovecot23 fixes the following issues: When upgrading from 42.3 to 15.1: dovecot shows Unknown protocol 'SSLv2' (boo#1134242). Remove !SSLv2 from existing ssl_protocols configuration during upgrade. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1695=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.3-lp151.2.3.1 dovecot23-backend-mysql-2.3.3-lp151.2.3.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp151.2.3.1 dovecot23-backend-pgsql-2.3.3-lp151.2.3.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp151.2.3.1 dovecot23-backend-sqlite-2.3.3-lp151.2.3.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp151.2.3.1 dovecot23-debuginfo-2.3.3-lp151.2.3.1 dovecot23-debugsource-2.3.3-lp151.2.3.1 dovecot23-devel-2.3.3-lp151.2.3.1 dovecot23-fts-2.3.3-lp151.2.3.1 dovecot23-fts-debuginfo-2.3.3-lp151.2.3.1 dovecot23-fts-lucene-2.3.3-lp151.2.3.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp151.2.3.1 dovecot23-fts-solr-2.3.3-lp151.2.3.1 dovecot23-fts-solr-debuginfo-2.3.3-lp151.2.3.1 dovecot23-fts-squat-2.3.3-lp151.2.3.1 dovecot23-fts-squat-debuginfo-2.3.3-lp151.2.3.1 References: https://bugzilla.suse.com/1134242

1 0

openSUSE-RU-2019:1694-1: Recommended update for libqt5-qtwebengine
by maintenance＠opensuse.org 04 Jul '19

04 Jul '19

openSUSE Recommended Update: Recommended update for libqt5-qtwebengine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1694-1 Rating: low References: #1127039 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libqt5-qtwebengine fixes a bug in the %postun script. (bsc#1127039) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1694=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1694=1 Package List: - openSUSE Leap 15.0 (x86_64): libqt5-qtwebengine-5.10.1-lp150.3.4.2 libqt5-qtwebengine-debuginfo-5.10.1-lp150.3.4.2 libqt5-qtwebengine-debugsource-5.10.1-lp150.3.4.2 libqt5-qtwebengine-devel-5.10.1-lp150.3.4.2 libqt5-qtwebengine-examples-5.10.1-lp150.3.4.2 libqt5-qtwebengine-examples-debuginfo-5.10.1-lp150.3.4.2 - openSUSE Leap 15.0 (noarch): libqt5-qtwebengine-private-headers-devel-5.10.1-lp150.3.4.2 - openSUSE Backports SLE-15 (noarch): libqt5-qtwebengine-private-headers-devel-5.10.1-bp150.3.3.3 - openSUSE Backports SLE-15 (x86_64): libqt5-qtwebengine-5.10.1-bp150.3.3.3 libqt5-qtwebengine-devel-5.10.1-bp150.3.3.3 libqt5-qtwebengine-examples-5.10.1-bp150.3.3.3 References: https://bugzilla.suse.com/1127039

1 0

openSUSE-RU-2019:1693-1: moderate: Recommended update for git-review
by maintenance＠opensuse.org 03 Jul '19

03 Jul '19

openSUSE Recommended Update: Recommended update for git-review ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1693-1 Rating: moderate References: #1134089 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for git-review fixes the following issues: git-review was updated to 1.28.0 (boo#1134089): * Support for auto-configuration of topic names based on the presence of keywords in the commit message is removed. Previously, keywords such as bug, bp or lp followed by a number would result in branch names containing the associated number, e.g. bug/123. This feature was OpenStack specific, was a frequent source of bugs and clearly wasn’t being used that often, given that StoryBoard is a thing now and no one had updated this feature to handle that metadata. * Fixed usepushurl to work when a read-only mirror being used as origin does not contain refs/changes from gerrit. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1693=1 Package List: - openSUSE Backports SLE-15 (noarch): git-review-1.28.0-bp150.3.3.1 References: https://bugzilla.suse.com/1134089

1 0

openSUSE-RU-2019:1691-1: moderate: Recommended update for git-review
by maintenance＠opensuse.org 03 Jul '19

03 Jul '19

openSUSE Recommended Update: Recommended update for git-review ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1691-1 Rating: moderate References: #1134089 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for git-review fixes the following issues: git-review was updated to 1.28.0 (boo#1134089): * Support for auto-configuration of topic names based on the presence of keywords in the commit message is removed. Previously, keywords such as bug, bp or lp followed by a number would result in branch names containing the associated number, e.g. bug/123. This feature was OpenStack specific, was a frequent source of bugs and clearly wasn’t being used that often, given that StoryBoard is a thing now and no one had updated this feature to handle that metadata. * Fixed usepushurl to work when a read-only mirror being used as origin does not contain refs/changes from gerrit. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1691=1 Package List: - openSUSE Leap 15.0 (noarch): git-review-1.28.0-lp150.2.3.1 References: https://bugzilla.suse.com/1134089

1 0

openSUSE-RU-2019:1692-1: moderate: Recommended update for guake
by maintenance＠opensuse.org 03 Jul '19

03 Jul '19

openSUSE Recommended Update: Recommended update for guake ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1692-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for guake fixes the following issues: guake was updated to version 3.6.3: * Add drag-n-drop to terminal (text & uris) * When scrolling with "shift" (1 page) or "shift + ctrl" (4 pages) it will be faster (gh#Guake/guake#271) * Add schema_version check for tabs session restore * Add save/restore terminal split for tabs session - Save/Restore terminal split by pre-order traversal full binary tree in list * Bump tabs session schema_version to 2 (to support terminal split) * Lazy restore terminal split until Guake is visible * Manage terminal signal handler by handler_ids * Avoid spurious resize event when showing fullscreened window * Make sure workspace-specific-tab-sets only enable on X11 backend (due to wnck) * Add install/uninstall-dev-locale to support dev locale * Fix DualTerminalBox grab focus when remove dead child * Support customize prefix for make * Fix re-focus on terminal after rename dialog destroy * Fix split terminal by menu will not follow last terminal cwd (if option set) * Fix delete_shell using os.waitpid (should not use it) guake was updated to 3.6.1: * new feature: search in current terminal * new feature: session saving * new feature: settings export and import * various fixes to the core * minor build system fixes * translation updates guake was updated to version 3.5.0: * new hotkey (CTRL+SHIFT+H) to open new tab in home directory * "New tab" button (gh#Guake/guake#1471) * Open new tab by double-clicking on the tab bar * Add new context menu on the notebook * Add a CLI option to change palette scheme (gh#Guake/guake#1345) * Bold text is also bright (>= VTE 0.52 only) * guake --split-vertical and --split-horizontal split the current * tab just like the context menu does * Optional close buttons for tabs (disabled by default) * Guake can now provide a set of tabs per workspace * Reverse transparency slider to be more meaningful (gh#Guake/guake#1501) * Fix command-line select tab behavior (gh#Guake/guake#1492) * removed duplicate event bind? previously I had issue where quick-open event would be fired twice because of this. * fix settings only applied to the active workspace if more the 1 is used * fix prompt quit dialog numbers when more then 1 workspace is used * Updated translations. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1692=1 Package List: - openSUSE Leap 15.1 (noarch): guake-3.6.3-lp151.2.3.1 References:

