September 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2127-1: moderate: Recommended update for yast2, yast2-packager
by maintenance＠opensuse.org 12 Sep '19

12 Sep '19

openSUSE Recommended Update: Recommended update for yast2, yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2127-1 Rating: moderate References: #1132748 #1148536 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2, yast2-packager provides the following fixes: Changes in yast2: - Include the package in the INSTALLER repository to be upgraded during installation. - No source changes Changes in yast2-packager: - Avoid error when generating some warnings. (bsc#1148536) - Always set proper release version for newly added repositories. (bsc#1132748) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2127=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): yast2-4.1.72-lp151.2.10.1 yast2-logs-4.1.72-lp151.2.10.1 yast2-packager-4.1.49-lp151.2.6.1 References: https://bugzilla.suse.com/1132748 https://bugzilla.suse.com/1148536

1 0

openSUSE-RU-2019:2125-1: moderate: Recommended update for ha-cluster-bootstrap
by maintenance＠opensuse.org 11 Sep '19

11 Sep '19

openSUSE Recommended Update: Recommended update for ha-cluster-bootstrap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2125-1 Rating: moderate References: #1138353 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ha-cluster-bootstrap fixes the following issues: - use help2man to generate init/join/remove man page (bsc#1138353) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2125=1 Package List: - openSUSE Leap 15.1 (noarch): ha-cluster-bootstrap-0.5-lp151.4.3.1 References: https://bugzilla.suse.com/1138353

1 0

openSUSE-RU-2019:2123-1: moderate: Recommended update for Salt
by maintenance＠opensuse.org 11 Sep '19

11 Sep '19

openSUSE Recommended Update: Recommended update for Salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2123-1 Rating: moderate References: #1128554 #1131114 #1132076 #1133647 #1135360 #1135507 #1139761 #1140193 #1148714 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update fixes the following issues: salt: - Multiple fixes on cmdmod, chroot, freezer and zypperpkg needed for Yomi cmdmod: fix runas and group in run_chroot chroot: add missing sys directory chroot: change variable name to root chroot: fix bug in safe_kwargs iteration freezer: do not fail in cache dir is present freezer: clean freeze YAML profile on restore zypperpkg: fix pkg.list_pkgs cache - Avoid traceback on http.query when there are errors with the requested URL (bsc#1128554) - Salt python client get_full_returns seems return data from incorrect jid (bsc#1131114) - Virt.volume_infos: don't raise an error if there is no VM - Prevent ansiblegate unit tests to fail on Ubuntu - Allow passing kwargs to pkg.list_downloaded for Zypper (bsc#1140193) - Do not make "ansiblegate" module to crash on Python3 minions (bsc#1139761) - Provide the missing features required for Yomi (Yet one more installer) - Fix zypper pkg.list_pkgs test expectation and dpkg mocking - Set 'salt' group for files and directories created by salt-standalone-formulas-configuration package - Fix virt.volume_infos raising an exception when there is only virtual machine on the minion. - Fix virt.purge() on all non-KVM hypervisors. For instance on Xen, virt.purge would simply throw an exception about unsupported flag - Building a libvirt pool starts it. When defining a new pool, we need to - Fix handling of Virtual Machines with white space in their name. - Avoid batch.py exception when minion does not respond (bsc#1135507) - Preserve already defined DESTRUCTIVE_TESTS and EXPENSIVE_TESTS env variables - Do not break repo files with multiple line values on yumpkg (bsc#1135360) - Fix return status when installing or updating RPM packages with "ppc64le" arch (bsc#1133647) - Add new "salt-standalone-formulas-configuration" package - Switch firewalld state to use change_interface (bsc#1132076) - Restore default behaviour of pkg list return (bsc#1148714) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2123=1 Package List: - openSUSE Leap 15.0 (noarch): salt-bash-completion-2019.2.0-lp150.3.33.1 salt-fish-completion-2019.2.0-lp150.3.33.1 salt-zsh-completion-2019.2.0-lp150.3.33.1 - openSUSE Leap 15.0 (x86_64): python2-salt-2019.2.0-lp150.3.33.1 python3-salt-2019.2.0-lp150.3.33.1 salt-2019.2.0-lp150.3.33.1 salt-api-2019.2.0-lp150.3.33.1 salt-cloud-2019.2.0-lp150.3.33.1 salt-doc-2019.2.0-lp150.3.33.1 salt-master-2019.2.0-lp150.3.33.1 salt-minion-2019.2.0-lp150.3.33.1 salt-proxy-2019.2.0-lp150.3.33.1 salt-ssh-2019.2.0-lp150.3.33.1 salt-standalone-formulas-configuration-2019.2.0-lp150.3.33.1 salt-syndic-2019.2.0-lp150.3.33.1 References: https://bugzilla.suse.com/1128554 https://bugzilla.suse.com/1131114 https://bugzilla.suse.com/1132076 https://bugzilla.suse.com/1133647 https://bugzilla.suse.com/1135360 https://bugzilla.suse.com/1135507 https://bugzilla.suse.com/1139761 https://bugzilla.suse.com/1140193 https://bugzilla.suse.com/1148714

1 0

openSUSE-RU-2019:2124-1: moderate: Recommended update for ha-cluster-bootstrap
by maintenance＠opensuse.org 11 Sep '19

11 Sep '19

openSUSE Recommended Update: Recommended update for ha-cluster-bootstrap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2124-1 Rating: moderate References: #1138353 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ha-cluster-bootstrap fixes the following issues: - use help2man to generate init/join/remove man page (bsc#1138353) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2124=1 Package List: - openSUSE Leap 15.0 (noarch): ha-cluster-bootstrap-0.5-lp150.3.3.1 References: https://bugzilla.suse.com/1138353

1 0

openSUSE-RU-2019:2122-1: moderate: Recommended update for golang-github-prometheus-prometheus and golang-github-prometheus-alertmanager
by maintenance＠opensuse.org 11 Sep '19

11 Sep '19

openSUSE Recommended Update: Recommended update for golang-github-prometheus-prometheus and golang-github-prometheus-alertmanager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2122-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues: golang-github-prometheus-prometheus and golang-github-prometheus-alertmanager: - Add support for Uyuni/SUSE Manager service discovery - Update to 2.11.1 + Bug Fix: * Fix potential panic when prometheus is watching multiple zookeeper paths. - Update to 2.11.0 + Bug Fix: * resolve race condition in maxGauge. * Fix ZooKeeper connection leak. * Improved atomicity of .tmp block replacement during compaction for usual case. * Fix "unknown series references" after clean shutdown. * Re-calculate block size when calling block.Delete. * Fix unsafe snapshots with head block. * prometheus_tsdb_compactions_failed_total is now incremented on any compaction failure. + Changes: * Remove max_retries from queue_config (it has been unused since rewriting remote-write to utilize the write-ahead-log) * The meta file BlockStats no longer holds size information. This is now dynamically calculated and kept in memory. It also includes the meta file size which was not included before * Renamed metric from prometheus_tsdb_wal_reader_corruption_errors to prometheus_tsdb_wal_reader_corruption_errors_total + Features: * Add option to use Alertmanager API v2. * Added humanizePercentage function for templates. * Include InitContainers in Kubernetes Service Discovery. * Provide option to compress WAL records using Snappy. + Enhancements: * Create new clean segment when starting the WAL. * Reduce allocations in PromQL aggregations. * Add storage warnings to LabelValues and LabelNames API results. * Add prometheus_http_requests_total metric. * Enable openbsd/arm build. * Remote-write allocation improvements. * Query performance improvement: Efficient iteration and search in HashForLabels and HashWithoutLabels. * Allow injection of arbitrary headers in promtool. * Allow passing external_labels in alert unit tests groups. * Allows globs for rules when unit testing. * Improved postings intersection matching. * Reduced disk usage for WAL for small setups. * Optimize queries using regexp for set lookups. - Rebase patch002-Default-settings.patch - Update to 2.10.0: + Bug Fixes: * TSDB: Don't panic when running out of disk space and recover nicely from the condition * TSDB: Correctly handle empty labels. * TSDB: Don't crash on an unknown tombstone reference. * Storage/remote: Remove queue-manager specific metrics if queue no longer exists. * PromQL: Correctly display {__name__="a"}. * Discovery/kubernetes: Use service rather than ingress as the name for the service workqueue. * Discovery/azure: Don't panic on a VM with a public IP. * Web: Fixed Content-Type for js and css instead of using /etc/mime.types. * API: Encode alert values as string to correctly represent Inf/NaN. + Features: * Template expansion: Make external labels available as $externalLabels in alert and console template expansion. * TSDB: Add prometheus_tsdb_wal_segment_current metric for the WAL segment index that TSDB is currently writing to. tsdb * Scrape: Add scrape_series_added per-scrape metric. #5546 + Enhancements * Discovery/kubernetes: Add labels __meta_kubernetes_endpoint_node_name and __meta_kubernetes_endpoint_hostname. * Discovery/azure: Add label __meta_azure_machine_public_ip. * TSDB: Simplify mergedPostings.Seek, resulting in better performance if there are many posting lists. tsdb * Log filesystem type on startup. * Cmd/promtool: Use POST requests for Query and QueryRange. client_golang * Web: Sort alerts by group name. * Console templates: Add convenience variables $rawParams, $params, $path. - Upadte to 2.9.2 + Bug Fixes: * Make sure subquery range is taken into account for selection * Exhaust every request body before closing it * Cmd/promtool: return errors from rule evaluations * Remote Storage: string interner should not panic in release * Fix memory allocation regression in mergedPostings.Seek tsdb - Update to 2.9.1 + Bug Fixes: * Discovery/kubernetes: fix missing label sanitization * Remote_write: Prevent reshard concurrent with calling stop - Update to 2.9.0 + Feature: * Add honor_timestamps scrape option. + Enhancements: * Update Consul to support catalog.ServiceMultipleTags. * Discovery/kubernetes: add present labels for labels/annotations. * OpenStack SD: Add ProjectID and UserID meta labels. * Add GODEBUG and retention to the runtime page. * Add support for POSTing to /series endpoint. * Support PUT methods for Lifecycle and Admin APIs. * Scrape: Add global jitter for HA server. * Check for cancellation on every step of a range evaluation. * String interning for labels & values in the remote_write path. * Don't lose the scrape cache on a failed scrape. * Reload cert files from disk automatically. common * Use fixed length millisecond timestamp format for logs. common * Performance improvements for postings. Bug Fixes: * Remote Write: fix checkpoint reading. * Check if label value is valid when unmarshaling external labels from YAML. * Promparse: sort all labels when parsing. * Reload rules: copy state on both name and labels. * Exponentation operator to drop metric name in result of operation. * Config: resolve more file paths. * Promtool: resolve relative paths in alert test files. * Set TLSHandshakeTimeout in HTTP transport. common * Use fsync to be more resilient to machine crashes. * Keep series that are still in WAL in checkpoints. - Update to 2.8.1 + Bug Fixes * Display the job labels in /targets which was removed accidentally - Update to 2.8.0 + Change: * This release uses Write-Ahead Logging (WAL) for the remote_write API. This currently causes a slight increase in memory usage, which will be addressed in future releases. * Default time retention is used only when no size based retention is specified. These are flags where time retention is specified by the flag --storage.tsdb.retention and size retention by --storage.tsdb.retention.size. * prometheus_tsdb_storage_blocks_bytes_total is now prometheus_tsdb_storage_blocks_bytes. + Feature: * (EXPERIMENTAL) Time overlapping blocks are now allowed; vertical compaction and vertical query merge. It is an optional feature which is controlled by the --storage.tsdb.allow-overlapping-blocks flag, disabled by default. + Enhancements: * Use the WAL for remote_write API. * Query performance improvements. * UI enhancements with upgrade to Bootstrap 4. * Reduce time that Alertmanagers are in flux when reloaded. * Limit number of metrics displayed on UI to 10000. * (1) Remember All/Unhealthy choice on target-overview when reloading page. (2) Resize text-input area on Graph page on mouseclick. * In histogram_quantile merge buckets with equivalent le values. * Show list of offending labels in the error message in many-to-many scenarios. * Show Storage Retention criteria in effect on /status page. + Bug Fixes: + Fix sorting of rule groups. + Fix support for password_file and bearer_token_file in Kubernetes SD. + Scrape: catch errors when creating HTTP clients + Adds new metrics: prometheus_target_scrape_pools_total prometheus_target_scrape_pools_failed_total prometheus_target_scrape_pool_reloads_total prometheus_target_scrape_pool_reloads_failed_total + Fix panic when aggregator param is not a literal. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2122=1 Package List: - openSUSE Leap 15.0 (x86_64): golang-github-prometheus-alertmanager-0.16.2-lp150.2.3.1 golang-github-prometheus-prometheus-2.11.1-lp150.2.6.1 References:

