August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1911-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1911-1 Rating: important References: #1142825 #1142832 #1142835 Cross-References: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icedtea-web to version 1.7.2 fixes the following issues: Security issues fixed: - CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835) - CVE-2019-10182: Fixed a path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite (bsc#1142825). - CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1911=1 Package List: - openSUSE Leap 15.0 (x86_64): icedtea-web-1.7.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): icedtea-web-javadoc-1.7.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10181.html https://www.suse.com/security/cve/CVE-2019-10182.html https://www.suse.com/security/cve/CVE-2019-10185.html https://bugzilla.suse.com/1142825 https://bugzilla.suse.com/1142832 https://bugzilla.suse.com/1142835

1 0

openSUSE-SU-2019:1912-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1912-1 Rating: important References: #1115375 #1141780 #1141782 #1141783 #1141784 #1141785 #1141786 #1141787 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2842 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk to version 8u222 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2842: Extended AES support (bsc#1141786). - CVE-2019-7317: Improve PNG support (bsc#1141780). - Certificate validation improvements Non-security issue fixed: - Fixed an issue where the installation failed when the manpages are not present (bsc#1115375) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1912=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1912=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-src-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-src-1.8.0.222-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2842.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141786 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141789

1 0

openSUSE-SU-2019:1902-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1902-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1902=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.100-lp151.2.20.1 chromedriver-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-76.0.3809.100-lp151.2.20.1 chromium-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-debugsource-76.0.3809.100-lp151.2.20.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242

1 0

openSUSE-SU-2019:1906-1: important: Security update for python
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1906-1 Rating: important References: #1138459 Cross-References: CVE-2019-10160 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1906=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1906=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.14-lp151.10.3.1 libpython2_7-1_0-debuginfo-2.7.14-lp151.10.3.1 python-2.7.14-lp151.10.3.1 python-base-2.7.14-lp151.10.3.1 python-base-debuginfo-2.7.14-lp151.10.3.1 python-base-debugsource-2.7.14-lp151.10.3.1 python-curses-2.7.14-lp151.10.3.1 python-curses-debuginfo-2.7.14-lp151.10.3.1 python-debuginfo-2.7.14-lp151.10.3.1 python-debugsource-2.7.14-lp151.10.3.1 python-demo-2.7.14-lp151.10.3.1 python-devel-2.7.14-lp151.10.3.1 python-gdbm-2.7.14-lp151.10.3.1 python-gdbm-debuginfo-2.7.14-lp151.10.3.1 python-idle-2.7.14-lp151.10.3.1 python-tk-2.7.14-lp151.10.3.1 python-tk-debuginfo-2.7.14-lp151.10.3.1 python-xml-2.7.14-lp151.10.3.1 python-xml-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.14-lp151.10.3.1 python-doc-pdf-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp151.10.3.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp151.10.3.1 python-32bit-2.7.14-lp151.10.3.1 python-32bit-debuginfo-2.7.14-lp151.10.3.1 python-base-32bit-2.7.14-lp151.10.3.1 python-base-32bit-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.0 (i586 x86_64): python-2.7.14-lp150.6.13.1 python-curses-2.7.14-lp150.6.13.1 python-curses-debuginfo-2.7.14-lp150.6.13.1 python-debuginfo-2.7.14-lp150.6.13.1 python-debugsource-2.7.14-lp150.6.13.1 python-demo-2.7.14-lp150.6.13.1 python-gdbm-2.7.14-lp150.6.13.1 python-gdbm-debuginfo-2.7.14-lp150.6.13.1 python-idle-2.7.14-lp150.6.13.1 python-tk-2.7.14-lp150.6.13.1 python-tk-debuginfo-2.7.14-lp150.6.13.1 - openSUSE Leap 15.0 (x86_64): python-32bit-2.7.14-lp150.6.13.1 python-32bit-debuginfo-2.7.14-lp150.6.13.1 References: https://www.suse.com/security/cve/CVE-2019-10160.html https://bugzilla.suse.com/1138459

1 0

openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.11-20.1 pdns-backend-godbc-4.1.11-20.1 pdns-backend-ldap-4.1.11-20.1 pdns-backend-lua-4.1.11-20.1 pdns-backend-mydns-4.1.11-20.1 pdns-backend-mysql-4.1.11-20.1 pdns-backend-postgresql-4.1.11-20.1 pdns-backend-remote-4.1.11-20.1 pdns-backend-sqlite3-4.1.11-20.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810