1 0

openSUSE-SU-2019:1689-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1689-1 Rating: moderate References: #1137496 #1137497 Cross-References: CVE-2019-11768 CVE-2019-12616 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.0.1: * Several issues with SYSTEM VERSIONING tables * Fixed json encode error in export * Fixed JavaScript events not activating on input (sql bookmark issue) * Show Designer combo boxes when adding a constraint * Fix edit view * Fixed invalid default value for bit field * Fix several errors relating to GIS data types * Fixed javascript error PMA_messages is not defined * Fixed import XML data with leading zeros * Fixed php notice, added support for 'DELETE HISTORY' table privilege (MariaDB >= 10.3.4) * Fixed MySQL 8.0.0 issues with GIS display * Fixed "Server charset" in "Database server" tab showing wrong information * Fixed can not copy user on Percona Server 5.7 * Updated sql-parser to version 4.3.2, which fixes several parsing and linting problems - boo#1137497 / PMASA-2019-4 / CVE-2019-12616 / CWE-661: Fixed CSRF vulnerability in login form https://www.phpmyadmin.net/security/PMASA-2019-4/ - boo#1137496 / PMASA-2019-3 / CVE-2019-11768 / CWE-661: Fixed SQL injection in Designer feature https://www.phpmyadmin.net/security/PMASA-2019-3/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1689=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1689=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.9.0.1-31.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.0.1-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.0.1-lp150.31.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.0.1-bp150.31.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.0.1-31.1 References: https://www.suse.com/security/cve/CVE-2019-11768.html https://www.suse.com/security/cve/CVE-2019-12616.html https://bugzilla.suse.com/1137496 https://bugzilla.suse.com/1137497

1 0

openSUSE-SU-2019:1690-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1690-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1690=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1690=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1690=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.1.3-33.1 irssi-debuginfo-1.1.3-33.1 irssi-debugsource-1.1.3-33.1 irssi-devel-1.1.3-33.1 - openSUSE Leap 15.1 (x86_64): irssi-1.1.3-lp151.2.3.1 irssi-debuginfo-1.1.3-lp151.2.3.1 irssi-debugsource-1.1.3-lp151.2.3.1 irssi-devel-1.1.3-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): irssi-1.1.3-lp150.33.1 irssi-debuginfo-1.1.3-lp150.33.1 irssi-debugsource-1.1.3-lp150.33.1 irssi-devel-1.1.3-lp150.33.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-bp150.33.1 irssi-devel-1.1.3-bp150.33.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-33.1 irssi-devel-1.1.3-33.1 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-SU-2019:1689-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1689-1 Rating: moderate References: #1137496 #1137497 Cross-References: CVE-2019-11768 CVE-2019-12616 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.0.1: * Several issues with SYSTEM VERSIONING tables * Fixed json encode error in export * Fixed JavaScript events not activating on input (sql bookmark issue) * Show Designer combo boxes when adding a constraint * Fix edit view * Fixed invalid default value for bit field * Fix several errors relating to GIS data types * Fixed javascript error PMA_messages is not defined * Fixed import XML data with leading zeros * Fixed php notice, added support for 'DELETE HISTORY' table privilege (MariaDB >= 10.3.4) * Fixed MySQL 8.0.0 issues with GIS display * Fixed "Server charset" in "Database server" tab showing wrong information * Fixed can not copy user on Percona Server 5.7 * Updated sql-parser to version 4.3.2, which fixes several parsing and linting problems - boo#1137497 / PMASA-2019-4 / CVE-2019-12616 / CWE-661: Fixed CSRF vulnerability in login form https://www.phpmyadmin.net/security/PMASA-2019-4/ - boo#1137496 / PMASA-2019-3 / CVE-2019-11768 / CWE-661: Fixed SQL injection in Designer feature https://www.phpmyadmin.net/security/PMASA-2019-3/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1689=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1689=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.9.0.1-31.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.0.1-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.0.1-lp150.31.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.0.1-bp150.31.1 References: https://www.suse.com/security/cve/CVE-2019-11768.html https://www.suse.com/security/cve/CVE-2019-12616.html https://bugzilla.suse.com/1137496 https://bugzilla.suse.com/1137497

1 0

openSUSE-SU-2019:1690-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 02 Jul '19