1 0

openSUSE-RU-2019:2117-1: moderate: Recommended update for parted
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for parted ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2117-1 Rating: moderate References: #1082318 #1136245 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for parted fixes the following issues: - Included several minor bug fixes - for more details please refer to this rpm's changelog (bsc#1136245) - Installs the license file in the correct directory (bsc#1082318) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2117=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libparted0-3.2-lp150.8.3.1 libparted0-debuginfo-3.2-lp150.8.3.1 parted-3.2-lp150.8.3.1 parted-debuginfo-3.2-lp150.8.3.1 parted-debugsource-3.2-lp150.8.3.1 parted-devel-3.2-lp150.8.3.1 - openSUSE Leap 15.0 (noarch): parted-lang-3.2-lp150.8.3.1 - openSUSE Leap 15.0 (x86_64): libparted0-32bit-3.2-lp150.8.3.1 libparted0-32bit-debuginfo-3.2-lp150.8.3.1 References: https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1136245

1 0

openSUSE-SU-2019:2120-1: important: Security update for nginx
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2120-1 Rating: important References: #1115015 #1115022 #1115025 #1145579 #1145580 #1145582 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). - CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015). - CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022). - CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2120=1 Package List: - openSUSE Leap 15.1 (x86_64): nginx-1.14.2-lp151.4.3.1 nginx-debuginfo-1.14.2-lp151.4.3.1 nginx-debugsource-1.14.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): nginx-source-1.14.2-lp151.4.3.1 vim-plugin-nginx-1.14.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9516.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 https://bugzilla.suse.com/1145579 https://bugzilla.suse.com/1145580 https://bugzilla.suse.com/1145582

1 0

openSUSE-SU-2019:2118-1: moderate: Security update for python-Werkzeug
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for python-Werkzeug ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2118-1 Rating: moderate References: #1145383 Cross-References: CVE-2019-14806 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2118=1 Package List: - openSUSE Leap 15.0 (noarch): python-Werkzeug-doc-0.12.2-lp150.2.3.1 python2-Werkzeug-0.12.2-lp150.2.3.1 python3-Werkzeug-0.12.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14806.html https://bugzilla.suse.com/1145383

1 0

openSUSE-SU-2019:2121-1: moderate: Security update for util-linux and shadow
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for util-linux and shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2121-1 Rating: moderate References: #1081947 #1082293 #1085196 #1106214 #1121197 #1122417 #1125886 #1127701 #1135534 #1135708 #1141113 #353876 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for util-linux and shadow fixes the following issues: util-linux: - Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197) - Prevent outdated pam files (bsc#1082293). - De-duplicate fstrim -A properly (bsc#1127701). - Do not trim read-only volumes (bsc#1106214). - Integrate pam_keyinit pam module to login (bsc#1081947). - Perform one-time reset of /etc/default/su (bsc#1121197). - Fix problems in reading of login.defs values (bsc#1121197) - libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417). - raw.service: Add RemainAfterExit=yes (bsc#1135534). - agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886) - libmount: print a blacklist hint for "unknown filesystem type" (jsc#SUSE-4085, fate#326832) - Fix /etc/default/su comments and create /etc/default/runuser (bsc#1121197). shadow: - Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197) - Fix segfault in useradd during setting password inactivity period. (bsc#1141113) - Hardening for su wrappers (bsc#353876) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2121=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libblkid-devel-2.33.1-lp151.3.3.2 libblkid-devel-static-2.33.1-lp151.3.3.2 libblkid1-2.33.1-lp151.3.3.2 libblkid1-debuginfo-2.33.1-lp151.3.3.2 libfdisk-devel-2.33.1-lp151.3.3.2 libfdisk-devel-static-2.33.1-lp151.3.3.2 libfdisk1-2.33.1-lp151.3.3.2 libfdisk1-debuginfo-2.33.1-lp151.3.3.2 libmount-devel-2.33.1-lp151.3.3.2 libmount-devel-static-2.33.1-lp151.3.3.2 libmount1-2.33.1-lp151.3.3.2 libmount1-debuginfo-2.33.1-lp151.3.3.2 libsmartcols-devel-2.33.1-lp151.3.3.2 libsmartcols-devel-static-2.33.1-lp151.3.3.2 libsmartcols1-2.33.1-lp151.3.3.2 libsmartcols1-debuginfo-2.33.1-lp151.3.3.2 libuuid-devel-2.33.1-lp151.3.3.2 libuuid-devel-static-2.33.1-lp151.3.3.2 libuuid1-2.33.1-lp151.3.3.2 libuuid1-debuginfo-2.33.1-lp151.3.3.2 shadow-4.6-lp151.2.3.2 shadow-debuginfo-4.6-lp151.2.3.2 shadow-debugsource-4.6-lp151.2.3.2 util-linux-2.33.1-lp151.3.3.2 util-linux-debuginfo-2.33.1-lp151.3.3.2 util-linux-debugsource-2.33.1-lp151.3.3.2 util-linux-systemd-2.33.1-lp151.3.3.2 util-linux-systemd-debuginfo-2.33.1-lp151.3.3.2 util-linux-systemd-debugsource-2.33.1-lp151.3.3.2 uuidd-2.33.1-lp151.3.3.2 uuidd-debuginfo-2.33.1-lp151.3.3.2 - openSUSE Leap 15.1 (noarch): util-linux-lang-2.33.1-lp151.3.3.2 - openSUSE Leap 15.1 (x86_64): libblkid-devel-32bit-2.33.1-lp151.3.3.2 libblkid1-32bit-2.33.1-lp151.3.3.2 libblkid1-32bit-debuginfo-2.33.1-lp151.3.3.2 libmount-devel-32bit-2.33.1-lp151.3.3.2 libmount1-32bit-2.33.1-lp151.3.3.2 libmount1-32bit-debuginfo-2.33.1-lp151.3.3.2 libuuid-devel-32bit-2.33.1-lp151.3.3.2 libuuid1-32bit-2.33.1-lp151.3.3.2 libuuid1-32bit-debuginfo-2.33.1-lp151.3.3.2 python3-libmount-2.33.1-lp151.3.3.2 python3-libmount-debuginfo-2.33.1-lp151.3.3.2 python3-libmount-debugsource-2.33.1-lp151.3.3.2 References: https://bugzilla.suse.com/1081947 https://bugzilla.suse.com/1082293 https://bugzilla.suse.com/1085196 https://bugzilla.suse.com/1106214 https://bugzilla.suse.com/1121197 https://bugzilla.suse.com/1122417 https://bugzilla.suse.com/1125886 https://bugzilla.suse.com/1127701 https://bugzilla.suse.com/1135534 https://bugzilla.suse.com/1135708 https://bugzilla.suse.com/1141113 https://bugzilla.suse.com/353876

1 0

openSUSE-RU-2019:2119-1: moderate: Recommended update for parted
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for parted ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2119-1 Rating: moderate References: #1082318 #1136245 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for parted fixes the following issues: - Included several minor bug fixes - for more details please refer to this rpm's changelog (bsc#1136245) - Installs the license file in the correct directory (bsc#1082318) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2119=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libparted0-3.2-lp151.9.3.1 libparted0-debuginfo-3.2-lp151.9.3.1 parted-3.2-lp151.9.3.1 parted-debuginfo-3.2-lp151.9.3.1 parted-debugsource-3.2-lp151.9.3.1 parted-devel-3.2-lp151.9.3.1 - openSUSE Leap 15.1 (x86_64): libparted0-32bit-3.2-lp151.9.3.1 libparted0-32bit-debuginfo-3.2-lp151.9.3.1 - openSUSE Leap 15.1 (noarch): parted-lang-3.2-lp151.9.3.1 References: https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1136245