1 0

openSUSE-SU-2019:1909-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1909-1 Rating: important References: #1093732 #1094893 #1118586 #1133290 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom: * Initial version 1.0.0 * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1909=1 Package List: - openSUSE Leap 15.0 (noarch): libaom-devel-doc-1.0.0-lp150.2.1 vlc-lang-3.0.7.1-lp150.8.1 - openSUSE Leap 15.0 (x86_64): aom-tools-1.0.0-lp150.2.1 aom-tools-debuginfo-1.0.0-lp150.2.1 libaom-debugsource-1.0.0-lp150.2.1 libaom-devel-1.0.0-lp150.2.1 libaom0-1.0.0-lp150.2.1 libaom0-debuginfo-1.0.0-lp150.2.1 libvlc5-3.0.7.1-lp150.8.1 libvlc5-debuginfo-3.0.7.1-lp150.8.1 libvlccore9-3.0.7.1-lp150.8.1 libvlccore9-debuginfo-3.0.7.1-lp150.8.1 vlc-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-debuginfo-3.0.7.1-lp150.8.1 vlc-debuginfo-3.0.7.1-lp150.8.1 vlc-debugsource-3.0.7.1-lp150.8.1 vlc-devel-3.0.7.1-lp150.8.1 vlc-jack-3.0.7.1-lp150.8.1 vlc-jack-debuginfo-3.0.7.1-lp150.8.1 vlc-noX-3.0.7.1-lp150.8.1 vlc-noX-debuginfo-3.0.7.1-lp150.8.1 vlc-qt-3.0.7.1-lp150.8.1 vlc-qt-debuginfo-3.0.7.1-lp150.8.1 vlc-vdpau-3.0.7.1-lp150.8.1 vlc-vdpau-debuginfo-3.0.7.1-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1093732 https://bugzilla.suse.com/1094893 https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549

1 0

openSUSE-SU-2019:1917-1: important: Security update for gpg2
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1917-1 Rating: important References: #1124847 #1141093 Cross-References: CVE-2019-13050 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gpg2 fixes the following issues: Security issue fixed: - CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093). Non-security issue fixed: - Allow coredumps in X11 desktop sessions (bsc#1124847) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1917=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1917=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gpg2-2.2.5-lp151.6.3.1 gpg2-debuginfo-2.2.5-lp151.6.3.1 gpg2-debugsource-2.2.5-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): gpg2-lang-2.2.5-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.10.1 gpg2-debuginfo-2.2.5-lp150.3.10.1 gpg2-debugsource-2.2.5-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-13050.html https://bugzilla.suse.com/1124847 https://bugzilla.suse.com/1141093

1 0

openSUSE-RU-2019:1900-1: Recommended update for kde-l10n
by maintenance＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Recommended Update: Recommended update for kde-l10n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1900-1 Rating: low References: #1103027 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kde-l10n fixes the following issue: * boo#1103027: Kopete was missing localization This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1900=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): kde-l10n-ar-17.08.3-bp151.5.3.3 kde-l10n-ast-17.08.3-bp151.5.3.3 kde-l10n-bg-17.08.3-bp151.5.3.3 kde-l10n-bs-17.08.3-bp151.5.3.3 kde-l10n-ca-17.08.3-bp151.5.3.3 kde-l10n-caValencia-17.08.3-bp151.5.3.3 kde-l10n-cs-17.08.3-bp151.5.3.3 kde-l10n-da-17.08.3-bp151.5.3.3 kde-l10n-da-data-17.08.3-bp151.5.3.3 kde-l10n-da-doc-17.08.3-bp151.5.3.3 kde-l10n-de-17.08.3-bp151.5.3.3 kde-l10n-de-data-17.08.3-bp151.5.3.3 kde-l10n-de-doc-17.08.3-bp151.5.3.3 kde-l10n-el-17.08.3-bp151.5.3.3 kde-l10n-en_GB-17.08.3-bp151.5.3.3 kde-l10n-en_GB-data-17.08.3-bp151.5.3.3 kde-l10n-en_GB-doc-17.08.3-bp151.5.3.3 kde-l10n-eo-17.08.3-bp151.5.3.3 kde-l10n-es-17.08.3-bp151.5.3.3 kde-l10n-es-data-17.08.3-bp151.5.3.3 kde-l10n-es-doc-17.08.3-bp151.5.3.3 kde-l10n-et-17.08.3-bp151.5.3.3 kde-l10n-et-data-17.08.3-bp151.5.3.3 kde-l10n-et-doc-17.08.3-bp151.5.3.3 kde-l10n-eu-17.08.3-bp151.5.3.3 kde-l10n-fa-17.08.3-bp151.5.3.3 kde-l10n-fi-17.08.3-bp151.5.3.3 kde-l10n-fr-17.08.3-bp151.5.3.3 kde-l10n-fr-data-17.08.3-bp151.5.3.3 kde-l10n-fr-doc-17.08.3-bp151.5.3.3 kde-l10n-ga-17.08.3-bp151.5.3.3 kde-l10n-gl-17.08.3-bp151.5.3.3 kde-l10n-he-17.08.3-bp151.5.3.3 kde-l10n-hi-17.08.3-bp151.5.3.3 kde-l10n-hr-17.08.3-bp151.5.3.3 kde-l10n-hu-17.08.3-bp151.5.3.3 kde-l10n-ia-17.08.3-bp151.5.3.3 kde-l10n-id-17.08.3-bp151.5.3.3 kde-l10n-is-17.08.3-bp151.5.3.3 kde-l10n-it-17.08.3-bp151.5.3.3 kde-l10n-it-data-17.08.3-bp151.5.3.3 kde-l10n-it-doc-17.08.3-bp151.5.3.3 kde-l10n-ja-17.08.3-bp151.5.3.3 kde-l10n-kk-17.08.3-bp151.5.3.3 kde-l10n-km-17.08.3-bp151.5.3.3 kde-l10n-ko-17.08.3-bp151.5.3.3 kde-l10n-lt-17.08.3-bp151.5.3.3 kde-l10n-lv-17.08.3-bp151.5.3.3 kde-l10n-mr-17.08.3-bp151.5.3.3 kde-l10n-nb-17.08.3-bp151.5.3.3 kde-l10n-nds-17.08.3-bp151.5.3.3 kde-l10n-nl-17.08.3-bp151.5.3.3 kde-l10n-nl-data-17.08.3-bp151.5.3.3 kde-l10n-nl-doc-17.08.3-bp151.5.3.3 kde-l10n-nn-17.08.3-bp151.5.3.3 kde-l10n-pa-17.08.3-bp151.5.3.3 kde-l10n-pl-17.08.3-bp151.5.3.3 kde-l10n-pl-data-17.08.3-bp151.5.3.3 kde-l10n-pl-doc-17.08.3-bp151.5.3.3 kde-l10n-pt-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-data-17.08.3-bp151.5.3.3 kde-l10n-pt_BR-doc-17.08.3-bp151.5.3.3 kde-l10n-ro-17.08.3-bp151.5.3.3 kde-l10n-ru-17.08.3-bp151.5.3.3 kde-l10n-ru-data-17.08.3-bp151.5.3.3 kde-l10n-ru-doc-17.08.3-bp151.5.3.3 kde-l10n-sk-17.08.3-bp151.5.3.3 kde-l10n-sl-17.08.3-bp151.5.3.3 kde-l10n-sr-17.08.3-bp151.5.3.3 kde-l10n-sv-17.08.3-bp151.5.3.3 kde-l10n-sv-data-17.08.3-bp151.5.3.3 kde-l10n-sv-doc-17.08.3-bp151.5.3.3 kde-l10n-tr-17.08.3-bp151.5.3.3 kde-l10n-ug-17.08.3-bp151.5.3.3 kde-l10n-uk-17.08.3-bp151.5.3.3 kde-l10n-uk-data-17.08.3-bp151.5.3.3 kde-l10n-uk-doc-17.08.3-bp151.5.3.3 kde-l10n-wa-17.08.3-bp151.5.3.3 kde-l10n-zh_CN-17.08.3-bp151.5.3.3 kde-l10n-zh_TW-17.08.3-bp151.5.3.3 References: https://bugzilla.suse.com/1103027

