August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1899-1: moderate: Recommended update for keepassxc
by maintenance＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Recommended Update: Recommended update for keepassxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1899-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for keepassxc fixes the following issues: keepassxc updated to 2.4.3: - Fix library loading issues in the Snap and macOS releases [#3247] - Fix various keyboard navigation issues [#3248] - Fix main window toggling regression when clicking the tray icon on KDE [#3258] - Add documentation for keyboard shortcuts to source code distribution [#3215] This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1899=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): keepassxc-2.4.3-bp151.3.3.3 - openSUSE Backports SLE-15-SP1 (noarch): keepassxc-lang-2.4.3-bp151.3.3.3 References:

1 0

openSUSE-SU-2019:1914-1: important: Security update for polkit
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1914-1 Rating: important References: #1121826 Cross-References: CVE-2019-6133 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2019-6133: Fixed improper caching of auth decisions, which could bypass uid checking in the interactive backend (bsc#1121826). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1914=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1914=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpolkit0-0.114-lp151.5.3.1 libpolkit0-debuginfo-0.114-lp151.5.3.1 polkit-0.114-lp151.5.3.1 polkit-debuginfo-0.114-lp151.5.3.1 polkit-debugsource-0.114-lp151.5.3.1 polkit-devel-0.114-lp151.5.3.1 polkit-devel-debuginfo-0.114-lp151.5.3.1 typelib-1_0-Polkit-1_0-0.114-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libpolkit0-32bit-0.114-lp151.5.3.1 libpolkit0-32bit-debuginfo-0.114-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): polkit-doc-0.114-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.10.1 libpolkit0-debuginfo-0.114-lp150.2.10.1 polkit-0.114-lp150.2.10.1 polkit-debuginfo-0.114-lp150.2.10.1 polkit-debugsource-0.114-lp150.2.10.1 polkit-devel-0.114-lp150.2.10.1 polkit-devel-debuginfo-0.114-lp150.2.10.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.10.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.10.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.10.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2019-6133.html https://bugzilla.suse.com/1121826

1 0

openSUSE-SU-2019:1901-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1901-1 Rating: important References: #1143492 #1144625 Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852 CVE-2019-5853 CVE-2019-5854 CVE-2019-5855 CVE-2019-5856 CVE-2019-5857 CVE-2019-5858 CVE-2019-5859 CVE-2019-5860 CVE-2019-5861 CVE-2019-5862 CVE-2019-5863 CVE-2019-5864 CVE-2019-5865 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium to version 76.0.3809.87 fixes the following issues: - CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492) - CVE-2019-5860: Use-after-free in PDFium (boo#1143492) - CVE-2019-5853: Memory corruption in regexp length check (boo#1143492) - CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492) - CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492) - CVE-2019-5856: Insufficient checks on filesystem: URI permissions (boo#1143492) - CVE-2019-5855: Integer overflow in PDFium (boo#1143492) - CVE-2019-5865: Site isolation bypass from compromised renderer (boo#1143492) - CVE-2019-5858: Insufficient filtering of Open URL service parameters (boo#1143492) - CVE-2019-5864: Insufficient port filtering in CORS for extensions (boo#1143492) - CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492) - CVE-2019-5861: Click location incorrectly checked (boo#1143492) - CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492) - CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492) - CVE-2019-5852: Object leak of utility functions (boo#1143492) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1901=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.87-bp151.3.3.3 chromium-76.0.3809.87-bp151.3.3.3 References: https://www.suse.com/security/cve/CVE-2019-5850.html https://www.suse.com/security/cve/CVE-2019-5851.html https://www.suse.com/security/cve/CVE-2019-5852.html https://www.suse.com/security/cve/CVE-2019-5853.html https://www.suse.com/security/cve/CVE-2019-5854.html https://www.suse.com/security/cve/CVE-2019-5855.html https://www.suse.com/security/cve/CVE-2019-5856.html https://www.suse.com/security/cve/CVE-2019-5857.html https://www.suse.com/security/cve/CVE-2019-5858.html https://www.suse.com/security/cve/CVE-2019-5859.html https://www.suse.com/security/cve/CVE-2019-5860.html https://www.suse.com/security/cve/CVE-2019-5861.html https://www.suse.com/security/cve/CVE-2019-5862.html https://www.suse.com/security/cve/CVE-2019-5863.html https://www.suse.com/security/cve/CVE-2019-5864.html https://www.suse.com/security/cve/CVE-2019-5865.html https://bugzilla.suse.com/1143492 https://bugzilla.suse.com/1144625