02 Jul '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1690-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1690=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-33.1 irssi-devel-1.1.3-33.1 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-RU-2019:1687-1: moderate: Recommended update for rclone
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for rclone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1687-1 Rating: moderate References: #1137685 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rclone fixes the following issues: rclone was updated to version 1.47.0. boo#1137685: - New backends - Backend for Koofr cloud storage service. (jaKa) - New Features - Resume downloads if the reader fails in copy (Nick Craig-Wood) - Use `--fast-list` for listing operations where it won't use more memory (Nick Craig-Wood) - Make `--files-from` traverse the destination unless `--no-traverse` is set (Nick Craig-Wood) - Make server side copy account bytes and obey `--max-transfer` (Nick Craig-Wood) - Add `--create-empty-src-dirs` flag and default to not creating empty dirs (ishuah) - Add client side TLS/SSL flags `--ca-cert`/`--client-cert`/`--client-key` (Nick Craig-Wood) - Implement `--suffix-keep-extension` for use with `--suffix` (Nick Craig-Wood) - serve dlna: Add connection manager service description to improve compatibility (Dan Walters) - lsf: Add 'e' format to show encrypted names and 'o' for original IDs (Nick Craig-Wood) - lsjson: Added `--files-only` and `--dirs-only` flags (calistri) - rc: Implement operations/publiclink the equivalent of `rclone link` (Nick Craig-Wood) - Bug Fixes - accounting: Fix total ETA when `--stats-unit bits` is in effect (Nick Craig-Wood) - Bash TAB completion - Use private custom func to fix clash between rclone and kubectl (Nick Craig-Wood) - Fix for remotes with underscores in their names (Six) - Fix completion of remotes (Florian Gamböck) - Fix autocompletion of remote paths with spaces (Danil Semelenov) - serve dlna: Fix root XML service descriptor (Dan Walters) - ncdu: Fix display corruption with Chinese characters (Nick Craig-Wood) - Add SIGTERM to signals which run the exit handlers on unix (Nick Craig-Wood) - rc: Reload filter when the options are set via the rc (Nick Craig-Wood) - VFS / Mount - Fix FreeBSD: Ignore Truncate if called with no readers and already the correct size (Nick Craig-Wood) - Read directory and check for a file before mkdir (Nick Craig-Wood) - Shorten the locking window for vfs/refresh (Nick Craig-Wood) - Azure Blob - Enable MD5 checksums when uploading files bigger than the "Cutoff" (Dr.Rx) - Fix SAS URL support (Nick Craig-Wood) - B2 - Allow manual configuration of backblaze downloadUrl (Vince) - Ignore already_hidden error on remove (Nick Craig-Wood) - Ignore malformed `src_last_modified_millis` (Nick Craig-Wood) - Drive - Add `--skip-checksum-gphotos` to ignore incorrect checksums on Google Photos (Nick Craig-Wood) - Allow server side move/copy between different remotes. (Fionera) - Add docs on team drives and `--fast-list` eventual consistency (Nestar47) - Fix imports of text files (Nick Craig-Wood) - Fix range requests on 0 length files (Nick Craig-Wood) - Fix creation of duplicates with server side copy (Nick Craig-Wood) - Dropbox - Retry blank errors to fix long listings (Nick Craig-Wood) - FTP - Add `--ftp-concurrency` to limit maximum number of connections (Nick Craig-Wood) - Google Cloud Storage - Fall back to default application credentials (marcintustin) - Allow bucket policy only buckets (Nick Craig-Wood) - HTTP - Add `--http-no-slash` for websites with directories with no slashes (Nick Craig-Wood) - Remove duplicates from listings (Nick Craig-Wood) - Fix socket leak on 404 errors (Nick Craig-Wood) - Jottacloud - Fix token refresh (Sebastian Bünger) - Add device registration (Oliver Heyme) - Onedrive - Implement graceful cancel of multipart uploads if rclone is interrupted (Cnly) - Always add trailing colon to path when addressing items, (Cnly) - Return errors instead of panic for invalid uploads (Fabian Möller) - S3 - Add support for "Glacier Deep Archive" storage class (Manu) - Update Dreamhost endpoint (Nick Craig-Wood) - Note incompatibility with CEPH Jewel (Nick Craig-Wood) - SFTP - Allow custom ssh client config (Alexandru Bumbacea) - Swift - Obey Retry-After to enable OVH restore from cold storage (Nick Craig-Wood) - Work around token expiry on CEPH (Nick Craig-Wood) - WebDAV - Allow IsCollection property to be integer or boolean (Nick Craig-Wood) - Fix race when creating directories (Nick Craig-Wood) - Fix About/df when reading the available/total returns 0 (Nick Craig-Wood) - Add bash-completion and zsh-completion support. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1687=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): rclone-1.47.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): rclone-bash-completion-1.47.0-bp150.3.3.1 rclone-zsh-completion-1.47.0-bp150.3.3.1 References: https://bugzilla.suse.com/1137685

1 0

openSUSE-RU-2019:1685-1: moderate: Recommended update for plasma5-pa
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-pa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1685-1 Rating: moderate References: #1012244 Affected Products: openSUSE Leap 42.3 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-pa fixes the following issues: - Fixed the notification volume slider always jumping back to 0 (boo#1012244, kde#383787) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1685=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1685=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): plasma5-pa-5.8.7-2.3.1 plasma5-pa-debuginfo-5.8.7-2.3.1 plasma5-pa-debugsource-5.8.7-2.3.1 - openSUSE Leap 42.3 (noarch): plasma5-pa-lang-5.8.7-2.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-pa-lang-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): plasma5-pa-5.8.7-5.1 References: https://bugzilla.suse.com/1012244

