August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810

1 0

openSUSE-SU-2019:1913-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1913-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1913=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.2-lp151.3.3.1 libmariadb-devel-debuginfo-3.1.2-lp151.3.3.1 libmariadb3-3.1.2-lp151.3.3.1 libmariadb3-debuginfo-3.1.2-lp151.3.3.1 libmariadb_plugins-3.1.2-lp151.3.3.1 libmariadb_plugins-debuginfo-3.1.2-lp151.3.3.1 libmariadbprivate-3.1.2-lp151.3.3.1 libmariadbprivate-debuginfo-3.1.2-lp151.3.3.1 libmysqld-devel-10.2.25-lp151.2.3.1 libmysqld19-10.2.25-lp151.2.3.1 libmysqld19-debuginfo-10.2.25-lp151.2.3.1 mariadb-10.2.25-lp151.2.3.1 mariadb-bench-10.2.25-lp151.2.3.1 mariadb-bench-debuginfo-10.2.25-lp151.2.3.1 mariadb-client-10.2.25-lp151.2.3.1 mariadb-client-debuginfo-10.2.25-lp151.2.3.1 mariadb-connector-c-debugsource-3.1.2-lp151.3.3.1 mariadb-debuginfo-10.2.25-lp151.2.3.1 mariadb-debugsource-10.2.25-lp151.2.3.1 mariadb-galera-10.2.25-lp151.2.3.1 mariadb-test-10.2.25-lp151.2.3.1 mariadb-test-debuginfo-10.2.25-lp151.2.3.1 mariadb-tools-10.2.25-lp151.2.3.1 mariadb-tools-debuginfo-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.2-lp151.3.3.1 libmariadb3-32bit-debuginfo-3.1.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035

1 0

openSUSE-SU-2019:1898-1: important: Security update for kconfig, kdelibs4
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for kconfig, kdelibs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1898-1 Rating: important References: #1144600 Cross-References: CVE-2019-14744 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kconfig, kdelibs4 fixes the following issues: - CVE-2019-14744: Fixed a command execution by an shell expansion (boo#1144600). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1898=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kconf_update5-5.55.0-bp151.3.8.1 kconfig-devel-5.55.0-bp151.3.8.1 kdelibs4-4.14.38-bp151.9.8.2 kdelibs4-branding-upstream-4.14.38-bp151.9.8.2 kdelibs4-core-4.14.38-bp151.9.8.2 kdelibs4-core-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debugsource-4.14.38-bp151.9.8.2 kdelibs4-doc-4.14.38-bp151.9.8.2 kdelibs4-doc-debuginfo-4.14.38-bp151.9.8.2 libKF5ConfigCore5-5.55.0-bp151.3.8.1 libKF5ConfigGui5-5.55.0-bp151.3.8.1 libkde4-4.14.38-bp151.9.8.2 libkde4-debuginfo-4.14.38-bp151.9.8.2 libkde4-devel-4.14.38-bp151.9.8.2 libkde4-devel-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-4.14.38-bp151.9.8.2 libkdecore4-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-devel-4.14.38-bp151.9.8.2 libkdecore4-devel-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall-devel-4.14.38-bp151.9.8.2 libksuseinstall1-4.14.38-bp151.9.8.2 libksuseinstall1-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): kconfig-devel-64bit-5.55.0-bp151.3.8.1 libKF5ConfigCore5-64bit-5.55.0-bp151.3.8.1 libKF5ConfigGui5-64bit-5.55.0-bp151.3.8.1 libkde4-64bit-4.14.38-bp151.9.8.2 libkde4-64bit-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-64bit-4.14.38-bp151.9.8.2 libkdecore4-64bit-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (noarch): kdelibs4-apidocs-4.14.38-bp151.9.8.1 libKF5ConfigCore5-lang-5.55.0-bp151.3.8.1 References: https://www.suse.com/security/cve/CVE-2019-14744.html https://bugzilla.suse.com/1144600

1 0

openSUSE-SU-2019:1903-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1903-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1903=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.100-lp150.229.1 chromedriver-debuginfo-76.0.3809.100-lp150.229.1 chromium-76.0.3809.100-lp150.229.1 chromium-debuginfo-76.0.3809.100-lp150.229.1 chromium-debugsource-76.0.3809.100-lp150.229.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242

1 0

openSUSE-SU-2019:1915-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1915-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1915=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmariadb-devel-3.1.2-lp150.10.1 libmariadb-devel-debuginfo-3.1.2-lp150.10.1 libmariadb3-3.1.2-lp150.10.1 libmariadb3-debuginfo-3.1.2-lp150.10.1 libmariadb_plugins-3.1.2-lp150.10.1 libmariadb_plugins-debuginfo-3.1.2-lp150.10.1 libmariadbprivate-3.1.2-lp150.10.1 libmariadbprivate-debuginfo-3.1.2-lp150.10.1 libmysqld-devel-10.2.25-lp150.2.13.1 libmysqld19-10.2.25-lp150.2.13.1 libmysqld19-debuginfo-10.2.25-lp150.2.13.1 mariadb-10.2.25-lp150.2.13.1 mariadb-bench-10.2.25-lp150.2.13.1 mariadb-bench-debuginfo-10.2.25-lp150.2.13.1 mariadb-client-10.2.25-lp150.2.13.1 mariadb-client-debuginfo-10.2.25-lp150.2.13.1 mariadb-connector-c-debugsource-3.1.2-lp150.10.1 mariadb-debuginfo-10.2.25-lp150.2.13.1 mariadb-debugsource-10.2.25-lp150.2.13.1 mariadb-galera-10.2.25-lp150.2.13.1 mariadb-test-10.2.25-lp150.2.13.1 mariadb-test-debuginfo-10.2.25-lp150.2.13.1 mariadb-tools-10.2.25-lp150.2.13.1 mariadb-tools-debuginfo-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libmariadb3-32bit-3.1.2-lp150.10.1 libmariadb3-32bit-debuginfo-3.1.2-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035