1 0

openSUSE-SU-2019:1905-1: important: Security update for dosbox
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for dosbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1905-1 Rating: important References: #1140254 Cross-References: CVE-2019-12594 CVE-2019-7165 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dosbox fixes the following issues: Security issues fixed: - CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254). - CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254). - Several other fixes for out of bounds access and buffer overflows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1905=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1905=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1905=1 Package List: - openSUSE Leap 15.1 (x86_64): dosbox-0.74.3-lp151.3.3.1 dosbox-debuginfo-0.74.3-lp151.3.3.1 dosbox-debugsource-0.74.3-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): dosbox-0.74.3-lp150.2.3.1 dosbox-debuginfo-0.74.3-lp150.2.3.1 dosbox-debugsource-0.74.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): dosbox-0.74.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-12594.html https://www.suse.com/security/cve/CVE-2019-7165.html https://bugzilla.suse.com/1140254

1 0

openSUSE-SU-2019:1908-1: important: Security update for evince
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1908-1 Rating: important References: #1141619 Cross-References: CVE-2019-1010006 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evince fixes the following issues: - CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1908=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1908=1 Package List: - openSUSE Leap 15.1 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): evince-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-debugsource-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 - openSUSE Leap 15.0 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): evince-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-debugsource-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-devel-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp150.3.6.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 libevview3-3-3.26.0+20180128.1bd86963-lp150.3.6.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 nautilus-evince-3.26.0+20180128.1bd86963-lp150.3.6.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp150.3.6.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-1010006.html https://bugzilla.suse.com/1141619

1 0

openSUSE-SU-2019:1911-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1911-1 Rating: important References: #1142825 #1142832 #1142835 Cross-References: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icedtea-web to version 1.7.2 fixes the following issues: Security issues fixed: - CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835) - CVE-2019-10182: Fixed a path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite (bsc#1142825). - CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1911=1 Package List: - openSUSE Leap 15.0 (x86_64): icedtea-web-1.7.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): icedtea-web-javadoc-1.7.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10181.html https://www.suse.com/security/cve/CVE-2019-10182.html https://www.suse.com/security/cve/CVE-2019-10185.html https://bugzilla.suse.com/1142825 https://bugzilla.suse.com/1142832 https://bugzilla.suse.com/1142835

1 0

openSUSE-SU-2019:1912-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1912-1 Rating: important References: #1115375 #1141780 #1141782 #1141783 #1141784 #1141785 #1141786 #1141787 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2842 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk to version 8u222 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2842: Extended AES support (bsc#1141786). - CVE-2019-7317: Improve PNG support (bsc#1141780). - Certificate validation improvements Non-security issue fixed: - Fixed an issue where the installation failed when the manpages are not present (bsc#1115375) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1912=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1912=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-src-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-src-1.8.0.222-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2842.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141786 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141789

1 0

openSUSE-SU-2019:1902-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1902-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1902=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.100-lp151.2.20.1 chromedriver-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-76.0.3809.100-lp151.2.20.1 chromium-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-debugsource-76.0.3809.100-lp151.2.20.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242