1 0

openSUSE-RU-2019:2113-1: moderate: Recommended update for pinentry
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for pinentry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2113-1 Rating: moderate References: #1141883 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pinentry fixes the following issues: - Fix a dangling pointer in qt/main.cpp that caused crashes. (bsc#1141883) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2113=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2113=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): pinentry-1.1.0-lp151.4.3.1 pinentry-debuginfo-1.1.0-lp151.4.3.1 pinentry-debugsource-1.1.0-lp151.4.3.1 pinentry-emacs-1.1.0-lp151.4.3.1 pinentry-emacs-debuginfo-1.1.0-lp151.4.3.1 pinentry-fltk-1.1.0-lp151.4.3.1 pinentry-fltk-debuginfo-1.1.0-lp151.4.3.1 pinentry-gnome3-1.1.0-lp151.4.3.1 pinentry-gnome3-debuginfo-1.1.0-lp151.4.3.1 pinentry-gtk2-1.1.0-lp151.4.3.1 pinentry-gtk2-debuginfo-1.1.0-lp151.4.3.1 pinentry-qt5-1.1.0-lp151.4.3.1 pinentry-qt5-debuginfo-1.1.0-lp151.4.3.1 - openSUSE Leap 15.0 (i586 x86_64): pinentry-1.1.0-lp150.3.3.1 pinentry-debuginfo-1.1.0-lp150.3.3.1 pinentry-debugsource-1.1.0-lp150.3.3.1 pinentry-emacs-1.1.0-lp150.3.3.1 pinentry-emacs-debuginfo-1.1.0-lp150.3.3.1 pinentry-fltk-1.1.0-lp150.3.3.1 pinentry-fltk-debuginfo-1.1.0-lp150.3.3.1 pinentry-gnome3-1.1.0-lp150.3.3.1 pinentry-gnome3-debuginfo-1.1.0-lp150.3.3.1 pinentry-gtk2-1.1.0-lp150.3.3.1 pinentry-gtk2-debuginfo-1.1.0-lp150.3.3.1 pinentry-qt5-1.1.0-lp150.3.3.1 pinentry-qt5-debuginfo-1.1.0-lp150.3.3.1 References: https://bugzilla.suse.com/1141883

1 0

openSUSE-SU-2019:2114-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2114-1 Rating: important References: #1146090 #1146091 #1146093 #1146094 #1146095 #1146097 #1146099 #1146100 Cross-References: CVE-2019-9511 CVE-2019-9512 CVE-2019-9513 CVE-2019-9514 CVE-2019-9515 CVE-2019-9516 CVE-2019-9517 CVE-2019-9518 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for nodejs10 to version 10.16.3 fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2114=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2114=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs10-10.16.3-lp151.2.6.1 nodejs10-debuginfo-10.16.3-lp151.2.6.1 nodejs10-debugsource-10.16.3-lp151.2.6.1 nodejs10-devel-10.16.3-lp151.2.6.1 npm10-10.16.3-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): nodejs10-docs-10.16.3-lp151.2.6.1 - openSUSE Leap 15.0 (x86_64): nodejs10-10.16.3-lp150.5.1 nodejs10-debuginfo-10.16.3-lp150.5.1 nodejs10-debugsource-10.16.3-lp150.5.1 nodejs10-devel-10.16.3-lp150.5.1 npm10-10.16.3-lp150.5.1 - openSUSE Leap 15.0 (noarch): nodejs10-docs-10.16.3-lp150.5.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9514.html https://www.suse.com/security/cve/CVE-2019-9515.html https://www.suse.com/security/cve/CVE-2019-9516.html https://www.suse.com/security/cve/CVE-2019-9517.html https://www.suse.com/security/cve/CVE-2019-9518.html https://bugzilla.suse.com/1146090 https://bugzilla.suse.com/1146091 https://bugzilla.suse.com/1146093 https://bugzilla.suse.com/1146094 https://bugzilla.suse.com/1146095 https://bugzilla.suse.com/1146097 https://bugzilla.suse.com/1146099 https://bugzilla.suse.com/1146100

1 0

openSUSE-RU-2019:2116-1: moderate: Recommended update for libimobiledevice
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for libimobiledevice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2116-1 Rating: moderate References: #1103546 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libimobiledevice fixes the following issues: - Fixes a double free with OpenSSL 1.1 bug (bsc#1103546) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2116=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): imobiledevice-tools-1.2.0+git20170122.45fda81-lp151.3.3.1 imobiledevice-tools-debuginfo-1.2.0+git20170122.45fda81-lp151.3.3.1 libimobiledevice-debugsource-1.2.0+git20170122.45fda81-lp151.3.3.1 libimobiledevice-devel-1.2.0+git20170122.45fda81-lp151.3.3.1 libimobiledevice6-1.2.0+git20170122.45fda81-lp151.3.3.1 libimobiledevice6-debuginfo-1.2.0+git20170122.45fda81-lp151.3.3.1 python-imobiledevice-1.2.0+git20170122.45fda81-lp151.3.3.1 python-imobiledevice-debuginfo-1.2.0+git20170122.45fda81-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libimobiledevice6-32bit-1.2.0+git20170122.45fda81-lp151.3.3.1 libimobiledevice6-32bit-debuginfo-1.2.0+git20170122.45fda81-lp151.3.3.1 References: https://bugzilla.suse.com/1103546

1 0

openSUSE-SU-2019:2115-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2115-1 Rating: important References: #1144919 #1146090 #1146091 #1146093 #1146094 #1146095 #1146097 #1146099 #1146100 Cross-References: CVE-2019-9511 CVE-2019-9512 CVE-2019-9513 CVE-2019-9514 CVE-2019-9515 CVE-2019-9516 CVE-2019-9517 CVE-2019-9518 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.16.1 fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). Bug fixes: - Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2115=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2115=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs8-8.16.1-lp151.2.6.1 nodejs8-debuginfo-8.16.1-lp151.2.6.1 nodejs8-debugsource-8.16.1-lp151.2.6.1 nodejs8-devel-8.16.1-lp151.2.6.1 npm8-8.16.1-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): nodejs8-docs-8.16.1-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.16.1-lp150.2.19.1 nodejs8-debuginfo-8.16.1-lp150.2.19.1 nodejs8-debugsource-8.16.1-lp150.2.19.1 nodejs8-devel-8.16.1-lp150.2.19.1 npm8-8.16.1-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.16.1-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9514.html https://www.suse.com/security/cve/CVE-2019-9515.html https://www.suse.com/security/cve/CVE-2019-9516.html https://www.suse.com/security/cve/CVE-2019-9517.html https://www.suse.com/security/cve/CVE-2019-9518.html https://bugzilla.suse.com/1144919 https://bugzilla.suse.com/1146090 https://bugzilla.suse.com/1146091 https://bugzilla.suse.com/1146093 https://bugzilla.suse.com/1146094 https://bugzilla.suse.com/1146095 https://bugzilla.suse.com/1146097 https://bugzilla.suse.com/1146099 https://bugzilla.suse.com/1146100

1 0

openSUSE-SU-2019:2109-1: moderate: Security update for SDL_image
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for SDL_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2109-1 Rating: moderate References: #1124827 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-13616 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 CVE-2019-7635 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for SDL_image fixes the following issues: Update SDL_Image to new snapshot 1.2.12+hg695. Security issues fixed: * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) * CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2109=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2109=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): SDL_image-debugsource-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-bp151.4.3.1 libSDL_image-devel-1.2.12+hg695-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libSDL_image-1_2-0-64bit-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-64bit-debuginfo-1.2.12+hg695-bp151.4.3.1 libSDL_image-devel-64bit-1.2.12+hg695-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libSDL_image-1_2-0-1.2.12+hg695-bp150.3.3.1 libSDL_image-devel-1.2.12+hg695-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libSDL_image-1_2-0-64bit-1.2.12+hg695-bp150.3.3.1 libSDL_image-devel-64bit-1.2.12+hg695-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://www.suse.com/security/cve/CVE-2019-7635.html https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768

1 0

openSUSE-RU-2019:2111-1: moderate: Recommended update for ibus-libpinyin
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for ibus-libpinyin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2111-1 Rating: moderate References: #1112998 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ibus-libpinyin fixes the following issues: ibus-libpinyin was updated to 1.11.1: * Use gettext * Add emoji-candidate option (boo#1112998) * Fix SuggestionEditor ibus-libpinyin was updated version to 1.11.0: * Fix keypad decimal * Fix emoji candidates * Support configurable opencc config Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2111=1 Package List: - openSUSE Leap 15.1 (x86_64): ibus-libpinyin-1.11.1-lp151.2.3.1 ibus-libpinyin-debuginfo-1.11.1-lp151.2.3.1 ibus-libpinyin-debugsource-1.11.1-lp151.2.3.1 References: https://bugzilla.suse.com/1112998

1 0

openSUSE-RU-2019:2112-1: moderate: Recommended update for libimobiledevice
by maintenance＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Recommended Update: Recommended update for libimobiledevice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2112-1 Rating: moderate References: #1103546 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libimobiledevice fixes the following issues: - Fixes a double free with OpenSSL 1.1 bug (bsc#1103546) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2112=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): imobiledevice-tools-1.2.0+git20170122.45fda81-lp150.2.3.1 imobiledevice-tools-debuginfo-1.2.0+git20170122.45fda81-lp150.2.3.1 libimobiledevice-debugsource-1.2.0+git20170122.45fda81-lp150.2.3.1 libimobiledevice-devel-1.2.0+git20170122.45fda81-lp150.2.3.1 libimobiledevice6-1.2.0+git20170122.45fda81-lp150.2.3.1 libimobiledevice6-debuginfo-1.2.0+git20170122.45fda81-lp150.2.3.1 python-imobiledevice-1.2.0+git20170122.45fda81-lp150.2.3.1 python-imobiledevice-debuginfo-1.2.0+git20170122.45fda81-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libimobiledevice6-32bit-1.2.0+git20170122.45fda81-lp150.2.3.1 libimobiledevice6-32bit-debuginfo-1.2.0+git20170122.45fda81-lp150.2.3.1 References: https://bugzilla.suse.com/1103546

