August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2037-1: moderate: Recommended update for mksusecd
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for mksusecd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2037-1 Rating: moderate References: #1000947 #1093145 #1097814 #1100236 #1139561 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for mksusecd fixes the following issues: - Embed gpg signature of checksum metadata into image. (bsc#1139561) - Set the default to unsigned images. - Add --enable-repos option. - Support aarch64 media. - No longer assume repo-md repositories don't include the installer. (bsc#1093145) - Adjust isozipl according to the changes of isoinfo. (bsc#1097814) - Don't miss zstd compression module. (bsc#1100236) - Keep some meta data for media checking even if the filesystem does not use iso9660. (bsc#1000947) - adjust to isoinfo and syslinux changes (bsc#1097814) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2037=1 Package List: - openSUSE Leap 15.0 (x86_64): mksusecd-1.69-lp150.7.1 mksusecd-debuginfo-1.69-lp150.7.1 mksusecd-debugsource-1.69-lp150.7.1 References: https://bugzilla.suse.com/1000947 https://bugzilla.suse.com/1093145 https://bugzilla.suse.com/1097814 https://bugzilla.suse.com/1100236 https://bugzilla.suse.com/1139561

1 0

openSUSE-SU-2019:2040-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2040-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2040=1 Package List: - openSUSE Leap 15.0 (noarch): libmirage-data-3.2.2-lp150.2.3.1 libmirage-lang-3.2.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libmirage-3_2-3.2.2-lp150.2.3.1 libmirage-3_2-debuginfo-3.2.2-lp150.2.3.1 libmirage-debuginfo-3.2.2-lp150.2.3.1 libmirage-debugsource-3.2.2-lp150.2.3.1 libmirage-devel-3.2.2-lp150.2.3.1 libmirage11-3.2.2-lp150.2.3.1 libmirage11-debuginfo-3.2.2-lp150.2.3.1 typelib-1_0-libmirage-3_2-3.2.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087

1 0

openSUSE-SU-2019:2038-1: moderate: Security update for flatpak
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2038-1 Rating: moderate References: #1125431 #1133041 #1133043 Cross-References: CVE-2019-11460 CVE-2019-11461 CVE-2019-8308 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for flatpak fixes the following issues: Security issues fixed: - CVE-2019-8308: Fixed a potential sandbox escape via /proc (bsc#1125431). - CVE-2019-11460: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133043). - CVE-2019-11461: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133041). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2038=1 Package List: - openSUSE Leap 15.0 (x86_64): flatpak-0.10.4-lp150.8.1 flatpak-debuginfo-0.10.4-lp150.8.1 flatpak-debugsource-0.10.4-lp150.8.1 flatpak-devel-0.10.4-lp150.8.1 libflatpak0-0.10.4-lp150.8.1 libflatpak0-debuginfo-0.10.4-lp150.8.1 typelib-1_0-Flatpak-1_0-0.10.4-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-11460.html https://www.suse.com/security/cve/CVE-2019-11461.html https://www.suse.com/security/cve/CVE-2019-8308.html https://bugzilla.suse.com/1125431 https://bugzilla.suse.com/1133041 https://bugzilla.suse.com/1133043

1 0

openSUSE-SU-2019:2039-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2039-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2039=1 Package List: - openSUSE Leap 15.0 (noarch): python-SQLAlchemy-doc-1.2.7-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): python-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 python-SQLAlchemy-debugsource-1.2.7-lp150.2.3.1 python2-SQLAlchemy-1.2.7-lp150.2.3.1 python2-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 python3-SQLAlchemy-1.2.7-lp150.2.3.1 python3-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593

1 0

openSUSE-RU-2019:2036-1: moderate: Recommended update for yast2-proxy
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for yast2-proxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2036-1 Rating: moderate References: #1140199 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-proxy fixes the following issues: - Fix 'proxy' behaviour when running in firstboot (bsc#1140199) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2036=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-proxy-4.0.3-lp150.2.10.1 References: https://bugzilla.suse.com/1140199

1 0

openSUSE-RU-2019:2034-1: moderate: Recommended update for lifelines
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for lifelines ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2034-1 Rating: moderate References: #1146704 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lifelines fixes the following issues: - Update to lifelines git version 3ad4571, which is the follower of lifelines version 3.1.1 (bug boo#1146704) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2034=1 Package List: - openSUSE Leap 15.1 (x86_64): lifelines-3.1.1+3ad4571-lp151.3.3.1 lifelines-debuginfo-3.1.1+3ad4571-lp151.3.3.1 lifelines-debugsource-3.1.1+3ad4571-lp151.3.3.1 References: https://bugzilla.suse.com/1146704

1 0

openSUSE-RU-2019:2035-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2035-1 Rating: moderate References: #1093052 #1113732 #1128032 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2 fixes the following issues: - Stop "ls: write error: Broken pipe" messages. (bsc#1128032) - Choose SuSEfirewall2 as default if no firewall has been installed. (bsc#1093052) - Added more testcases if e.g. system is running in chroot environment and systemd does not work properly (bsc#1113732) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2035=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-4.0.104-lp150.2.16.1 References: https://bugzilla.suse.com/1093052 https://bugzilla.suse.com/1113732 https://bugzilla.suse.com/1128032

1 0

openSUSE-SU-2019:2033-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2033-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2033=1 Package List: - openSUSE Leap 15.1 (x86_64): libmirage-3_2-3.2.2-lp151.3.3.1 libmirage-3_2-debuginfo-3.2.2-lp151.3.3.1 libmirage-debuginfo-3.2.2-lp151.3.3.1 libmirage-debugsource-3.2.2-lp151.3.3.1 libmirage-devel-3.2.2-lp151.3.3.1 libmirage11-3.2.2-lp151.3.3.1 libmirage11-debuginfo-3.2.2-lp151.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): libmirage-data-3.2.2-lp151.3.3.1 libmirage-lang-3.2.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087

1 0

openSUSE-RU-2019:2026-1: moderate: Recommended update for clementine
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for clementine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2026-1 Rating: moderate References: #1138261 #1141444 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for clementine fixes the following issues: - Fix a clementine crash and memory leak (boo#1138261) - Fix many memory leaks (boo#1141444) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2026=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): clementine-1.3.1-bp151.4.6.1 References: https://bugzilla.suse.com/1138261 https://bugzilla.suse.com/1141444

1 0

openSUSE-RU-2019:2028-1: moderate: Recommended update for mate-menus
by maintenance＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Recommended Update: Recommended update for mate-menus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2028-1 Rating: moderate References: #1144346 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-menus fixes the following issues: - Fix a crash of mate-menu due to a missing symbol (boo#1144346) Remove subpackages: * python2-mate-menus and python-mate-menus: dropped in patch series, mate-menus examples go to the devel subpackage Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2028=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmate-menu2-1.20.0-lp151.3.5.1 libmate-menu2-debuginfo-1.20.0-lp151.3.5.1 mate-menus-1.20.0-lp151.3.5.1 mate-menus-debugsource-1.20.0-lp151.3.5.1 mate-menus-devel-1.20.0-lp151.3.5.1 typelib-1_0-MateMenu-2_0-1.20.0-lp151.3.5.1 - openSUSE Leap 15.1 (noarch): mate-menus-branding-upstream-1.20.0-lp151.3.5.1 mate-menus-lang-1.20.0-lp151.3.5.1 - openSUSE Leap 15.1 (x86_64): libmate-menu2-32bit-1.20.0-lp151.3.5.1 libmate-menu2-32bit-debuginfo-1.20.0-lp151.3.5.1 References: https://bugzilla.suse.com/1144346

1 0