1 0

openSUSE-SU-2019:1688-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1688-1 Rating: moderate References: #1047218 #1084909 Cross-References: CVE-2018-16860 CVE-2019-12098 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: libheimdal was updated to version 7.7.0: + Bug fixes: - PKCS#11 hcrypto back-end: + initialize the p11_module_load function list + verify that not only is a mechanism present but that its mechanism info states that it offers the required encryption, decryption or digest services - krb5: + Starting with 7.6, Heimdal permitted requesting authenticated anonymous tickets. However, it did not verify that a KDC in fact returned an anonymous ticket when one was requested. + Cease setting the KDCOption reaquest_anonymous flag when issuing S4UProxy (constrained delegation) TGS requests. + when the Win2K PKINIT compatibility option is set, do not require krbtgt otherName to match when validating KDC certificate. + set PKINIT_BTMM flag per Apple implementation + use memset_s() instead of memset() - kdc: + When generating KRB5SignedPath in the AS, use the reply client name rather than the one from the request, so validation will work correctly in the TGS. + allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used an enctype with a different checksum. Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always HMAC_MD5, and that's what Windows and MIT clients send. In Heimdal both the client and kdc use instead the checksum of the TGT, and therefore work with each other but Windows and MIT clients fail against Heimdal KDC. Both Windows and MIT KDC would allow any keyed checksum to be used so Heimdal client work fine against it. Change Heimdal KDC to allow HMAC_MD5 even for non RC4 based TGT in order to support per-spec clients. + use memset_s() instead of memset() + Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy (constrained delegation) TGS Requests with the request anonymous flag set. These requests will be treated as S4UProxy requests and not anonymous requests. - HDB: + Set SQLite3 backend default page size to 8KB. + Add hdb_set_sync() method - kadmind: + disable HDB sync during database load avoiding unnecessary disk i/o. - ipropd: + disable HDB sync during receive_everything. Doing an fsync per-record when receiving the complete HDB is a performance disaster. Among other things, if the HDB is very large, then one slave receving a full HDB can cause other slaves to timeout and, if HDB write activity is high enough to cause iprop log truncation, then also need full syncs, which leads to a cycle of full syncs for all slaves until HDB write activity drops. Allowing the iprop log to be larger helps, but improving receive_everything() performance helps even more. - kinit: + Anonymous PKINIT tickets discard the realm information used to locate the issuing AS. Store the issuing realm in the credentials cache in order to locate a KDC which can renew them. + Do not leak the result of krb5_cc_get_config() when determining anonymous PKINIT start realm. - klist: + Show transited-policy-checked, ok-as-delegate and anonymous flags when listing credentials. - tests: + Regenerate certs so that they expire before the 2038 armageddon so the test suite will pass on 32-bit operating systems until the underlying issues can be resolved. - documentation: + rename verify-password to verify-password-quality + hprop default mode is encrypt + kadmind "all" permission does not include "get-keys" + verify-password-quality might not be stateless Version 7.6.0: + Security (#555): - CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum When the Heimdal KDC checks the checksum that is placed on the S4U2Self packet by the server to protect the requested principal against modification, it does not confirm that the checksum algorithm that protects the user name (principal) in the request is keyed. This allows a man-in-the-middle attacker who can intercept the request to the KDC to modify the packet by replacing the user name (principal) in the request with any desired user name (principal) that exists in the KDC and replace the checksum protecting that name with a CRC32 checksum (which requires no prior knowledge to compute). This would allow a S4U2Self ticket requested on behalf of user name (principal) user(a)EXAMPLE.COM to any service to be changed to a S4U2Self ticket with a user name (principal) of Administrator(a)EXAMPLE.COM. This ticket would then contain the PAC of the modified user name (principal). - CVE-2019-12098, client-only: RFC8062 Section 7 requires verification of the PA-PKINIT-KX key exchange when anonymous PKINIT is used. Failure to do so can permit an active attacker to become a man-in-the-middle. + Bug fixes: - Happy eyeballs: Don't wait for responses from known-unreachable KDCs. - kdc: + check return copy_Realm, copy_PrincipalName, copy_EncryptionKey - kinit: + cleanup temporary ccaches + see man page for "kinit --anonymous" command line syntax change - kdc: + Make anonymous AS-requests more RFC8062-compliant. Updated expired test certificates + Features: - kuser: support authenticated anonymous AS-REQs in kinit - kdc: support for anonymous TGS-REQs - kgetcred support for anonymous service tickets - Support builds with OpenSSL 1.1.1 This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1688=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libheimdal-7.7.0-bp150.2.3.1 libheimdal-devel-7.7.0-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16860.html https://www.suse.com/security/cve/CVE-2019-12098.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1084909

1 0

openSUSE-RU-2019:1686-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1686-1 Rating: moderate References: #1091191 Affected Products: openSUSE Leap 42.3 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - Fixed playing the login sound with Phonon 4.9+ when the sound file is specified as absolute file path (boo#1091191, kde#392725) - Adapted the BBC weather engine provider to changes in the RSS feed that broke it (kde#392510) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1686=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1686=1 Package List: - openSUSE Leap 42.3 (noarch): plasma5-workspace-lang-5.8.7-14.1 - openSUSE Leap 42.3 (x86_64): drkonqi5-5.8.7-14.1 drkonqi5-debuginfo-5.8.7-14.1 plasma5-workspace-5.8.7-14.1 plasma5-workspace-debuginfo-5.8.7-14.1 plasma5-workspace-debugsource-5.8.7-14.1 plasma5-workspace-devel-5.8.7-14.1 plasma5-workspace-libs-5.8.7-14.1 plasma5-workspace-libs-debuginfo-5.8.7-14.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-workspace-lang-5.8.6-11.1 plasma5-workspace-lang-5.8.7-11.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): drkonqi5-5.8.6-11.1 drkonqi5-5.8.7-11.1 drkonqi5-debuginfo-5.8.7-11.1 plasma5-workspace-5.8.6-11.1 plasma5-workspace-5.8.7-11.1 plasma5-workspace-debuginfo-5.8.7-11.1 plasma5-workspace-debugsource-5.8.7-11.1 plasma5-workspace-devel-5.8.6-11.1 plasma5-workspace-devel-5.8.7-11.1 plasma5-workspace-libs-5.8.6-11.1 plasma5-workspace-libs-5.8.7-11.1 plasma5-workspace-libs-debuginfo-5.8.7-11.1 References: https://bugzilla.suse.com/1091191

1 0

openSUSE-RU-2019:1685-1: moderate: Recommended update for plasma5-pa
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-pa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1685-1 Rating: moderate References: #1012244 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-pa fixes the following issues: - Fixed the notification volume slider always jumping back to 0 (boo#1012244, kde#383787) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1685=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): plasma5-pa-5.8.7-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-pa-lang-5.8.7-5.1 References: https://bugzilla.suse.com/1012244