1 0

openSUSE-SU-2019:2108-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2108-1 Rating: moderate References: #1135787 #1135789 #1135796 #1135806 #1136101 #1140419 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-12217 CVE-2019-12218 CVE-2019-12220 CVE-2019-12221 CVE-2019-12222 CVE-2019-13616 CVE-2019-5051 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Update to new upstream release 2.0.5. Security issues fixed: * TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419) * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) Not mentioned by upstream, but issues seemingly further fixed: * CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789) * CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787) * CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806) * CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796) * CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2108=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2108=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): SDL2_image-debugsource-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-debuginfo-2.0.5-bp151.4.3.1 libSDL2_image-devel-2.0.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-64bit-debuginfo-2.0.5-bp151.4.3.1 libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libSDL2_image-2_0-0-2.0.5-bp150.3.6.1 libSDL2_image-devel-2.0.5-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libSDL2_image-2_0-0-64bit-2.0.5-bp150.3.6.1 libSDL2_image-devel-64bit-2.0.5-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-12217.html https://www.suse.com/security/cve/CVE-2019-12218.html https://www.suse.com/security/cve/CVE-2019-12220.html https://www.suse.com/security/cve/CVE-2019-12221.html https://www.suse.com/security/cve/CVE-2019-12222.html https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5051.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://bugzilla.suse.com/1135787 https://bugzilla.suse.com/1135789 https://bugzilla.suse.com/1135796 https://bugzilla.suse.com/1135806 https://bugzilla.suse.com/1136101 https://bugzilla.suse.com/1140419 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768

1 0

openSUSE-SU-2019:2110-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2110-1 Rating: moderate References: #1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2110=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-Twisted-doc-17.9.0-bp150.4.6.1 python2-Twisted-17.9.0-bp150.4.6.1 python3-Twisted-17.9.0-bp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-12855.html https://bugzilla.suse.com/1138461

1 0

openSUSE-SU-2019:2107-1: important: Recommended update for opera
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2107-1 Rating: important References: Affected Products: openSUSE Leap 15.1:NonFree openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Opera was updated to version 63.0.3368.66: - CHR-7525 Update chromium on desktop-stable-76-3368 to 76.0.3809.132 - DNA-74031 Download indicator doesn’t match progress - DNA-77042 Something went wrong message in crypto wallet in private window - DNA-79137 Crash at opera::installer::OptionsScreen:: OnLanguageChanged() - DNA-79683 Installer crashes when showing progress - DNA-79757 Line divider under address bar disappears after opening and closing Bookmarks Bar - DNA-80012 Zoom popup appears each time clicking ‘heart’ icon - DNA-80110 Bug when changing the install path in installer - DNA-80417 [assistant] Crash at opera::avro::event_driven::StatSenderImpl::NetworkThread:: SetTrafficAllowed(bool) - DNA-80422 Continue shopping section is too close to Speed Dial tiles when tiles are big - DNA-80463 Add shadow to shopping tiles - DNA-78143 Load async resources before rendering the page - DNA-79102 Make AU to be always server IPC endpoint when new AU logic is enabled - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80416 Crash at opera::assistant::ProcessMonitorImpl:: ObserveProcess(std::__1::basic_string const&, opera::assistant:: ProcessMonitor::Observer*) - DNA-79558 Add database for continue shopping feature - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79558 Add database for continue shopping feature - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79063 Address bar icons are hardly visible in private window in light mode - DNA-79274 No warning notification on quitting Opera with multiple tabs open after update - DNA-80103 Investigate best ICECC_THREADS for faster Mac builds - DNA-80105 O63 translations (08.08.2019) - DNA-80219 DCHECK at ExtensionDownloader::HandleManifestResults - DNA-80330 [My Flow] The QR code and connection code is not visible for some people - DNA-79569 Don’t provide default value for titleTextColor in opr.wallpapersAPI - DNA-80221 Change channel to “stable” in permissions features for wallpapersPrivate - DNA-80230 Promote O63 to stable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2019-2107=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2019-2107=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-63.0.3368.66-lp151.2.6.1 - openSUSE Leap 15.0:NonFree (x86_64): opera-63.0.3368.66-lp150.2.18.1 References:

1 0

openSUSE-RU-2019:2105-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2105-1 Rating: moderate References: #1113712 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for open-iscsi fixes the following issues: - Fixes an issue where an iSCSI boot failure appeared in MPIO config with single path active (bsc#1113712) Additionally: This update includes a lot of smaller bug fixes. Please refer to this rpm's changelog file to get the full list of all changes. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2105=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): iscsiuio-0.7.8.2-lp151.13.3.1 iscsiuio-debuginfo-0.7.8.2-lp151.13.3.1 libopeniscsiusr0_2_0-2.0.876-lp151.13.3.1 libopeniscsiusr0_2_0-debuginfo-2.0.876-lp151.13.3.1 open-iscsi-2.0.876-lp151.13.3.1 open-iscsi-debuginfo-2.0.876-lp151.13.3.1 open-iscsi-debugsource-2.0.876-lp151.13.3.1 open-iscsi-devel-2.0.876-lp151.13.3.1 References: https://bugzilla.suse.com/1113712

1 0

openSUSE-RU-2019:2103-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2103-1 Rating: moderate References: #1113712 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for open-iscsi fixes the following issues: - Fixes an issue where an iSCSI boot failure appeared in MPIO config with single path active (bsc#1113712) Additionally: This update includes a lot of smaller bug fixes. Please refer to this rpm's changelog file to get the full list of all changes. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2103=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): iscsiuio-0.7.8.2-lp150.9.16.1 iscsiuio-debuginfo-0.7.8.2-lp150.9.16.1 libopeniscsiusr0_2_0-2.0.876-lp150.9.16.1 libopeniscsiusr0_2_0-debuginfo-2.0.876-lp150.9.16.1 open-iscsi-2.0.876-lp150.9.16.1 open-iscsi-debuginfo-2.0.876-lp150.9.16.1 open-iscsi-debugsource-2.0.876-lp150.9.16.1 open-iscsi-devel-2.0.876-lp150.9.16.1 References: https://bugzilla.suse.com/1113712

1 0

openSUSE-RU-2019:2102-1: moderate: Recommended update for google-compute-engine
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2102-1 Rating: moderate References: #1144092 #1144170 #1146172 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for google-compute-engine fixes the following issues: - updated to version 20190801 (bsc#1144092, bsc#1144170) * Fix for 2FA on RHEL 8 * Support for Debian 10 * Support for Google Private Access over IPv6 * Support root disk expansion in RHEL 8 and Debian 10 Some more minor bug fixes were included in this maintenance update. The full list can be retrieved from this rpm's changelog file. - Fix install location of NSS and PAM shared libraries (bsc#1146172) - Switch RPM group for oslogin package from Hardware to System/Daemons This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2102=1 Package List: - openSUSE Leap 15.1 (x86_64): google-compute-engine-debugsource-20190801-lp151.2.10.1 google-compute-engine-oslogin-20190801-lp151.2.10.1 google-compute-engine-oslogin-debuginfo-20190801-lp151.2.10.1 - openSUSE Leap 15.1 (noarch): google-compute-engine-init-20190801-lp151.2.10.1 References: https://bugzilla.suse.com/1144092 https://bugzilla.suse.com/1144170 https://bugzilla.suse.com/1146172

1 0

openSUSE-RU-2019:2106-1: moderate: Recommended update for SUSEConnect
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2106-1 Rating: moderate References: #1128969 #1136752 #1144020 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for SUSEConnect fixes the following issues: - Fix failing on registered system without arguments (bsc#1144020) - Fix base product service removal during de-registration in public clouds (bsc#1136752) - It will no longer try to remove a service during migration if a zypper service plugin already exists (bsc#1128969) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2106=1 Package List: - openSUSE Leap 15.1 (x86_64): SUSEConnect-0.3.19-lp151.2.3.1 References: https://bugzilla.suse.com/1128969 https://bugzilla.suse.com/1136752 https://bugzilla.suse.com/1144020

1 0

openSUSE-RU-2019:2104-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2104-1 Rating: moderate References: #1124370 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perf provides the following fixes: - Add POWER mem/c2c support. (FATE#326869, bsc#1124370) (Initial implementation was as FATE#326866 in SLE15-SP1) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2104=1 Package List: - openSUSE Leap 15.0 (x86_64): perf-4.12.14-lp150.8.10.1 perf-debuginfo-4.12.14-lp150.8.10.1 perf-debugsource-4.12.14-lp150.8.10.1 References: https://bugzilla.suse.com/1124370

1 0

openSUSE-RU-2019:2100-1: moderate: Recommended update for yast2-firstboot
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for yast2-firstboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2100-1 Rating: moderate References: #1140199 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-firstboot fixes the following issue: - AutoYaST: automatic installation results in lan and ntp-client module failure (bsc#1140199) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2100=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-firstboot-4.1.8-lp151.2.6.1 References: https://bugzilla.suse.com/1140199

1 0

openSUSE-RU-2019:2101-1: moderate: Recommended update for google-compute-engine
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2101-1 Rating: moderate References: #1144092 #1144170 #1146172 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for google-compute-engine fixes the following issues: - updated to version 20190801 (bsc#1144092, bsc#1144170) * Fix for 2FA on RHEL 8 * Support for Debian 10 * Support for Google Private Access over IPv6 * Support root disk expansion in RHEL 8 and Debian 10 Some more minor bug fixes were included in this maintenance update. The full list can be retrieved from this rpm's changelog file. - Fix install location of NSS and PAM shared libraries (bsc#1146172) - Switch RPM group for oslogin package from Hardware to System/Daemons This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2101=1 Package List: - openSUSE Leap 15.0 (x86_64): google-compute-engine-debugsource-20190801-lp150.2.26.1 google-compute-engine-oslogin-20190801-lp150.2.26.1 google-compute-engine-oslogin-debuginfo-20190801-lp150.2.26.1 - openSUSE Leap 15.0 (noarch): google-compute-engine-init-20190801-lp150.2.26.1 References: https://bugzilla.suse.com/1144092 https://bugzilla.suse.com/1144170 https://bugzilla.suse.com/1146172