1 0

openSUSE-SU-2019:1906-1: important: Security update for python
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1906-1 Rating: important References: #1138459 Cross-References: CVE-2019-10160 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1906=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1906=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.14-lp151.10.3.1 libpython2_7-1_0-debuginfo-2.7.14-lp151.10.3.1 python-2.7.14-lp151.10.3.1 python-base-2.7.14-lp151.10.3.1 python-base-debuginfo-2.7.14-lp151.10.3.1 python-base-debugsource-2.7.14-lp151.10.3.1 python-curses-2.7.14-lp151.10.3.1 python-curses-debuginfo-2.7.14-lp151.10.3.1 python-debuginfo-2.7.14-lp151.10.3.1 python-debugsource-2.7.14-lp151.10.3.1 python-demo-2.7.14-lp151.10.3.1 python-devel-2.7.14-lp151.10.3.1 python-gdbm-2.7.14-lp151.10.3.1 python-gdbm-debuginfo-2.7.14-lp151.10.3.1 python-idle-2.7.14-lp151.10.3.1 python-tk-2.7.14-lp151.10.3.1 python-tk-debuginfo-2.7.14-lp151.10.3.1 python-xml-2.7.14-lp151.10.3.1 python-xml-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.14-lp151.10.3.1 python-doc-pdf-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp151.10.3.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp151.10.3.1 python-32bit-2.7.14-lp151.10.3.1 python-32bit-debuginfo-2.7.14-lp151.10.3.1 python-base-32bit-2.7.14-lp151.10.3.1 python-base-32bit-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.0 (i586 x86_64): python-2.7.14-lp150.6.13.1 python-curses-2.7.14-lp150.6.13.1 python-curses-debuginfo-2.7.14-lp150.6.13.1 python-debuginfo-2.7.14-lp150.6.13.1 python-debugsource-2.7.14-lp150.6.13.1 python-demo-2.7.14-lp150.6.13.1 python-gdbm-2.7.14-lp150.6.13.1 python-gdbm-debuginfo-2.7.14-lp150.6.13.1 python-idle-2.7.14-lp150.6.13.1 python-tk-2.7.14-lp150.6.13.1 python-tk-debuginfo-2.7.14-lp150.6.13.1 - openSUSE Leap 15.0 (x86_64): python-32bit-2.7.14-lp150.6.13.1 python-32bit-debuginfo-2.7.14-lp150.6.13.1 References: https://www.suse.com/security/cve/CVE-2019-10160.html https://bugzilla.suse.com/1138459

1 0

openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.11-20.1 pdns-backend-godbc-4.1.11-20.1 pdns-backend-ldap-4.1.11-20.1 pdns-backend-lua-4.1.11-20.1 pdns-backend-mydns-4.1.11-20.1 pdns-backend-mysql-4.1.11-20.1 pdns-backend-postgresql-4.1.11-20.1 pdns-backend-remote-4.1.11-20.1 pdns-backend-sqlite3-4.1.11-20.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810

1 0

openSUSE-SU-2019:1909-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1909-1 Rating: important References: #1093732 #1094893 #1118586 #1133290 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom: * Initial version 1.0.0 * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1909=1 Package List: - openSUSE Leap 15.0 (noarch): libaom-devel-doc-1.0.0-lp150.2.1 vlc-lang-3.0.7.1-lp150.8.1 - openSUSE Leap 15.0 (x86_64): aom-tools-1.0.0-lp150.2.1 aom-tools-debuginfo-1.0.0-lp150.2.1 libaom-debugsource-1.0.0-lp150.2.1 libaom-devel-1.0.0-lp150.2.1 libaom0-1.0.0-lp150.2.1 libaom0-debuginfo-1.0.0-lp150.2.1 libvlc5-3.0.7.1-lp150.8.1 libvlc5-debuginfo-3.0.7.1-lp150.8.1 libvlccore9-3.0.7.1-lp150.8.1 libvlccore9-debuginfo-3.0.7.1-lp150.8.1 vlc-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-debuginfo-3.0.7.1-lp150.8.1 vlc-debuginfo-3.0.7.1-lp150.8.1 vlc-debugsource-3.0.7.1-lp150.8.1 vlc-devel-3.0.7.1-lp150.8.1 vlc-jack-3.0.7.1-lp150.8.1 vlc-jack-debuginfo-3.0.7.1-lp150.8.1 vlc-noX-3.0.7.1-lp150.8.1 vlc-noX-debuginfo-3.0.7.1-lp150.8.1 vlc-qt-3.0.7.1-lp150.8.1 vlc-qt-debuginfo-3.0.7.1-lp150.8.1 vlc-vdpau-3.0.7.1-lp150.8.1 vlc-vdpau-debuginfo-3.0.7.1-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1093732 https://bugzilla.suse.com/1094893 https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549