1 0

openSUSE-RU-2019:1686-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1686-1 Rating: moderate References: #1091191 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-workspace fixes the following issues: - Fixed playing the login sound with Phonon 4.9+ when the sound file is specified as absolute file path (boo#1091191, kde#392725) - Adapted the BBC weather engine provider to changes in the RSS feed that broke it (kde#392510) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1686=1 Package List: - openSUSE Leap 42.3 (noarch): plasma5-workspace-lang-5.8.7-14.1 - openSUSE Leap 42.3 (x86_64): drkonqi5-5.8.7-14.1 drkonqi5-debuginfo-5.8.7-14.1 plasma5-workspace-5.8.7-14.1 plasma5-workspace-debuginfo-5.8.7-14.1 plasma5-workspace-debugsource-5.8.7-14.1 plasma5-workspace-devel-5.8.7-14.1 plasma5-workspace-libs-5.8.7-14.1 plasma5-workspace-libs-debuginfo-5.8.7-14.1 References: https://bugzilla.suse.com/1091191

1 0

openSUSE-SU-2019:1682-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1682-1 Rating: moderate References: #1047218 #1084909 Cross-References: CVE-2018-16860 CVE-2019-12098 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: libheimdal was updated to version 7.7.0: + Bug fixes: - PKCS#11 hcrypto back-end: + initialize the p11_module_load function list + verify that not only is a mechanism present but that its mechanism info states that it offers the required encryption, decryption or digest services - krb5: + Starting with 7.6, Heimdal permitted requesting authenticated anonymous tickets. However, it did not verify that a KDC in fact returned an anonymous ticket when one was requested. + Cease setting the KDCOption reaquest_anonymous flag when issuing S4UProxy (constrained delegation) TGS requests. + when the Win2K PKINIT compatibility option is set, do not require krbtgt otherName to match when validating KDC certificate. + set PKINIT_BTMM flag per Apple implementation + use memset_s() instead of memset() - kdc: + When generating KRB5SignedPath in the AS, use the reply client name rather than the one from the request, so validation will work correctly in the TGS. + allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used an enctype with a different checksum. Per [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always HMAC_MD5, and that's what Windows and MIT clients send. In Heimdal both the client and kdc use instead the checksum of the TGT, and therefore work with each other but Windows and MIT clients fail against Heimdal KDC. Both Windows and MIT KDC would allow any keyed checksum to be used so Heimdal client work fine against it. Change Heimdal KDC to allow HMAC_MD5 even for non RC4 based TGT in order to support per-spec clients. + use memset_s() instead of memset() + Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy (constrained delegation) TGS Requests with the request anonymous flag set. These requests will be treated as S4UProxy requests and not anonymous requests. - HDB: + Set SQLite3 backend default page size to 8KB. + Add hdb_set_sync() method - kadmind: + disable HDB sync during database load avoiding unnecessary disk i/o. - ipropd: + disable HDB sync during receive_everything. Doing an fsync per-record when receiving the complete HDB is a performance disaster. Among other things, if the HDB is very large, then one slave receving a full HDB can cause other slaves to timeout and, if HDB write activity is high enough to cause iprop log truncation, then also need full syncs, which leads to a cycle of full syncs for all slaves until HDB write activity drops. Allowing the iprop log to be larger helps, but improving receive_everything() performance helps even more. - kinit: + Anonymous PKINIT tickets discard the realm information used to locate the issuing AS. Store the issuing realm in the credentials cache in order to locate a KDC which can renew them. + Do not leak the result of krb5_cc_get_config() when determining anonymous PKINIT start realm. - klist: + Show transited-policy-checked, ok-as-delegate and anonymous flags when listing credentials. - tests: + Regenerate certs so that they expire before the 2038 armageddon so the test suite will pass on 32-bit operating systems until the underlying issues can be resolved. - documentation: + rename verify-password to verify-password-quality + hprop default mode is encrypt + kadmind "all" permission does not include "get-keys" + verify-password-quality might not be stateless Version 7.6.0: + Security (#555): - CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum When the Heimdal KDC checks the checksum that is placed on the S4U2Self packet by the server to protect the requested principal against modification, it does not confirm that the checksum algorithm that protects the user name (principal) in the request is keyed. This allows a man-in-the-middle attacker who can intercept the request to the KDC to modify the packet by replacing the user name (principal) in the request with any desired user name (principal) that exists in the KDC and replace the checksum protecting that name with a CRC32 checksum (which requires no prior knowledge to compute). This would allow a S4U2Self ticket requested on behalf of user name (principal) user(a)EXAMPLE.COM to any service to be changed to a S4U2Self ticket with a user name (principal) of Administrator(a)EXAMPLE.COM. This ticket would then contain the PAC of the modified user name (principal). - CVE-2019-12098, client-only: RFC8062 Section 7 requires verification of the PA-PKINIT-KX key exchange when anonymous PKINIT is used. Failure to do so can permit an active attacker to become a man-in-the-middle. + Bug fixes: - Happy eyeballs: Don't wait for responses from known-unreachable KDCs. - kdc: + check return copy_Realm, copy_PrincipalName, copy_EncryptionKey - kinit: + cleanup temporary ccaches + see man page for "kinit --anonymous" command line syntax change - kdc: + Make anonymous AS-requests more RFC8062-compliant. Updated expired test certificates + Features: - kuser: support authenticated anonymous AS-REQs in kinit - kdc: support for anonymous TGS-REQs - kgetcred support for anonymous service tickets - Support builds with OpenSSL 1.1.1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1682=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1682=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1682=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libheimdal-7.7.0-12.1 libheimdal-debuginfo-7.7.0-12.1 libheimdal-debugsource-7.7.0-12.1 libheimdal-devel-7.7.0-12.1 - openSUSE Leap 15.1 (x86_64): libheimdal-7.7.0-lp151.3.3.1 libheimdal-debuginfo-7.7.0-lp151.3.3.1 libheimdal-debugsource-7.7.0-lp151.3.3.1 libheimdal-devel-7.7.0-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): libheimdal-7.7.0-lp150.2.3.1 libheimdal-debuginfo-7.7.0-lp150.2.3.1 libheimdal-debugsource-7.7.0-lp150.2.3.1 libheimdal-devel-7.7.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16860.html https://www.suse.com/security/cve/CVE-2019-12098.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1084909