1 0

openSUSE-RU-2019:2098-1: moderate: Recommended update for habootstrap-formula, python-shaptools, saphanabootstrap-formula
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for habootstrap-formula, python-shaptools, saphanabootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2098-1 Rating: moderate References: #1137989 #1142306 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for habootstrap-formula, python-shaptools, saphanabootstrap-formula fixes the following issues: python-shaptools was updated to version 0.3.1: - Add support for Power machines (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) - Add an option to run the commands in remote nodes to shapcli - shapcli is provided to expose shaptools api methods as command line tool - Add support for Power machines - Add an option to run the commands in remote nodes to shapcli - shapcli is provided to expose shaptools api methods as command line tool habootstrap-formula was updated to version 0.2.4: - Fix issue with file permissions during package installation in /usr/share/salt-formulas (boo#1142306) - Make pkg.install more resilient, allowing retries during install - Change the salt-formula directories permissions to 0750 to avoid conflicts with the package salt-standalone-formulas-configuration. - Correct the required package name to salt-standalone-formulas-configuration saphanabootstrap-formula was updated to version 0.2.9: - Fix srHook script usage for cost optimized scenario - Add scenario type options to the form.yml file (boo#1137989) - Fix errors in the form.yml file to match with the formula names - Fix some styling issues - Add support for Power machines - Fix issues with SAP HANA deployment template and the exporter - Fix issue with file permissions during package installation in /usr/share/salt-formulas (boo#1142306) - Retry pkg.install multiple times, in case a pkg installtion fails for having a more resilient installation. - hanadb_exporter executed as a daemon - hanadb_exporter installation suggested - Change the salt-formula directories permissions to 0750 to avoid conflicts with the package salt-standalone-formulas-configuration. - Correct the required package name to salt-standalone-formulas-configuration - supporting hanadb_exporter logging system - adding hanadb_exporter deployment This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2098=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2098=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): habootstrap-formula-0.2.4-bp151.5.1 python2-shaptools-0.3.1-bp151.5.1 python3-shaptools-0.3.1-bp151.5.1 saphanabootstrap-formula-0.2.9-bp151.5.1 - openSUSE Backports SLE-15 (noarch): habootstrap-formula-0.2.4-bp150.5.1 python2-shaptools-0.3.1-bp150.5.1 python3-shaptools-0.3.1-bp150.5.1 saphanabootstrap-formula-0.2.9-bp150.5.1 References: https://bugzilla.suse.com/1137989 https://bugzilla.suse.com/1142306

1 0

openSUSE-RU-2019:2099-1: moderate: Recommended update for SUSEConnect
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2099-1 Rating: moderate References: #1136752 #1144020 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for SUSEConnect fixes the following issues: - Fix failing on registered system without arguments (bsc#1144020) - Fix base product service removal during de-registration in public clouds (bsc#1136752) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2099=1 Package List: - openSUSE Leap 15.0 (x86_64): SUSEConnect-0.3.19-lp150.2.17.1 References: https://bugzilla.suse.com/1136752 https://bugzilla.suse.com/1144020

1 0

openSUSE-RU-2019:2097-1: moderate: Recommended update for devscripts
by maintenance＠opensuse.org 09 Sep '19

09 Sep '19

openSUSE Recommended Update: Recommended update for devscripts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2097-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for devscripts fixes the following issues: Update to version 2.18.10: * See /usr/share/doc/packages/devscripts/changelog Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2097=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): devscripts-2.19.5-lp151.3.5.1 devscripts-debuginfo-2.19.5-lp151.3.5.1 - openSUSE Leap 15.1 (noarch): checkbashisms-2.19.5-lp151.3.5.1 References:

1 0

openSUSE-SU-2019:2096-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2096-1 Rating: moderate References: #1148728 Cross-References: CVE-2019-15757 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: Security issues fixed: - CVE-2019-15757: Fixed NULL pointer dereference in the NRG parser (boo#1148728). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2096=1 Package List: - openSUSE Leap 15.1 (x86_64): libmirage-3_2-3.2.2-lp151.3.6.1 libmirage-3_2-debuginfo-3.2.2-lp151.3.6.1 libmirage-debuginfo-3.2.2-lp151.3.6.1 libmirage-debugsource-3.2.2-lp151.3.6.1 libmirage-devel-3.2.2-lp151.3.6.1 libmirage11-3.2.2-lp151.3.6.1 libmirage11-debuginfo-3.2.2-lp151.3.6.1 typelib-1_0-libmirage-3_2-3.2.2-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): libmirage-data-3.2.2-lp151.3.6.1 libmirage-lang-3.2.2-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15757.html https://bugzilla.suse.com/1148728

1 0

openSUSE-SU-2019:2095-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2095-1 Rating: moderate References: #1148728 Cross-References: CVE-2019-15757 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: Security issues fixed: - CVE-2019-15757: Fixed NULL pointer dereference in the NRG parser (boo#1148728). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2095=1 Package List: - openSUSE Leap 15.0 (x86_64): libmirage-3_2-3.2.2-lp150.2.6.1 libmirage-3_2-debuginfo-3.2.2-lp150.2.6.1 libmirage-debuginfo-3.2.2-lp150.2.6.1 libmirage-debugsource-3.2.2-lp150.2.6.1 libmirage-devel-3.2.2-lp150.2.6.1 libmirage11-3.2.2-lp150.2.6.1 libmirage11-debuginfo-3.2.2-lp150.2.6.1 typelib-1_0-libmirage-3_2-3.2.2-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): libmirage-data-3.2.2-lp150.2.6.1 libmirage-lang-3.2.2-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-15757.html https://bugzilla.suse.com/1148728

1 0

openSUSE-SU-2019:2093-1: important: Security update for exim
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2093-1 Rating: important References: #1149182 Cross-References: CVE-2019-15846 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: exim was updated to fix a security issue: - CVE-2019-15846: Fixed a buffer overflow in SMTP Delivery process where a remote attacker could execute code with root privileges by sending crafted SNI data (boo#1149182). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2093=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2093=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.9.1 exim-debuginfo-4.88-lp151.4.9.1 exim-debugsource-4.88-lp151.4.9.1 eximon-4.88-lp151.4.9.1 eximon-debuginfo-4.88-lp151.4.9.1 eximstats-html-4.88-lp151.4.9.1 - openSUSE Leap 15.0 (x86_64): exim-4.88-lp150.3.9.1 exim-debuginfo-4.88-lp150.3.9.1 exim-debugsource-4.88-lp150.3.9.1 eximon-4.88-lp150.3.9.1 eximon-debuginfo-4.88-lp150.3.9.1 eximstats-html-4.88-lp150.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-15846.html https://bugzilla.suse.com/1149182

1 0

openSUSE-SU-2019:2094-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2094-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2094=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.132-bp151.3.9.1 chromium-76.0.3809.132-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143

1 0

openSUSE-RU-2019:2092-1: moderate: Recommended update for jack
by maintenance＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Recommended Update: Recommended update for jack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2092-1 Rating: moderate References: #1108981 #1132458 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for jack fixes the following issues: - Make jack_control python2-3 compatible (boo#1132458). - Remove unnecessary requires for libjack0 and remove obsolete comments. - Fix return value check of mmap() (boo#1108981). - Update the waf code to the 2.0 series in order to work under python3.7 taken from upstream git. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2092=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): jack-1.9.12-lp151.3.3.1 jack-debuginfo-1.9.12-lp151.3.3.1 jack-debugsource-1.9.12-lp151.3.3.1 libjack-devel-1.9.12-lp151.3.3.1 libjack0-1.9.12-lp151.3.3.1 libjack0-debuginfo-1.9.12-lp151.3.3.1 libjacknet0-1.9.12-lp151.3.3.1 libjacknet0-debuginfo-1.9.12-lp151.3.3.1 libjackserver0-1.9.12-lp151.3.3.1 libjackserver0-debuginfo-1.9.12-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): jack-32bit-1.9.12-lp151.3.3.1 jack-32bit-debuginfo-1.9.12-lp151.3.3.1 libjack-devel-32bit-1.9.12-lp151.3.3.1 libjack0-32bit-1.9.12-lp151.3.3.1 libjack0-32bit-debuginfo-1.9.12-lp151.3.3.1 libjacknet0-32bit-1.9.12-lp151.3.3.1 libjacknet0-32bit-debuginfo-1.9.12-lp151.3.3.1 libjackserver0-32bit-1.9.12-lp151.3.3.1 libjackserver0-32bit-debuginfo-1.9.12-lp151.3.3.1 References: https://bugzilla.suse.com/1108981 https://bugzilla.suse.com/1132458

1 0

openSUSE-RU-2019:2091-1: moderate: Recommended update for python-cheroot
by maintenance＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Recommended Update: Recommended update for python-cheroot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2091-1 Rating: moderate References: #1149124 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-cheroot fixes the following issues: - Drop dependency on backports.functools_lru_cache for the python3 subpackage. (boo#1149124) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2091=1 Package List: - openSUSE Leap 15.1 (noarch): python2-cheroot-6.5.5-lp151.3.6.1 python3-cheroot-6.5.5-lp151.3.6.1 References: https://bugzilla.suse.com/1149124

1 0

openSUSE-SU-2019:2089-1: moderate: Security update for httpie
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for httpie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2089-1 Rating: moderate References: #1148466 Cross-References: CVE-2019-10751 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for httpie fixes the following issues: httpie was updated to version 1.0.3: * Fix CVE-2019-10751 (HTTPie is vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2089=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python3-httpie-1.0.3-bp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-10751.html https://bugzilla.suse.com/1148466

1 0

openSUSE-RU-2019:2086-1: moderate: Recommended update for desktop-file-utils
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for desktop-file-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2086-1 Rating: moderate References: #1094774 #1148080 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for desktop-file-utils fixes the following issues: - let update-desktop-database recognize font media types (boo#1148080) - add Pantheon to desktop env list(fdo#105785 boo#1094774). - Move RPM macros to %_rpmmacrodir. - suse-update-mime-defaults requires coreutils and awk add both to package requires Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2086=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): desktop-file-utils-0.23-lp151.4.3.1 desktop-file-utils-debuginfo-0.23-lp151.4.3.1 desktop-file-utils-debugsource-0.23-lp151.4.3.1 References: https://bugzilla.suse.com/1094774 https://bugzilla.suse.com/1148080