1 0

openSUSE-SU-2019:1916-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1916-1 Rating: important References: #1115375 #1140461 #1141780 #1141781 #1141782 #1141783 #1141784 #1141785 #1141787 #1141788 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2818 CVE-2019-2821 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-7317: Improve PNG support options (bsc#1141780). - CVE-2019-2818: Better Poly1305 support (bsc#1141788). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2821: Improve TLS negotiation (bsc#1141781). - Certificate validation improvements Non-security issues fixed: - Do not fail installation when the manpages are not present (bsc#1115375) - Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1916=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1916=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debugsource-11.0.4.0-lp151.3.6.1 java-11-openjdk-demo-11.0.4.0-lp151.3.6.1 java-11-openjdk-devel-11.0.4.0-lp151.3.6.1 java-11-openjdk-headless-11.0.4.0-lp151.3.6.1 java-11-openjdk-jmods-11.0.4.0-lp151.3.6.1 java-11-openjdk-src-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp150.2.25.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debugsource-11.0.4.0-lp150.2.25.1 java-11-openjdk-demo-11.0.4.0-lp150.2.25.1 java-11-openjdk-devel-11.0.4.0-lp150.2.25.1 java-11-openjdk-headless-11.0.4.0-lp150.2.25.1 java-11-openjdk-jmods-11.0.4.0-lp150.2.25.1 java-11-openjdk-src-11.0.4.0-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2818.html https://www.suse.com/security/cve/CVE-2019-2821.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1140461 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141781 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141788 https://bugzilla.suse.com/1141789

1 0

openSUSE-SU-2019:1897-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1897-1 Rating: important References: #1118586 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1897=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.7.1-bp151.5.3.3 libvlccore9-3.0.7.1-bp151.5.3.3 vlc-3.0.7.1-bp151.5.3.3 vlc-codec-gstreamer-3.0.7.1-bp151.5.3.3 vlc-devel-3.0.7.1-bp151.5.3.3 vlc-jack-3.0.7.1-bp151.5.3.3 vlc-noX-3.0.7.1-bp151.5.3.3 vlc-qt-3.0.7.1-bp151.5.3.3 vlc-vdpau-3.0.7.1-bp151.5.3.3 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.7.1-bp151.5.3.3 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549

1 0