1 0

openSUSE-SU-2019:1917-1: important: Security update for gpg2
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1917-1 Rating: important References: #1124847 #1141093 Cross-References: CVE-2019-13050 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gpg2 fixes the following issues: Security issue fixed: - CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093). Non-security issue fixed: - Allow coredumps in X11 desktop sessions (bsc#1124847) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1917=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1917=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gpg2-2.2.5-lp151.6.3.1 gpg2-debuginfo-2.2.5-lp151.6.3.1 gpg2-debugsource-2.2.5-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): gpg2-lang-2.2.5-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.10.1 gpg2-debuginfo-2.2.5-lp150.3.10.1 gpg2-debugsource-2.2.5-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-13050.html https://bugzilla.suse.com/1124847 https://bugzilla.suse.com/1141093

1 0

openSUSE-RU-2019:1900-1: Recommended update for kde-l10n
by maintenance＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Recommended Update: Recommended update for kde-l10n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1900-1 Rating: low References: #1103027 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kde-l10n fixes the following issue: * boo#1103027: Kopete was missing localization This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1900=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): kde-l10n-ar-17.08.3-bp151.5.3.3 kde-l10n-ast-17.08.3-bp151.5.3.3 kde-l10n-bg-17.08.3-bp151.5.3.3 kde-l10n-bs-17.08.3-bp151.5.3.3 kde-l10n-ca-17.08.3-bp151.5.3.3 kde-l10n-caValencia-17.08.3-bp151.5.3.3 kde-l10n-cs-17.08.3-bp151.5.3.3 kde-l10n-da-17.08.3-bp151.5.3.3 kde-l10n-da-data-17.08.3-bp151.5.3.3 kde-l10n-da-doc-17.08.3-bp151.5.3.3 kde-l10n-de-17.08.3-bp151.5.3.3 kde-l10n-de-data-17.08.3-bp151.5.3.3 kde-l10n-de-doc-17.08.3-bp151.5.3.3 kde-l10n-el-17.08.3-bp151.5.3.3 kde-l10n-en_GB-17.08.3-bp151.5.3.3 kde-l10n-en_GB-data-17.08.3-bp151.5.3.3 kde-l10n-en_GB-doc-17.08.3-bp151.5.3.3 kde-l10n-eo-17.08.3-bp151.5.3.3 kde-l10n-es-17.08.3-bp151.5.3.3 kde-l10n-es-data-17.08.3-bp151.5.3.3 kde-l10n-es-doc-17.08.3-bp151.5.3.3 kde-l10n-et-17.08.3-bp151.5.3.3 kde-l10n-et-data-17.08.3-bp151.5.3.3 kde-l10n-et-doc-17.08.3-bp151.5.3.3 kde-l10n-eu-17.08.3-bp151.5.3.3 kde-l10n-fa-17.08.3-bp151.5.3.3 kde-l10n-fi-17.08.3-bp151.5.3.3 kde-l10n-fr-17.08.3-bp151.5.3.3 kde-l10n-fr-data-17.08.3-bp151.5.3.3 kde-l10n-fr-doc-17.08.3-bp151.5.3.3 kde-l10n-ga-17.08.3-bp151.5.3.3 kde-l10n-gl-17.08.3-bp151.5.3.3 kde-l10n-he-17.08.3-bp151.5.3.3 kde-l10n-hi-17.08.3-bp151.5.3.3 kde-l10n-hr-17.08.3-bp151.5.3.3 kde-l10n-hu-17.08.3-bp151.5.3.3 kde-l10n-ia-17.08.3-bp151.5.3.3 kde-l10n-id-17.08.3-bp151.5.3.3 kde-l10n-is-17.08.3-bp151.5.3.3 kde-l10n-it-17.08.3-bp151.5.3.3 kde-l10n-it-data-17.08.3-bp151.5.3.3 kde-l10n-it-doc-17.08.3-bp151.5.3.3 kde-l10n-ja-17.08.3-bp151.5.3.3 kde-l10n-kk-17.08.3-bp151.5.3.3 