September 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2085-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2085-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2085=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.17.1 go1.12-doc-1.12.9-lp151.2.17.1 go1.12-race-1.12.9-lp151.2.17.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123

1 0

openSUSE-RU-2019:2087-1: moderate: Recommended update for plasma5-pk-updates
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for plasma5-pk-updates ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2087-1 Rating: moderate References: #1086068 #1148168 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for plasma5-pk-updates fixes the following issues: Various fixes were done to improve the french translations (boo#1086068) Also implemented EULA handling (boo#1148168): This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2087=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): plasma5-pk-updates-0.3.2-bp150.24.1 - openSUSE Backports SLE-15 (noarch): plasma5-pk-updates-lang-0.3.2-bp150.24.1 References: https://bugzilla.suse.com/1086068 https://bugzilla.suse.com/1148168

1 0

openSUSE-RU-2019:2084-1: moderate: Recommended update for enigmail
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2084-1 Rating: moderate References: #1141025 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enigmail fixes the following issues: - enimail 2.0.12: * set the default keyserver to keys.openpgp.org in order to mitigate the SKS Keyserver Network Attack (boo#1141025) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2084=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.12-34.1 References: https://bugzilla.suse.com/1141025

1 0

openSUSE-SU-2019:2083-1: moderate: Security update for srt
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for srt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2083-1 Rating: moderate References: #1148844 Cross-References: CVE-2019-15784 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: srt was updated to version 1.3.4. Security issues fixed: * CVE-2019-15784: avoid a potential array overflow. (boo#1148844) * New binary: srt-tunnel * srt-multiplexer binary is now a testing application and thus is dropped from our package. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2083=1 Package List: - openSUSE Leap 15.1 (x86_64): libsrt1-1.3.4-lp151.2.3.1 libsrt1-debuginfo-1.3.4-lp151.2.3.1 srt-1.3.4-lp151.2.3.1 srt-debuginfo-1.3.4-lp151.2.3.1 srt-debugsource-1.3.4-lp151.2.3.1 srt-devel-1.3.4-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15784.html https://bugzilla.suse.com/1148844

1 0

openSUSE-SU-2019:2081-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2081-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2081=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.132-lp150.234.1 chromedriver-debuginfo-76.0.3809.132-lp150.234.1 chromium-76.0.3809.132-lp150.234.1 chromium-debuginfo-76.0.3809.132-lp150.234.1 chromium-debugsource-76.0.3809.132-lp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143

1 0

openSUSE-SU-2019:2080-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2080-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2080=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.132-lp151.2.25.1 chromedriver-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-76.0.3809.132-lp151.2.25.1 chromium-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-debugsource-76.0.3809.132-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143

1 0

openSUSE-SU-2019:2077-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2077-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2077=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2077=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp151.4.3.1 libmirage-3_2-debuginfo-3.2.2-bp151.4.3.1 libmirage-debuginfo-3.2.2-bp151.4.3.1 libmirage-debugsource-3.2.2-bp151.4.3.1 libmirage-devel-3.2.2-bp151.4.3.1 libmirage11-3.2.2-bp151.4.3.1 libmirage11-debuginfo-3.2.2-bp151.4.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): libmirage-data-3.2.2-bp151.4.3.1 libmirage-lang-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp150.3.3.1 libmirage-devel-3.2.2-bp150.3.3.1 libmirage11-3.2.2-bp150.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libmirage-data-3.2.2-bp150.3.3.1 libmirage-lang-3.2.2-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087

1 0

openSUSE-SU-2019:2078-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2078-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2078=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-SQLAlchemy-1.2.7-bp150.2.3.1 python3-SQLAlchemy-1.2.7-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): python-SQLAlchemy-doc-1.2.7-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593

1 0

openSUSE-RU-2019:2076-1: moderate: Recommended update for sddm
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2076-1 Rating: moderate References: #1025387 #1069396 #1101297 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sddm fixes the following issues: - Add SLE branding package for PackageHub (boo#1101297) - Change the Supplements of branding packages, so they get installed when sddm and the respective branding package is installed. Also added a Supplements to sddm so it gets recommended when plasma5-workspace is installed. - Provide a sddm-branding-SLE package with correct dependencies, together with sddm-branding-openSUSE (boo#1025387, boo#1069396) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2076=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sddm-0.18.0-bp151.4.3.1 sddm-branding-SLE-0.18.0-bp151.4.3.1 sddm-branding-openSUSE-0.18.0-bp151.4.3.1 sddm-branding-upstream-0.18.0-bp151.4.3.1 References: https://bugzilla.suse.com/1025387 https://bugzilla.suse.com/1069396 https://bugzilla.suse.com/1101297

1 0

openSUSE-OU-2019:2075-1: moderate: Optional update for sddm
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Optional Update: Optional update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:2075-1 Rating: moderate References: #1105342 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update for sddm adds the following functionality: * Honor PAM's ambient supplemental groups (boo#1105342) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2075=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): sddm-0.17.0-bp150.9.13.1 sddm-branding-openSUSE-0.17.0-bp150.9.13.1 sddm-branding-upstream-0.17.0-bp150.9.13.1 References: https://bugzilla.suse.com/1105342

1 0