1 0

openSUSE-RU-2019:2088-1: moderate: Recommended update for youtube-dl
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for youtube-dl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2088-1 Rating: moderate References: #1120842 #1121694 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for youtube-dl fixes the following issues: youtube-dl was updated to new upstream release 2019.08.13: * downloader/fragment: Fix ETA calculation of resumed download * discovery: extract series meta field * roosterteeth: add support for watch URLs Update to new upstream release 2019.08.02 * [yahoo:japannews] Add support for yahoo.co.jp (#21698, #21265) * [discovery] Add support go.discovery.com URLs * [youtube:playlist] Relax video regular expression (#21844) * [generic] Restrict --default-search schemeless URLs detection pattern (#21842) * [vrv] Fix CMS signing query extraction (#21809) * [youtube] Fix and improve title and description extraction (#21934) * [tvigle] Add support for HLS and DASH formats (#21967) * [tvigle] Fix extraction (#21967) * [yandexvideo] Add support for DASH formats (#21971) * [discovery] Use API call for video data extraction (#21808) * [mgtv] Extract format_note (#21881) * [tvn24] Fix metadata extraction (#21833, #21834) * [dlive] Relax URL regular expression (#21909) * [openload] Add support for oload.best (#21913) * [youtube] Improve metadata extraction for age gate content (#21943) Update to new upstream release 2019.07.16: * [asiancrush] Add support for yuyutv.com, midnightpulp.com and cocoro.tv * (#21281, #21290) * [kaltura] Check source format URL (#21290) * [ctsnews] Fix YouTube embeds extraction (#21678) * [einthusan] Add support for einthusan.com (#21748, #21775) * [youtube] Add support for invidious.mastodon.host (#21777) * [gfycat] Extend URL regular expression (#21779, #21780) * [youtube] Restrict is_live extraction (#21782) Update to new upstream release 2019.07.02 * Introduce random_user_agent and use as default User-Agent (closes #21546) * dailymotion: add support embed with DM.player js call * openload: Add support for oload.biz This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2088=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2088=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-youtube-dl-2019.08.13-bp151.5.3.1 python3-youtube-dl-2019.08.13-bp151.5.3.1 youtube-dl-2019.08.13-bp151.5.3.1 youtube-dl-bash-completion-2019.08.13-bp151.5.3.1 youtube-dl-fish-completion-2019.08.13-bp151.5.3.1 youtube-dl-zsh-completion-2019.08.13-bp151.5.3.1 - openSUSE Backports SLE-15 (noarch): youtube-dl-2019.08.13-bp150.7.1 youtube-dl-bash-completion-2019.08.13-bp150.7.1 youtube-dl-fish-completion-2019.08.13-bp150.7.1 youtube-dl-zsh-completion-2019.08.13-bp150.7.1 References: https://bugzilla.suse.com/1120842 https://bugzilla.suse.com/1121694

1 0

openSUSE-RU-2019:2090-1: moderate: Recommended update for plasma5-pk-updates
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for plasma5-pk-updates ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2090-1 Rating: moderate References: #1086068 #1148168 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for plasma5-pk-updates fixes the following issues: Various fixes were done to improve the french translations (boo#1086068) Also implemented EULA handling (boo#1148168): This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2090=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): plasma5-pk-updates-0.3.2-bp151.5.3.1 - openSUSE Backports SLE-15-SP1 (noarch): plasma5-pk-updates-lang-0.3.2-bp151.5.3.1 References: https://bugzilla.suse.com/1086068 https://bugzilla.suse.com/1148168

1 0

openSUSE-SU-2019:2085-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2085-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2085=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.17.1 go1.12-doc-1.12.9-lp151.2.17.1 go1.12-race-1.12.9-lp151.2.17.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123

1 0

openSUSE-RU-2019:2087-1: moderate: Recommended update for plasma5-pk-updates
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for plasma5-pk-updates ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2087-1 Rating: moderate References: #1086068 #1148168 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for plasma5-pk-updates fixes the following issues: Various fixes were done to improve the french translations (boo#1086068) Also implemented EULA handling (boo#1148168): This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2087=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): plasma5-pk-updates-0.3.2-bp150.24.1 - openSUSE Backports SLE-15 (noarch): plasma5-pk-updates-lang-0.3.2-bp150.24.1 References: https://bugzilla.suse.com/1086068 https://bugzilla.suse.com/1148168

1 0

openSUSE-RU-2019:2084-1: moderate: Recommended update for enigmail
by maintenance＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Recommended Update: Recommended update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2084-1 Rating: moderate References: #1141025 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enigmail fixes the following issues: - enimail 2.0.12: * set the default keyserver to keys.openpgp.org in order to mitigate the SKS Keyserver Network Attack (boo#1141025) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2084=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): enigmail-2.0.12-34.1 References: https://bugzilla.suse.com/1141025

1 0

openSUSE-SU-2019:2083-1: moderate: Security update for srt
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for srt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2083-1 Rating: moderate References: #1148844 Cross-References: CVE-2019-15784 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: srt was updated to version 1.3.4. Security issues fixed: * CVE-2019-15784: avoid a potential array overflow. (boo#1148844) * New binary: srt-tunnel * srt-multiplexer binary is now a testing application and thus is dropped from our package. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2083=1 Package List: - openSUSE Leap 15.1 (x86_64): libsrt1-1.3.4-lp151.2.3.1 libsrt1-debuginfo-1.3.4-lp151.2.3.1 srt-1.3.4-lp151.2.3.1 srt-debuginfo-1.3.4-lp151.2.3.1 srt-debugsource-1.3.4-lp151.2.3.1 srt-devel-1.3.4-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15784.html https://bugzilla.suse.com/1148844

1 0

openSUSE-SU-2019:2081-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2081-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2081=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.132-lp150.234.1 chromedriver-debuginfo-76.0.3809.132-lp150.234.1 chromium-76.0.3809.132-lp150.234.1 chromium-debuginfo-76.0.3809.132-lp150.234.1 chromium-debugsource-76.0.3809.132-lp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143

1 0

openSUSE-SU-2019:2080-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2080-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2080=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.132-lp151.2.25.1 chromedriver-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-76.0.3809.132-lp151.2.25.1 chromium-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-debugsource-76.0.3809.132-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143

1 0

openSUSE-SU-2019:2077-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2077-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2077=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2077=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp151.4.3.1 libmirage-3_2-debuginfo-3.2.2-bp151.4.3.1 libmirage-debuginfo-3.2.2-bp151.4.3.1 libmirage-debugsource-3.2.2-bp151.4.3.1 libmirage-devel-3.2.2-bp151.4.3.1 libmirage11-3.2.2-bp151.4.3.1 libmirage11-debuginfo-3.2.2-bp151.4.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): libmirage-data-3.2.2-bp151.4.3.1 libmirage-lang-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp150.3.3.1 libmirage-devel-3.2.2-bp150.3.3.1 libmirage11-3.2.2-bp150.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libmirage-data-3.2.2-bp150.3.3.1 libmirage-lang-3.2.2-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087

1 0

openSUSE-SU-2019:2078-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2078-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2078=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-SQLAlchemy-1.2.7-bp150.2.3.1 python3-SQLAlchemy-1.2.7-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): python-SQLAlchemy-doc-1.2.7-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593

1 0

openSUSE-RU-2019:2076-1: moderate: Recommended update for sddm
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2076-1 Rating: moderate References: #1025387 #1069396 #1101297 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sddm fixes the following issues: - Add SLE branding package for PackageHub (boo#1101297) - Change the Supplements of branding packages, so they get installed when sddm and the respective branding package is installed. Also added a Supplements to sddm so it gets recommended when plasma5-workspace is installed. - Provide a sddm-branding-SLE package with correct dependencies, together with sddm-branding-openSUSE (boo#1025387, boo#1069396) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2076=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sddm-0.18.0-bp151.4.3.1 sddm-branding-SLE-0.18.0-bp151.4.3.1 sddm-branding-openSUSE-0.18.0-bp151.4.3.1 sddm-branding-upstream-0.18.0-bp151.4.3.1 References: https://bugzilla.suse.com/1025387 https://bugzilla.suse.com/1069396 https://bugzilla.suse.com/1101297

1 0

openSUSE-OU-2019:2075-1: moderate: Optional update for sddm
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Optional Update: Optional update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:2075-1 Rating: moderate References: #1105342 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update for sddm adds the following functionality: * Honor PAM's ambient supplemental groups (boo#1105342) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2075=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): sddm-0.17.0-bp150.9.13.1 sddm-branding-openSUSE-0.17.0-bp150.9.13.1 sddm-branding-upstream-0.17.0-bp150.9.13.1 References: https://bugzilla.suse.com/1105342

1 0

openSUSE-SU-2019:2067-1: Security update for wavpack
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for wavpack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2067-1 Rating: low References: #1133384 #1141334 Cross-References: CVE-2019-1010319 CVE-2019-11498 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wavpack fixes the following issues: Security issues fixed: - CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults (bsc#1141334). - CVE-2019-11498: Fixed possible denial of service (application crash) in WavpackSetConfiguration64 via a DFF file that lacks valid sample-rate data (bsc#1133384). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2067=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2067=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwavpack1-5.1.0-lp151.5.3.1 libwavpack1-debuginfo-5.1.0-lp151.5.3.1 wavpack-5.1.0-lp151.5.3.1 wavpack-debuginfo-5.1.0-lp151.5.3.1 wavpack-debugsource-5.1.0-lp151.5.3.1 wavpack-devel-5.1.0-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libwavpack1-32bit-5.1.0-lp151.5.3.1 libwavpack1-32bit-debuginfo-5.1.0-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libwavpack1-5.1.0-lp150.3.6.1 libwavpack1-debuginfo-5.1.0-lp150.3.6.1 wavpack-5.1.0-lp150.3.6.1 wavpack-debuginfo-5.1.0-lp150.3.6.1 wavpack-debugsource-5.1.0-lp150.3.6.1 wavpack-devel-5.1.0-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libwavpack1-32bit-5.1.0-lp150.3.6.1 libwavpack1-32bit-debuginfo-5.1.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-1010319.html https://www.suse.com/security/cve/CVE-2019-11498.html https://bugzilla.suse.com/1133384 https://bugzilla.suse.com/1141334

1 0

openSUSE-RU-2019:2074-1: moderate: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2074-1 Rating: moderate References: #1144169 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ca-certificates-mozilla fixes the following issues: ca-certificates-mozillawas updated to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169) Removed CAs: - Certinomis - Root CA Includes new root CAs from the 2.32 version: - emSign ECC Root CA - C3 (email and server auth) - emSign ECC Root CA - G3 (email and server auth) - emSign Root CA - C1 (email and server auth) - emSign Root CA - G1 (email and server auth) - Hongkong Post Root CA 3 (server auth) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2074=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2074=1 Package List: - openSUSE Leap 15.1 (noarch): ca-certificates-mozilla-2.34-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): ca-certificates-mozilla-2.34-lp150.3.13.1 References: https://bugzilla.suse.com/1144169

1 0

openSUSE-SU-2019:2071-1: moderate: Security update for SDL_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2071-1 Rating: moderate References: #1124827 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-13616 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 CVE-2019-7635 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for SDL_image fixes the following issues: Update SDL_Image to new snapshot 1.2.12+hg695. Security issues fixed: * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) * CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2071=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2071=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-1.2.12+hg695-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://www.suse.com/security/cve/CVE-2019-7635.html https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768