kde-l10n-km-17.08.3-bp151.5.3.3 kde-l10n-ko-17.08.3-bp151.5.3.3 kde-l10n-lt-17.08.3-bp151.5.3.3 kde-l10n-lv-17.08.3-bp151.5.3.3 kde-l10n-mr-17.08.3-bp151.5.3.3 kde-l10n-nb-17.08.3-bp151.5.3.3 kde-l10n-nds-17.08.3-bp151.5.3.3 kde-l10n-nl-17.08.3-bp151.5.3.3 kde-l10n-nl-data-17.08.3-bp151.5.3.3 kde-l10n-nl-doc-17.08.3-bp151.5.3.3 kde-l10n-nn-17.08.3-bp151.5.3.3 kde-l10n-pa-17.08.3-bp151.5.3.3 kde-l10n-pl-17.08.3-bp151.5.3.3 kde-l10n-pl-data-17.08.3-bp151.5.3.3 kde-l10n-pl-doc-17.08.3-bp151.5.3.3 kde-l10n-pt-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-data-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-doc-17.08.3-bp151.5.3.3 kde-l10n-ro-17.08.3-bp151.5.3.3 kde-l10n-ru-17.08.3-bp151.5.3.3 kde-l10n-ru-data-17.08.3-bp151.5.3.3 kde-l10n-ru-doc-17.08.3-bp151.5.3.3 kde-l10n-sk-17.08.3-bp151.5.3.3 kde-l10n-sl-17.08.3-bp151.5.3.3 kde-l10n-sr-17.08.3-bp151.5.3.3 kde-l10n-sv-17.08.3-bp151.5.3.3 kde-l10n-sv-data-17.08.3-bp151.5.3.3 kde-l10n-sv-doc-17.08.3-bp151.5.3.3 kde-l10n-tr-17.08.3-bp151.5.3.3 kde-l10n-ug-17.08.3-bp151.5.3.3 kde-l10n-uk-17.08.3-bp151.5.3.3 kde-l10n-uk-data-17.08.3-bp151.5.3.3 kde-l10n-uk-doc-17.08.3-bp151.5.3.3 kde-l10n-wa-17.08.3-bp151.5.3.3 kde-l10n-zh_CN-17.08.3-bp151.5.3.3 kde-l10n-zh_TW-17.08.3-bp151.5.3.3 References: https://bugzilla.suse.com/1103027

1 0

openSUSE-SU-2019:1916-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1916-1 Rating: important References: #1115375 #1140461 #1141780 #1141781 #1141782 #1141783 #1141784 #1141785 #1141787 #1141788 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2818 CVE-2019-2821 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-7317: Improve PNG support options (bsc#1141780). - CVE-2019-2818: Better Poly1305 support (bsc#1141788). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2821: Improve TLS negotiation (bsc#1141781). - Certificate validation improvements Non-security issues fixed: - Do not fail installation when the manpages are not present (bsc#1115375) - Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1916=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1916=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debugsource-11.0.4.0-lp151.3.6.1 java-11-openjdk-demo-11.0.4.0-lp151.3.6.1 java-11-openjdk-devel-11.0.4.0-lp151.3.6.1 java-11-openjdk-headless-11.0.4.0-lp151.3.6.1 java-11-openjdk-jmods-11.0.4.0-lp151.3.6.1 java-11-openjdk-src-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp150.2.25.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debugsource-11.0.4.0-lp150.2.25.1 java-11-openjdk-demo-11.0.4.0-lp150.2.25.1 java-11-openjdk-devel-11.0.4.0-lp150.2.25.1 java-11-openjdk-headless-11.0.4.0-lp150.2.25.1 java-11-openjdk-jmods-11.0.4.0-lp150.2.25.1 java-11-openjdk-src-11.0.4.0-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2818.html https://www.suse.com/security/cve/CVE-2019-2821.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1140461 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141781 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141788 https://bugzilla.suse.com/1141789