1 0

openSUSE-SU-2019:1683-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1683-1 Rating: moderate References: #1133204 #1133205 #1133498 #1133501 #1134075 #1135232 #1135236 #1136183 #1136732 #1138425 #1138464 Cross-References: CVE-2017-12805 CVE-2017-12806 CVE-2019-10131 CVE-2019-11470 CVE-2019-11472 CVE-2019-11505 CVE-2019-11506 CVE-2019-11597 CVE-2019-11598 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11597: Fixed a heap-based buffer over-read in the WriteTIFFImage() (bsc#1138464). - Fixed a file content disclosure via SVG and WMF decoding (bsc#1138425).- CVE-2019-11472: Fixed a denial of service in ReadXWDImage() (bsc#1133204). - CVE-2019-11470: Fixed a denial of service in ReadCINImage() (bsc#1133205). - CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABImage() (bsc#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the WritePDBImage() (bsc#1133501). - CVE-2019-10131: Fixed a off-by-one read in formatIPTCfromBuffer function in coders/meta.c (bsc#1134075). - CVE-2017-12806: Fixed a denial of service through memory exhaustion in format8BIM() (bsc#1135232). - CVE-2017-12805: Fixed a denial of service through memory exhaustion in ReadTIFFImage() (bsc#1135236). - CVE-2019-11598: Fixed a heap-based buffer over-read in WritePNMImage() (bsc#1136732) We also now disable PCL in the -SUSE configuration, as it also uses ghostscript for decoding (bsc#1136183) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1683=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-85.1 ImageMagick-config-6-SUSE-6.8.8.1-85.1 ImageMagick-config-6-upstream-6.8.8.1-85.1 ImageMagick-debuginfo-6.8.8.1-85.1 ImageMagick-debugsource-6.8.8.1-85.1 ImageMagick-devel-6.8.8.1-85.1 ImageMagick-extra-6.8.8.1-85.1 ImageMagick-extra-debuginfo-6.8.8.1-85.1 libMagick++-6_Q16-3-6.8.8.1-85.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-85.1 libMagick++-devel-6.8.8.1-85.1 libMagickCore-6_Q16-1-6.8.8.1-85.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-85.1 libMagickWand-6_Q16-1-6.8.8.1-85.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-85.1 perl-PerlMagick-6.8.8.1-85.1 perl-PerlMagick-debuginfo-6.8.8.1-85.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-85.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-85.1 libMagick++-6_Q16-3-32bit-6.8.8.1-85.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-85.1 libMagick++-devel-32bit-6.8.8.1-85.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-85.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-85.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-85.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-85.1 References: https://www.suse.com/security/cve/CVE-2017-12805.html https://www.suse.com/security/cve/CVE-2017-12806.html https://www.suse.com/security/cve/CVE-2019-10131.html https://www.suse.com/security/cve/CVE-2019-11470.html https://www.suse.com/security/cve/CVE-2019-11472.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://www.suse.com/security/cve/CVE-2019-11597.html https://www.suse.com/security/cve/CVE-2019-11598.html https://bugzilla.suse.com/1133204 https://bugzilla.suse.com/1133205 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501 https://bugzilla.suse.com/1134075 https://bugzilla.suse.com/1135232 https://bugzilla.suse.com/1135236 https://bugzilla.suse.com/1136183 https://bugzilla.suse.com/1136732 https://bugzilla.suse.com/1138425 https://bugzilla.suse.com/1138464

1 0

openSUSE-RU-2019:1684-1: moderate: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1684-1 Rating: moderate References: #1048392 #1139409 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for release-notes-openSUSE fixes the following issues: release notes version 42.3.20190626 (tracked in boo#1139409): - Enable product deprecation notice - Updated translations (Arabic, Bulgarian, Catalan, Chinese (China), Chinese (Taiwan), Czech, Danish, Dutch, Finnish, French, Galician, German, Greek, Hindi, Indonesian, Italian, Japanese, Marathi, Polish, Portuguese (Brazil), Russian, Serbian, Slovak, Spanish, Swedish, Turkish, Ukrainian) - Document fixes and changed notes: - Removed "Dolphin/Konqueror: Extended Permission Bits" (boo#1048392) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1684=1 Package List: - openSUSE Leap 42.3 (noarch): release-notes-openSUSE-42.3.20190626-9.1 References: https://bugzilla.suse.com/1048392 https://bugzilla.suse.com/1139409