1 0

openSUSE-RU-2019:2069-1: moderate: Recommended update for python-reno
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for python-reno ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2069-1 Rating: moderate References: #1137659 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-reno fixes the following issues: - Added a dependency to python-pbr and python-six in order to let python-reno work properly (bsc#1137659) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2069=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2069=1 Package List: - openSUSE Leap 15.1 (noarch): python2-reno-2.7.0-lp151.3.3.1 python3-reno-2.7.0-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): python2-reno-2.7.0-lp150.2.3.1 python3-reno-2.7.0-lp150.2.3.1 References: https://bugzilla.suse.com/1137659

1 0

openSUSE-RU-2019:2073-1: moderate: Recommended update for phpPgAdmin
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for phpPgAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2073-1 Rating: moderate References: #1094772 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpPgAdmin fixes the following issues: Update to 5.6.0 - Fixed that distributed phpPgAdmin 5.1 did not support distributed PostgreSQL 10.3 (boo#1094772) - Released: 12th November, 2018 - Features * Add support for PostgreSQL 9.3, 9.4, 9.5, 9.6, 10, 11 * Development support for PostgreSQL 12 * Add support for brows/select navigation tabs (firzen) * Add new theme, "bootstrap" (amenadiel) * Improved support for json/jsonb - Bugs * Fix bug in Turkish translation which caused failed ajax responses * Account for Blocked field in admin processes Selenium test * Properly handle column comments * Fix background css issue * Additional language updates - Incompatabilities * Dropped testing of pre-9.3 versions of Postgres, which are now EOL Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2073=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2073=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2073=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2073=1 Package List: - openSUSE Leap 15.1 (noarch): phpPgAdmin-5.6.0-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): phpPgAdmin-5.6.0-lp150.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): phpPgAdmin-5.6.0-bp151.4.3.1 - openSUSE Backports SLE-15 (noarch): phpPgAdmin-5.6.0-bp150.3.3.1 References: https://bugzilla.suse.com/1094772

1 0

openSUSE-SU-2019:2068-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2068-1 Rating: moderate References: #1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2068=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2068=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp151.3.6.1 python-Twisted-debugsource-17.9.0-lp151.3.6.1 python-Twisted-doc-17.9.0-lp151.3.6.1 python2-Twisted-17.9.0-lp151.3.6.1 python2-Twisted-debuginfo-17.9.0-lp151.3.6.1 python3-Twisted-17.9.0-lp151.3.6.1 python3-Twisted-debuginfo-17.9.0-lp151.3.6.1 - openSUSE Leap 15.0 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp150.2.6.1 python-Twisted-debugsource-17.9.0-lp150.2.6.1 python-Twisted-doc-17.9.0-lp150.2.6.1 python2-Twisted-17.9.0-lp150.2.6.1 python2-Twisted-debuginfo-17.9.0-lp150.2.6.1 python3-Twisted-17.9.0-lp150.2.6.1 python3-Twisted-debuginfo-17.9.0-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12855.html https://bugzilla.suse.com/1138461

1 0

openSUSE-SU-2019:2070-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2070-1 Rating: moderate References: #1135787 #1135789 #1135796 #1135806 #1136101 #1140419 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-12217 CVE-2019-12218 CVE-2019-12220 CVE-2019-12221 CVE-2019-12222 CVE-2019-13616 CVE-2019-5051 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Update to new upstream release 2.0.5. Security issues fixed: * TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419) * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) Not mentioned by upstream, but issues seemingly further fixed: * CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789) * CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787) * CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806) * CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796) * CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2070=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2070=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-2.0.5-lp151.2.5.1 - openSUSE Leap 15.1 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1 - openSUSE Leap 15.0 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp150.9.1 libSDL2_image-2_0-0-2.0.5-lp150.9.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-2.0.5-lp150.9.1 - openSUSE Leap 15.0 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp150.9.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-32bit-2.0.5-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-12217.html https://www.suse.com/security/cve/CVE-2019-12218.html https://www.suse.com/security/cve/CVE-2019-12220.html https://www.suse.com/security/cve/CVE-2019-12221.html https://www.suse.com/security/cve/CVE-2019-12222.html https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5051.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://bugzilla.suse.com/1135787 https://bugzilla.suse.com/1135789 https://bugzilla.suse.com/1135796 https://bugzilla.suse.com/1135806 https://bugzilla.suse.com/1136101 https://bugzilla.suse.com/1140419 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768

1 0

openSUSE-RU-2019:2066-1: moderate: Recommended update for sysstat
by maintenance＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Recommended Update: Recommended update for sysstat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2066-1 Rating: moderate References: #1142470 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sysstat fixes the following issues: - Remove deprecated gettext and require gettext-runtime during build only. (bsc#1142470) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2066=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2066=1 Package List: - openSUSE Leap 15.1 (x86_64): sysstat-12.0.2-lp151.3.6.1 sysstat-debuginfo-12.0.2-lp151.3.6.1 sysstat-debugsource-12.0.2-lp151.3.6.1 sysstat-isag-12.0.2-lp151.3.6.1 - openSUSE Leap 15.0 (x86_64): sysstat-12.0.2-lp150.13.1 sysstat-debuginfo-12.0.2-lp150.13.1 sysstat-debugsource-12.0.2-lp150.13.1 sysstat-isag-12.0.2-lp150.13.1 References: https://bugzilla.suse.com/1142470

1 0

openSUSE-SU-2019:2072-1: moderate: Security update for go1.11
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2072-1 Rating: moderate References: #1141688 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.11 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.11.13 (bsc#1141688). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2072=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2072=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.11-1.11.13-lp151.2.9.1 go1.11-doc-1.11.13-lp151.2.9.1 go1.11-race-1.11.13-lp151.2.9.1 - openSUSE Leap 15.0 (x86_64): go1.11-1.11.13-lp150.18.1 go1.11-doc-1.11.13-lp150.18.1 go1.11-race-1.11.13-lp150.18.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1141688 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123

1 0

openSUSE-RU-2019:2065-1: moderate: Recommended update for scap-workbench
by maintenance＠opensuse.org 04 Sep '19

04 Sep '19

openSUSE Recommended Update: Recommended update for scap-workbench ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2065-1 Rating: moderate References: #1084706 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for scap-workbench fixes the following issues: * security hardening for pk-exec usage (boo#1084706). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2065=1 Package List: - openSUSE Leap 15.1 (x86_64): scap-workbench-1.1.5-lp151.4.3.1 scap-workbench-debuginfo-1.1.5-lp151.4.3.1 scap-workbench-doc-1.1.5-lp151.4.3.1 References: https://bugzilla.suse.com/1084706

1 0

openSUSE-SU-2019:2064-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 04 Sep '19

04 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2064-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2064=1 Package List: - openSUSE Leap 15.1 (noarch): python-SQLAlchemy-doc-1.2.14-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): python-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python-SQLAlchemy-debugsource-1.2.14-lp151.2.3.1 python2-SQLAlchemy-1.2.14-lp151.2.3.1 python2-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python3-SQLAlchemy-1.2.14-lp151.2.3.1 python3-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593

1 0

openSUSE-RU-2019:2063-1: moderate: Recommended update for python-kiwi
by maintenance＠opensuse.org 04 Sep '19

04 Sep '19

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2063-1 Rating: moderate References: #1141168 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-kiwi fixes the following issues: - kiwi will no longer create an empty machine-id file in case it is not provided during the system installation (bsc#1141168) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2063=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-kiwi-lib-9.17.16-lp150.2.23.1 dracut-kiwi-live-9.17.16-lp150.2.23.1 dracut-kiwi-oem-dump-9.17.16-lp150.2.23.1 dracut-kiwi-oem-repart-9.17.16-lp150.2.23.1 dracut-kiwi-overlay-9.17.16-lp150.2.23.1 kiwi-man-pages-9.17.16-lp150.2.23.1 kiwi-pxeboot-9.17.16-lp150.2.23.1 kiwi-tools-9.17.16-lp150.2.23.1 kiwi-tools-debuginfo-9.17.16-lp150.2.23.1 python-kiwi-debugsource-9.17.16-lp150.2.23.1 python2-kiwi-9.17.16-lp150.2.23.1 python3-kiwi-9.17.16-lp150.2.23.1 References: https://bugzilla.suse.com/1141168

1 0

openSUSE-SU-2019:2062-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2062-1 Rating: important References: #1145092 Cross-References: CVE-2019-10208 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner (bsc#1145092). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2062=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2062=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libecpg6-10.10-lp151.2.6.1 libecpg6-debuginfo-10.10-lp151.2.6.1 libpq5-10.10-lp151.2.6.1 libpq5-debuginfo-10.10-lp151.2.6.1 postgresql10-10.10-lp151.2.6.1 postgresql10-contrib-10.10-lp151.2.6.1 postgresql10-contrib-debuginfo-10.10-lp151.2.6.1 postgresql10-debuginfo-10.10-lp151.2.6.1 postgresql10-debugsource-10.10-lp151.2.6.1 postgresql10-devel-10.10-lp151.2.6.1 postgresql10-devel-debuginfo-10.10-lp151.2.6.1 postgresql10-plperl-10.10-lp151.2.6.1 postgresql10-plperl-debuginfo-10.10-lp151.2.6.1 postgresql10-plpython-10.10-lp151.2.6.1 postgresql10-plpython-debuginfo-10.10-lp151.2.6.1 postgresql10-pltcl-10.10-lp151.2.6.1 postgresql10-pltcl-debuginfo-10.10-lp151.2.6.1 postgresql10-server-10.10-lp151.2.6.1 postgresql10-server-debuginfo-10.10-lp151.2.6.1 postgresql10-test-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): libecpg6-32bit-10.10-lp151.2.6.1 libecpg6-32bit-debuginfo-10.10-lp151.2.6.1 libpq5-32bit-10.10-lp151.2.6.1 libpq5-32bit-debuginfo-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): postgresql10-docs-10.10-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.10-lp150.3.13.1 libecpg6-debuginfo-10.10-lp150.3.13.1 libpq5-10.10-lp150.3.13.1 libpq5-debuginfo-10.10-lp150.3.13.1 postgresql10-10.10-lp150.3.13.1 postgresql10-contrib-10.10-lp150.3.13.1 postgresql10-contrib-debuginfo-10.10-lp150.3.13.1 postgresql10-debuginfo-10.10-lp150.3.13.1 postgresql10-debugsource-10.10-lp150.3.13.1 postgresql10-devel-10.10-lp150.3.13.1 postgresql10-devel-debuginfo-10.10-lp150.3.13.1 postgresql10-plperl-10.10-lp150.3.13.1 postgresql10-plperl-debuginfo-10.10-lp150.3.13.1 postgresql10-plpython-10.10-lp150.3.13.1 postgresql10-plpython-debuginfo-10.10-lp150.3.13.1 postgresql10-pltcl-10.10-lp150.3.13.1 postgresql10-pltcl-debuginfo-10.10-lp150.3.13.1 postgresql10-server-10.10-lp150.3.13.1 postgresql10-server-debuginfo-10.10-lp150.3.13.1 postgresql10-test-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.10-lp150.3.13.1 libecpg6-32bit-debuginfo-10.10-lp150.3.13.1 libpq5-32bit-10.10-lp150.3.13.1 libpq5-32bit-debuginfo-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.10-lp150.3.13.1 References: https://www.suse.com/security/cve/CVE-2019-10208.html https://bugzilla.suse.com/1145092