1 0

openSUSE-SU-2019:1897-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1897-1 Rating: important References: #1118586 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1897=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.7.1-bp151.5.3.3 libvlccore9-3.0.7.1-bp151.5.3.3 vlc-3.0.7.1-bp151.5.3.3 vlc-codec-gstreamer-3.0.7.1-bp151.5.3.3 vlc-devel-3.0.7.1-bp151.5.3.3 vlc-jack-3.0.7.1-bp151.5.3.3 vlc-noX-3.0.7.1-bp151.5.3.3 vlc-qt-3.0.7.1-bp151.5.3.3 vlc-vdpau-3.0.7.1-bp151.5.3.3 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.7.1-bp151.5.3.3 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549

1 0

openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810

1 0

openSUSE-SU-2019:1913-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1913-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1913=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.2-lp151.3.3.1 libmariadb-devel-debuginfo-3.1.2-lp151.3.3.1 libmariadb3-3.1.2-lp151.3.3.1 libmariadb3-debuginfo-3.1.2-lp151.3.3.1 libmariadb_plugins-3.1.2-lp151.3.3.1 libmariadb_plugins-debuginfo-3.1.2-lp151.3.3.1 libmariadbprivate-3.1.2-lp151.3.3.1 libmariadbprivate-debuginfo-3.1.2-lp151.3.3.1 libmysqld-devel-10.2.25-lp151.2.3.1 libmysqld19-10.2.25-lp151.2.3.1 libmysqld19-debuginfo-10.2.25-lp151.2.3.1 mariadb-10.2.25-lp151.2.3.1 mariadb-bench-10.2.25-lp151.2.3.1 mariadb-bench-debuginfo-10.2.25-lp151.2.3.1 mariadb-client-10.2.25-lp151.2.3.1 mariadb-client-debuginfo-10.2.25-lp151.2.3.1 mariadb-connector-c-debugsource-3.1.2-lp151.3.3.1 mariadb-debuginfo-10.2.25-lp151.2.3.1 mariadb-debugsource-10.2.25-lp151.2.3.1 mariadb-galera-10.2.25-lp151.2.3.1 mariadb-test-10.2.25-lp151.2.3.1 mariadb-test-debuginfo-10.2.25-lp151.2.3.1 mariadb-tools-10.2.25-lp151.2.3.1 mariadb-tools-debuginfo-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.2-lp151.3.3.1 libmariadb3-32bit-debuginfo-3.1.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035

1 0

openSUSE-SU-2019:1898-1: important: Security update for kconfig, kdelibs4
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for kconfig, kdelibs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1898-1 Rating: important References: #1144600 Cross-References: CVE-2019-14744 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kconfig, kdelibs4 fixes the following issues: - CVE-2019-14744: Fixed a command execution by an shell expansion (boo#1144600). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1898=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kconf_update5-5.55.0-bp151.3.8.1 kconfig-devel-5.55.0-bp151.3.8.1 kdelibs4-4.14.38-bp151.9.8.2 kdelibs4-branding-upstream-4.14.38-bp151.9.8.2 kdelibs4-core-4.14.38-bp151.9.8.2 kdelibs4-core-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debugsource-4.14.38-bp151.9.8.2 kdelibs4-doc-4.14.38-bp151.9.8.2 kdelibs4-doc-debuginfo-4.14.38-bp151.9.8.2 libKF5ConfigCore5-5.55.0-bp151.3.8.1 libKF5ConfigGui5-5.55.0-bp151.3.8.1 libkde4-4.14.38-bp151.9.8.2 libkde4-debuginfo-4.14.38-bp151.9.8.2 libkde4-devel-4.14.38-bp151.9.8.2 libkde4-devel-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-4.14.38-bp151.9.8.2 libkdecore4-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-devel-4.14.38-bp151.9.8.2 libkdecore4-devel-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall-devel-4.14.38-bp151.9.8.2 libksuseinstall1-4.14.38-bp151.9.8.2 libksuseinstall1-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): kconfig-devel-64bit-5.55.0-bp151.3.8.1 libKF5ConfigCore5-64bit-5.55.0-bp151.3.8.1 libKF5ConfigGui5-64bit-5.55.0-bp151.3.8.1 libkde4-64bit-4.14.38-bp151.9.8.2 libkde4-64bit-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-64bit-4.14.38-bp151.9.8.2 libkdecore4-64bit-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (noarch): kdelibs4-apidocs-4.14.38-bp151.9.8.1 libKF5ConfigCore5-lang-5.55.0-bp151.3.8.1 References: https://www.suse.com/security/cve/CVE-2019-14744.html https://bugzilla.suse.com/1144600