1 0

openSUSE-RU-2019:1681-1: moderate: Recommended update for cloud-init, dhcp
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for cloud-init, dhcp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1681-1 Rating: moderate References: #1087331 #1095627 #1097388 #1099340 #1101894 #1111427 #1114160 #1116767 #1119397 #1121878 #1123694 #1125950 #1125992 #1126101 #1132692 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 15 recommended fixes can now be installed. Description: This update for cloud-init, dhcp provides the following fixes: Changes to cloud-init: - When the user configures a new rules file for network devices, the rules may not apply immediately, so trigger udevadm. (bsc#1125950) - Fix the order of calls when writing routes so that the SUSE implementation of route config file writing has precedence over the default implementation. (bsc#1125992) - Use the proper name to designate IPv6 addresses in ifcfg-* files. (bsc#1126101) - Drop a '-' in the route file for the last column. (bsc#1123694) - Make sure the resulting resolv.conf file is not empty. (bsc#1119397) - Update to version 18.5 (bsc#1121878, bsc#1116767): * Add cloud-id binary to packages for SUSE. * azure: Accept variation in error msg from mount for ntfs volumes. * azure: Add apply_network_config option to disable network from IMDS. * azure: Add udev rules to create cloud-init Gen2 disk name symlinks. * azure: Detect vnet migration via netlink media change event. * azure: Fix a copy and paste error in error handling when reading azure ovf. * azure: Fix a regression introduced when persisting ephemeral dhcp lease. * azure: _poll_imds only retry on 404, failing on timeout. * azure: Remove /etc/netplan/90-hotplug-azure.yaml when net from IMDS. * azure: Report ready to fabric after reprovision and reduce logging. * azure: Retry imds polling on requests.Timeout. * config: On ubuntu select cloud archive mirrors for armel, armhf, arm64. * dhclient-hook: Clean it up, add tests and fix a bug on 'down' event. * doc: Change dns_nameserver property to dns_nameservers. * docs: Remove colon from network v1 config example. * instance-data: Add standard keys platform and subplatform. Refactor ec2. * instance-data: Fallback to instance-data.json if sensitive is absent. * logs: collect-logs ignore instance-data-sensitive.json on non-root user * net: Ephemeral*Network: Add connectivity check via URL. * net: Ignore nics that have "zero" mac address. * net: Render 'metric' values in per-subnet routes. * NoCloud: Allow top level 'network' key in network-config. * ovf: Fix ovf network config generation gateway/routes. * ovf: Identify label iso9660 filesystems with label 'OVF ENV'. * query: Better error when missing read permission on instance-data. * resizefs: Prefix discovered devpath with '/dev/' when path does not exist. * systemd: On SUSE ensure cloud-init.service runs before wicked. * tools: Add cloud-id command line utility. * Update detection of openSUSE variants. * write_files: Add support for appending to files. - Fix a decoding error that could cause persisting the metadata to fail. (bsc#1101894) - Fix a problem that could cause static network to be configured with BOOTPROTO=none. (bsc#1114160) - Changes from 18.4 (bsc#1087331, bsc#1097388, bsc#1111427, bsc#1095627): * Avoid Python 3 dependency when building for distros with Python 2 support. * Add dhcp-client as requirement as cloud-init uses dhclient to setup a temporary network for metadata retrieval. (fate#327672) * Use ds._crawled_metadata instance attribute if set when writing instance-data.json. * ec2: Update crawled metadata and add standardized keys. * lxd: Adjust to snap installed lxd. * Add support for Infiniband network interfaces (IPoIB). * cli: Add cloud-init query subcommand to query instance metadata. * stages: Fix bug causing datasource to have incorrect sys_cfg. * net_util: Ensure static configurations have netmask in translate_network result. * Fall back to root:root on syslog permissions if other options fail. * OpenStack: Support setting mac address on bond. * EphemeralIPv4Network: Be more explicit when adding default route. * OpenStack: Support reading of newer versions of metadata. * OpenStack: Fix a bug that was causing causing 'latest' version to be used from network. * user-data: Use jinja template to render instance-data.json in cloud-config. * config: Disable ssh access to a configured user account. * sysconfig: Refactor sysconfig to accept distro specific templates paths. * hyperv_reporting_handler: Simplify threaded publisher. * VMWare: Fix a network config bug in vm with static IPv4 and no gateway. * logging: Add logging config type hyperv for reporting via Azure KVP * Add datasource Oracle Compute Infrastructure (OCI). * azure: Allow azure to generate network configuration from IMDS per boot. * Scaleway: Add network configuration to the DataSource. * netplan: Correctly render macaddress on a bonds and bridges when provided. * tools: Add 'net-convert' subcommand command to 'cloud-init devel'. * Use typeset or local in profile.d scripts. * OpenNebula: Fix null gateway6. * tools: add '--debug' to tools/net-convert.py * update_metadata: A datasource can support network re-config every boot. * Retry on failed import of gpg receive keys. * tools: Fix run-container when neither source or binary package requested. - Changes from 18.3: * Explicitly prevent `sudo` access for user module. * lxd: Delete default network and detach device if lxd-init created them. * openstack: Avoid unneeded metadata probe on non-openstack platforms. * stages: Fix tracebacks if a module stage is undefined or empty. * Be safer on string/bytes when writing multipart user-data to disk. * Fix get_proc_env for pids that have non-utf8 content in environment. * netplan: Fix mtu if provided by network config for all rendered types. * subp: Support combine_capture argument. * util: Add get_linux_distro function to replace platform.dist * Do not use the systemd_prefix macro, not available in this environment. * openstack: Allow discovery in init-local using dhclient in a sandbox. * yaml_load/schema: Add invalid line and column nums to error message. * Azure: Ignore NTFS mount errors when checking ephemeral drive. * cc_mounts: Do not add devices to fstab that are already present. * ds-identify: Ensure that we have certain tokens in PATH. * read_file_or_url: Move to url_helper, fix bug in its FileResponse. * ds-identify: Recognize container-other as a container. * ds-identify: Remove duplicate call to is_ds_enabled. * azure: Add reported ready marker file. * netinfo: Fix netdev_pformat when a nic does not have an address assigned. * collect-logs: Add -v flag, write to stderr, limit journal to single boot. * IBMCloud: Disable config-drive and nocloud only if IBMCloud is enabled. * Add reporting events and log_time around early source of blocking time. * IBMCloud: recognize provisioning environment during debug boots. * net: Detect unstable network names and trigger a settle if needed. * sysconfig: dhcp6 subnet type should not imply dhcpv4. * schema: In validation, raise ImportError if strict but no jsonschema. * set_passwords: Add newline to end of sshd config, only restart if updated. * net: Depend on iproute2's ip instead of net-tools ifconfig or route. * renderer: Support unicode in render_from_file. * Implement ntp client spec with auto support for distro selection. * apport: Add Brightbox, IBM, LXD, and OpenTelekomCloud to list of clouds. * tests: Fix ec2 integration network metadata validation. * cc_resizefs, util: Handle no /dev/zfs. - The distribution indicator is set to SUSE during template expansion. Do not replace anything set to Ubuntu. - Do not run cloud-init after network-online, this breaks functionality in cloud-init. Certain parts of the code running in this phase expect to run before the network is on-line. - Root should not be enabled by default. Image builders/users that want root access by default should provide an appropriate configuration file during image build or image setup. - Set distribution default to OpenSUSE/SLES. (bsc#1099340) - Run metadata detection after network-online. (bsc#1097388) - Properly accumulate all the defined routes for a given network device. Previously only the last defined route was written to the routes file. (bsc#1132692) - Write the udev rules to a different file than the default. (bsc#1125950) - Settle udev if not all configured devices are in the device tree to avoid race a condition between udev and cloud-init. (bsc#1125950) Changes in dhcp: - No changes, just being released together to be included in CaaS Platform. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1681=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): dhcp-4.3.3-11.9.1 dhcp-client-4.3.3-11.9.1 dhcp-client-debuginfo-4.3.3-11.9.1 dhcp-debuginfo-4.3.3-11.9.1 dhcp-debugsource-4.3.3-11.9.1 dhcp-devel-4.3.3-11.9.1 dhcp-doc-4.3.3-11.9.1 dhcp-relay-4.3.3-11.9.1 dhcp-relay-debuginfo-4.3.3-11.9.1 dhcp-server-4.3.3-11.9.1 dhcp-server-debuginfo-4.3.3-11.9.1 - openSUSE Leap 42.3 (x86_64): cloud-init-18.5-40.1 cloud-init-config-suse-18.5-40.1 cloud-init-doc-18.5-40.1 References: https://bugzilla.suse.com/1087331 https://bugzilla.suse.com/1095627 https://bugzilla.suse.com/1097388 https://bugzilla.suse.com/1099340 https://bugzilla.suse.com/1101894 https://bugzilla.suse.com/1111427 https://bugzilla.suse.com/1114160 https://bugzilla.suse.com/1116767 https://bugzilla.suse.com/1119397 https://bugzilla.suse.com/1121878 https://bugzilla.suse.com/1123694 https://bugzilla.suse.com/1125950 https://bugzilla.suse.com/1125992 https://bugzilla.suse.com/1126101 https://bugzilla.suse.com/1132692