1 0

openSUSE-RU-2019:1890-1: moderate: Recommended update for cluster-glue
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for cluster-glue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1890-1 Rating: moderate References: #1131545 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cluster-glue fixes the following issues: - Directory /var/run/heartbeat/rsctmp will now get created if it doesn't exist (bsc#1131545) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1890=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cluster-glue-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue-devel-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue2-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libglue-devel-64bit-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue2-64bit-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 References: https://bugzilla.suse.com/1131545

1 0

openSUSE-SU-2019:1891-1: moderate: Security update for libqb
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for libqb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1891-1 Rating: moderate References: #1137835 Cross-References: CVE-2019-12779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqb fixes the following issue: Security issue fixed: - CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835). This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1891=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libqb-devel-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tests-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tools-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-1.0.3+20190326.a521604-bp151.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libqb-devel-64bit-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-64bit-1.0.3+20190326.a521604-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12779.html https://bugzilla.suse.com/1137835

1 0

openSUSE-RU-2019:1896-1: moderate: Recommended update for dolphin
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for dolphin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1896-1 Rating: moderate References: #1139359 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dolphin fixes the following issues: - Updated Lithuanian translations (boo#1139359). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1896=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): dolphin-18.12.3-bp151.3.3.4 dolphin-devel-18.12.3-bp151.3.3.4 dolphin-part-18.12.3-bp151.3.3.4 libdolphinvcs5-18.12.3-bp151.3.3.4 - openSUSE Backports SLE-15-SP1 (noarch): dolphin-part-lang-18.12.3-bp151.3.3.4 References: https://bugzilla.suse.com/1139359

1 0

openSUSE-SU-2019:1894-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1894-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1894=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-bp151.3.3.3 irssi-devel-1.1.3-bp151.3.3.3 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-SU-2019:1895-1: moderate: Security update for ledger
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for ledger ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1895-1 Rating: moderate References: #1052478 #1052484 #1105084 Cross-References: CVE-2017-12481 CVE-2017-12482 CVE-2017-2807 CVE-2017-2808 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ledger fixes the following issues: ledger was updated to 3.1.3: + Properly reject postings with a comment right after the flag (bug #1753) + Make sorting order of lot information deterministic (bug #1747) + Fix bug in tag value parsing (bug #1702) + Remove the org command, which was always a hack to begin with (bug #1706) + Provide Docker information in README + Various small documentation improvements This also includes the update to 3.1.2: + Increase maximum length for regex from 255 to 4095 (bug #981) + Initialize periods from from/since clause rather than earliest transaction date (bug #1159) + Check balance assertions against the amount after the posting (bug #1147) + Allow balance assertions with multiple posts to same account (bug #1187) + Fix period duration of "every X days" and similar statements (bug #370) + Make option --force-color not require --color anymore (bug #1109) + Add quoted_rfc4180 to allow CVS output with RFC 4180 compliant quoting. + Add support for --prepend-format in accounts command + Fix handling of edge cases in trim function (bug #520) + Fix auto xact posts not getting applied to account total during journal parse (bug #552) + Transfer null_post flags to generated postings + Fix segfault when using --market with --group-by + Use amount_width variable for budget report + Keep pending items in budgets until the last day they apply + Fix bug where .total used in value expressions breaks totals + Make automated transactions work with assertions (bug #1127) + Improve parsing of date tokens (bug #1626) + Don't attempt to invert a value if it's already zero (bug #1703) + Do not parse user-specified init-file twice + Fix parsing issue of effective dates (bug #1722, TALOS-2017-0303, CVE-2017-2807) + Fix use-after-free issue with deferred postings (bug #1723, TALOS-2017-0304, CVE-2017-2808) + Fix possible stack overflow in option parsing routine (bug #1222, CVE-2017-12481) + Fix possible stack overflow in date parsing routine (bug #1224, CVE-2017-12482) + Fix use-after-free when using --gain (bug #541) + Python: Removed double quotes from Unicode values. + Python: Ensure that parse errors produce useful RuntimeErrors + Python: Expose journal expand_aliases + Python: Expose journal_t::register_account + Improve bash completion + Emacs Lisp files have been moved to https://github.com/ledger/ledger-mode + Various documentation improvements This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1895=1 Package List: - openSUSE Backports SLE-15-SP1 (ppc64le s390x x86_64): ledger-3.1.3-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-12481.html https://www.suse.com/security/cve/CVE-2017-12482.html https://www.suse.com/security/cve/CVE-2017-2807.html https://www.suse.com/security/cve/CVE-2017-2808.html https://bugzilla.suse.com/1052478 https://bugzilla.suse.com/1052484 https://bugzilla.suse.com/1105084

1 0