1 0

openSUSE-SU-2019:1903-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1903-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1903=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.100-lp150.229.1 chromedriver-debuginfo-76.0.3809.100-lp150.229.1 chromium-76.0.3809.100-lp150.229.1 chromium-debuginfo-76.0.3809.100-lp150.229.1 chromium-debugsource-76.0.3809.100-lp150.229.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242

1 0

openSUSE-SU-2019:1915-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1915-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1915=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmariadb-devel-3.1.2-lp150.10.1 libmariadb-devel-debuginfo-3.1.2-lp150.10.1 libmariadb3-3.1.2-lp150.10.1 libmariadb3-debuginfo-3.1.2-lp150.10.1 libmariadb_plugins-3.1.2-lp150.10.1 libmariadb_plugins-debuginfo-3.1.2-lp150.10.1 libmariadbprivate-3.1.2-lp150.10.1 libmariadbprivate-debuginfo-3.1.2-lp150.10.1 libmysqld-devel-10.2.25-lp150.2.13.1 libmysqld19-10.2.25-lp150.2.13.1 libmysqld19-debuginfo-10.2.25-lp150.2.13.1 mariadb-10.2.25-lp150.2.13.1 mariadb-bench-10.2.25-lp150.2.13.1 mariadb-bench-debuginfo-10.2.25-lp150.2.13.1 mariadb-client-10.2.25-lp150.2.13.1 mariadb-client-debuginfo-10.2.25-lp150.2.13.1 mariadb-connector-c-debugsource-3.1.2-lp150.10.1 mariadb-debuginfo-10.2.25-lp150.2.13.1 mariadb-debugsource-10.2.25-lp150.2.13.1 mariadb-galera-10.2.25-lp150.2.13.1 mariadb-test-10.2.25-lp150.2.13.1 mariadb-test-debuginfo-10.2.25-lp150.2.13.1 mariadb-tools-10.2.25-lp150.2.13.1 mariadb-tools-debuginfo-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libmariadb3-32bit-3.1.2-lp150.10.1 libmariadb3-32bit-debuginfo-3.1.2-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035

1 0

openSUSE-RU-2019:1890-1: moderate: Recommended update for cluster-glue
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for cluster-glue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1890-1 Rating: moderate References: #1131545 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cluster-glue fixes the following issues: - Directory /var/run/heartbeat/rsctmp will now get created if it doesn't exist (bsc#1131545) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1890=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cluster-glue-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue-devel-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue2-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libglue-devel-64bit-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 libglue2-64bit-1.0.12+v1.git.1560323319.fd5a3bef-bp151.2.3.3 References: https://bugzilla.suse.com/1131545

1 0

openSUSE-SU-2019:1891-1: moderate: Security update for libqb
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for libqb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1891-1 Rating: moderate References: #1137835 Cross-References: CVE-2019-12779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqb fixes the following issue: Security issue fixed: - CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835). This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1891=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libqb-devel-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tests-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tools-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-1.0.3+20190326.a521604-bp151.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libqb-devel-64bit-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-64bit-1.0.3+20190326.a521604-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12779.html https://bugzilla.suse.com/1137835