1 0

openSUSE-RU-2019:1679-1: moderate: Recommended update for rapidjson
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for rapidjson ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1679-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rapidjson fixes the following issues: Added rapidjson version 1.1.0: * Added JSON Pointer * Added JSON Schema * Added relaxed JSON syntax (comment, trailing comma, NaN/Infinity) * Iterating array/object with C++11 Range-based for loop * Reduce memory overhead of each Value from 24 bytes to 16 bytes in x86-64 architecture. Full changeset at https://github.com/miloyip/rapidjson/releases/tag/v1.1.0 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1679=1 Package List: - openSUSE Leap 15.0 (noarch): rapidjson-devel-1.1.0-lp150.2.1 References:

1 0

openSUSE-RU-2019:1680-1: moderate: Recommended update for binutils
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for binutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1680-1 Rating: moderate References: #1137271 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for binutils fixes the following issues: - Add support for new IBM zSeries z13 instructions. (fate#327074, jsc#SLE-6206, bsc#1137271) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1680=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): binutils-2.31-22.1 binutils-debuginfo-2.31-22.1 binutils-debugsource-2.31-22.1 binutils-devel-2.31-22.1 binutils-gold-2.31-22.1 binutils-gold-debuginfo-2.31-22.1 cross-aarch64-binutils-2.31-22.1 cross-aarch64-binutils-debuginfo-2.31-22.1 cross-aarch64-binutils-debugsource-2.31-22.1 cross-arm-binutils-2.31-22.1 cross-arm-binutils-debuginfo-2.31-22.1 cross-arm-binutils-debugsource-2.31-22.1 cross-avr-binutils-2.31-22.1 cross-avr-binutils-debuginfo-2.31-22.1 cross-avr-binutils-debugsource-2.31-22.1 cross-hppa-binutils-2.31-22.1 cross-hppa-binutils-debuginfo-2.31-22.1 cross-hppa-binutils-debugsource-2.31-22.1 cross-hppa64-binutils-2.31-22.1 cross-hppa64-binutils-debuginfo-2.31-22.1 cross-hppa64-binutils-debugsource-2.31-22.1 cross-ia64-binutils-2.31-22.1 cross-ia64-binutils-debuginfo-2.31-22.1 cross-ia64-binutils-debugsource-2.31-22.1 cross-m68k-binutils-2.31-22.1 cross-m68k-binutils-debuginfo-2.31-22.1 cross-m68k-binutils-debugsource-2.31-22.1 cross-mips-binutils-2.31-22.1 cross-mips-binutils-debuginfo-2.31-22.1 cross-mips-binutils-debugsource-2.31-22.1 cross-ppc-binutils-2.31-22.1 cross-ppc-binutils-debuginfo-2.31-22.1 cross-ppc-binutils-debugsource-2.31-22.1 cross-ppc64-binutils-2.31-22.1 cross-ppc64-binutils-debuginfo-2.31-22.1 cross-ppc64-binutils-debugsource-2.31-22.1 cross-ppc64le-binutils-2.31-22.1 cross-ppc64le-binutils-debuginfo-2.31-22.1 cross-ppc64le-binutils-debugsource-2.31-22.1 cross-s390-binutils-2.31-22.1 cross-s390-binutils-debuginfo-2.31-22.1 cross-s390-binutils-debugsource-2.31-22.1 cross-s390x-binutils-2.31-22.1 cross-s390x-binutils-debuginfo-2.31-22.1 cross-s390x-binutils-debugsource-2.31-22.1 cross-sparc-binutils-2.31-22.1 cross-sparc-binutils-debuginfo-2.31-22.1 cross-sparc-binutils-debugsource-2.31-22.1 cross-sparc64-binutils-2.31-22.1 cross-sparc64-binutils-debuginfo-2.31-22.1 cross-sparc64-binutils-debugsource-2.31-22.1 cross-spu-binutils-2.31-22.1 cross-spu-binutils-debuginfo-2.31-22.1 cross-spu-binutils-debugsource-2.31-22.1 - openSUSE Leap 42.3 (x86_64): binutils-devel-32bit-2.31-22.1 cross-i386-binutils-2.31-22.1 cross-i386-binutils-debuginfo-2.31-22.1 cross-i386-binutils-debugsource-2.31-22.1 - openSUSE Leap 42.3 (i586): cross-x86_64-binutils-2.31-22.1 cross-x86_64-binutils-debuginfo-2.31-22.1 cross-x86_64-binutils-debugsource-2.31-22.1 References: https://bugzilla.suse.com/1137271

1 0

openSUSE-RU-2019:1678-1: moderate: Recommended update for trytond
by maintenance＠opensuse.org 01 Jul '19

01 Jul '19

openSUSE Recommended Update: Recommended update for trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1678-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond fixes the following issues: trytond was updated to version 4.2.22 - Bugfix Release This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1678=1 Package List: - openSUSE Backports SLE-15 (noarch): trytond-4.2.22-bp150.2.19.1 References:

1 0