1 0

openSUSE-RU-2019:1896-1: moderate: Recommended update for dolphin
by maintenance＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Recommended Update: Recommended update for dolphin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1896-1 Rating: moderate References: #1139359 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dolphin fixes the following issues: - Updated Lithuanian translations (boo#1139359). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1896=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): dolphin-18.12.3-bp151.3.3.4 dolphin-devel-18.12.3-bp151.3.3.4 dolphin-part-18.12.3-bp151.3.3.4 libdolphinvcs5-18.12.3-bp151.3.3.4 - openSUSE Backports SLE-15-SP1 (noarch): dolphin-part-lang-18.12.3-bp151.3.3.4 References: https://bugzilla.suse.com/1139359

1 0

openSUSE-SU-2019:1894-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1894-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1894=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-bp151.3.3.3 irssi-devel-1.1.3-bp151.3.3.3 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802

1 0

openSUSE-SU-2019:1895-1: moderate: Security update for ledger
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for ledger ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1895-1 Rating: moderate References: #1052478 #1052484 #1105084 Cross-References: CVE-2017-12481 CVE-2017-12482 CVE-2017-2807 CVE-2017-2808 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ledger fixes the following issues: ledger was updated to 3.1.3: + Properly reject postings with a comment right after the flag (bug #1753) + Make sorting order of lot information deterministic (bug #1747) + Fix bug in tag value parsing (bug #1702) + Remove the org command, which was always a hack to begin with (bug #1706) + Provide Docker information in README + Various small documentation improvements This also includes the update to 3.1.2: + Increase maximum length for regex from 255 to 4095 (bug #981) + Initialize periods from from/since clause rather than earliest transaction date (bug #1159) + Check balance assertions against the amount after the posting (bug #1147) + Allow balance assertions with multiple posts to same account (bug #1187) + Fix period duration of "every X days" and similar statements (bug #370) + Make option --force-color not require --color anymore (bug #1109) + Add quoted_rfc4180 to allow CVS output with RFC 4180 compliant quoting. + Add support for --prepend-format in accounts command + Fix handling of edge cases in trim function (bug #520) + Fix auto xact posts not getting applied to account total during journal parse (bug #552) + Transfer null_post flags to generated postings + Fix segfault when using --market with --group-by + Use amount_width variable for budget report + Keep pending items in budgets until the last day they apply + Fix bug where .total used in value expressions breaks totals + Make automated transactions work with assertions (bug #1127) + Improve parsing of date tokens (bug #1626) + Don't attempt to invert a value if it's already zero (bug #1703) + Do not parse user-specified init-file twice + Fix parsing issue of effective dates (bug #1722, TALOS-2017-0303, CVE-2017-2807) + Fix use-after-free issue with deferred postings (bug #1723, TALOS-2017-0304, CVE-2017-2808) + Fix possible stack overflow in option parsing routine (bug #1222, CVE-2017-12481) + Fix possible stack overflow in date parsing routine (bug #1224, CVE-2017-12482) + Fix use-after-free when using --gain (bug #541) + Python: Removed double quotes from Unicode values. + Python: Ensure that parse errors produce useful RuntimeErrors + Python: Expose journal expand_aliases + Python: Expose journal_t::register_account + Improve bash completion + Emacs Lisp files have been moved to https://github.com/ledger/ledger-mode + Various documentation improvements This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1895=1 Package List: - openSUSE Backports SLE-15-SP1 (ppc64le s390x x86_64): ledger-3.1.3-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-12481.html https://www.suse.com/security/cve/CVE-2017-12482.html https://www.suse.com/security/cve/CVE-2017-2807.html https://www.suse.com/security/cve/CVE-2017-2808.html https://bugzilla.suse.com/1052478 https://bugzilla.suse.com/1052484 https://bugzilla.suse.com/1105084

1 0