1 0

openSUSE-RU-2019:2060-1: moderate: Recommended update for yast2-ftp-server
by maintenance＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Recommended Update: Recommended update for yast2-ftp-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2060-1 Rating: moderate References: #1142146 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-ftp-server fixes the following issue: - wrong allowed user displayed (bsc#1142146) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2060=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-ftp-server-4.1.7-lp151.2.3.1 References: https://bugzilla.suse.com/1142146

1 0

openSUSE-RU-2019:2061-1: moderate: Recommended update for python-kiwi
by maintenance＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2061-1 Rating: moderate References: #1141168 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-kiwi fixes the following issues: - kiwi will no longer create an empty machine-id file in case it is not provided during the system installation (bsc#1141168) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2061=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): dracut-kiwi-lib-9.17.16-lp151.2.3.1 dracut-kiwi-live-9.17.16-lp151.2.3.1 dracut-kiwi-oem-dump-9.17.16-lp151.2.3.1 dracut-kiwi-oem-repart-9.17.16-lp151.2.3.1 dracut-kiwi-overlay-9.17.16-lp151.2.3.1 kiwi-man-pages-9.17.16-lp151.2.3.1 kiwi-pxeboot-9.17.16-lp151.2.3.1 kiwi-tools-9.17.16-lp151.2.3.1 kiwi-tools-debuginfo-9.17.16-lp151.2.3.1 python-kiwi-debugsource-9.17.16-lp151.2.3.1 python2-kiwi-9.17.16-lp151.2.3.1 python3-kiwi-9.17.16-lp151.2.3.1 References: https://bugzilla.suse.com/1141168

1 0

openSUSE-SU-2019:2059-1: important: Security update for qemu
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2059-1 Rating: important References: #1079730 #1098403 #1111025 #1119115 #1134883 #1135902 #1136540 #1136778 #1140402 #1143794 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). Bug fixes and enhancements: - Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764) - Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796) - Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025). - Ignore csske for expanding the cpu model (bsc#1136540) - Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2059=1 Package List: - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.25.1 qemu-arm-2.11.2-lp150.7.25.1 qemu-arm-debuginfo-2.11.2-lp150.7.25.1 qemu-block-curl-2.11.2-lp150.7.25.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.25.1 qemu-block-dmg-2.11.2-lp150.7.25.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.25.1 qemu-block-gluster-2.11.2-lp150.7.25.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.25.1 qemu-block-iscsi-2.11.2-lp150.7.25.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.25.1 qemu-block-rbd-2.11.2-lp150.7.25.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.25.1 qemu-block-ssh-2.11.2-lp150.7.25.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.25.1 qemu-debuginfo-2.11.2-lp150.7.25.1 qemu-debugsource-2.11.2-lp150.7.25.1 qemu-extra-2.11.2-lp150.7.25.1 qemu-extra-debuginfo-2.11.2-lp150.7.25.1 qemu-guest-agent-2.11.2-lp150.7.25.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.25.1 qemu-ksm-2.11.2-lp150.7.25.1 qemu-kvm-2.11.2-lp150.7.25.1 qemu-lang-2.11.2-lp150.7.25.1 qemu-ppc-2.11.2-lp150.7.25.1 qemu-ppc-debuginfo-2.11.2-lp150.7.25.1 qemu-s390-2.11.2-lp150.7.25.1 qemu-s390-debuginfo-2.11.2-lp150.7.25.1 qemu-tools-2.11.2-lp150.7.25.1 qemu-tools-debuginfo-2.11.2-lp150.7.25.1 qemu-x86-2.11.2-lp150.7.25.1 qemu-x86-debuginfo-2.11.2-lp150.7.25.1 - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.25.1 qemu-seabios-1.11.0-lp150.7.25.1 qemu-sgabios-8-lp150.7.25.1 qemu-vgabios-1.11.0-lp150.7.25.1 References: https://www.suse.com/security/cve/CVE-2019-12155.html https://www.suse.com/security/cve/CVE-2019-13164.html https://www.suse.com/security/cve/CVE-2019-14378.html https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1098403 https://bugzilla.suse.com/1111025 https://bugzilla.suse.com/1119115 https://bugzilla.suse.com/1134883 https://bugzilla.suse.com/1135902 https://bugzilla.suse.com/1136540 https://bugzilla.suse.com/1136778 https://bugzilla.suse.com/1140402 https://bugzilla.suse.com/1143794

1 0

openSUSE-SU-2019:2058-1: important: Security update for apache-commons-beanutils
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for apache-commons-beanutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2058-1 Rating: important References: #1146657 Cross-References: CVE-2019-10086 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-commons-beanutils fixes the following issues: Security issue fixed: - CVE-2019-10086: Added special BeanIntrospector class which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects (bsc#1146657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2058=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2058=1 Package List: - openSUSE Leap 15.1 (noarch): apache-commons-beanutils-1.9.2-lp151.3.3.1 apache-commons-beanutils-javadoc-1.9.2-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): apache-commons-beanutils-1.9.2-lp150.2.3.1 apache-commons-beanutils-javadoc-1.9.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10086.html https://bugzilla.suse.com/1146657

1 0

openSUSE-SU-2019:2057-1: important: Security update for libreoffice
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2057-1 Rating: important References: #1133534 #1141861 #1141862 #1146098 #1146105 #1146107 Cross-References: CVE-2019-9848 CVE-2019-9849 CVE-2019-9850 CVE-2019-9851 CVE-2019-9852 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libreoffice fixes the following issues: Security issues fixed: - CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' (bsc#1141861). - CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo (bsc#1141862). - CVE-2019-9851: Fixed LibreLogo global-event script execution issue (bsc#1146105). - CVE-2019-9852: Fixed insufficient URL encoding flaw in allowed script location check (bsc#1146107). - CVE-2019-9850: Fixed insufficient URL validation that allowed LibreLogo script execution (bsc#1146098). Non-security issue fixed: - SmartArt: Basic rendering of Trapezoid List (bsc#1133534) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2057=1 Package List: - openSUSE Leap 15.0 (noarch): libreoffice-branding-upstream-6.2.6.2-lp150.2.16.1 libreoffice-gdb-pretty-printers-6.2.6.2-lp150.2.16.1 libreoffice-glade-6.2.6.2-lp150.2.16.1 libreoffice-icon-themes-6.2.6.2-lp150.2.16.1 libreoffice-l10n-af-6.2.6.2-lp150.2.16.1 libreoffice-l10n-am-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ar-6.2.6.2-lp150.2.16.1 libreoffice-l10n-as-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ast-6.2.6.2-lp150.2.16.1 libreoffice-l10n-be-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-br-6.2.6.2-lp150.2.16.1 libreoffice-l10n-brx-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca_valencia-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-da-6.2.6.2-lp150.2.16.1 libreoffice-l10n-de-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dgo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-el-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_GB-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_ZA-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-es-6.2.6.2-lp150.2.16.1 libreoffice-l10n-et-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ga-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-he-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-id-6.2.6.2-lp150.2.16.1 libreoffice-l10n-is-6.2.6.2-lp150.2.16.1 libreoffice-l10n-it-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ja-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ka-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kab-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-km-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kmr_Latn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ko-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kok-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ks-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mai-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ml-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mni-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-my-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ne-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nso-6.2.6.2-lp150.2.16.1 libreoffice-l10n-oc-6.2.6.2-lp150.2.16.1 libreoffice-l10n-om-6.2.6.2-lp150.2.16.1 libreoffice-l10n-or-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_BR-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_PT-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ro-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ru-6.2.6.2-lp150.2.16.1 libreoffice-l10n-rw-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sa_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sat-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-si-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sid-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sq-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ss-6.2.6.2-lp150.2.16.1 libreoffice-l10n-st-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sw_TZ-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ta-6.2.6.2-lp150.2.16.1 libreoffice-l10n-te-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-th-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ts-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ve-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vec-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-xh-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_CN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_TW-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zu-6.2.6.2-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libreoffice-6.2.6.2-lp150.2.16.1 libreoffice-base-6.2.6.2-lp150.2.16.1 libreoffice-base-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-6.2.6.2-lp150.2.16.1 libreoffice-calc-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-extensions-6.2.6.2-lp150.2.16.1 libreoffice-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-debugsource-6.2.6.2-lp150.2.16.1 libreoffice-draw-6.2.6.2-lp150.2.16.1 libreoffice-draw-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-filters-optional-6.2.6.2-lp150.2.16.1 libreoffice-gnome-6.2.6.2-lp150.2.16.1 libreoffice-gnome-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-impress-6.2.6.2-lp150.2.16.1 libreoffice-impress-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-mailmerge-6.2.6.2-lp150.2.16.1 libreoffice-math-6.2.6.2-lp150.2.16.1 libreoffice-math-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-officebean-6.2.6.2-lp150.2.16.1 libreoffice-officebean-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-qt5-6.2.6.2-lp150.2.16.1 libreoffice-qt5-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-6.2.6.2-lp150.2.16.1 libreoffice-sdk-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-doc-6.2.6.2-lp150.2.16.1 libreoffice-writer-6.2.6.2-lp150.2.16.1 libreoffice-writer-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-writer-extensions-6.2.6.2-lp150.2.16.1 libreofficekit-6.2.6.2-lp150.2.16.1 libreofficekit-devel-6.2.6.2-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-9848.html https://www.suse.com/security/cve/CVE-2019-9849.html https://www.suse.com/security/cve/CVE-2019-9850.html https://www.suse.com/security/cve/CVE-2019-9851.html https://www.suse.com/security/cve/CVE-2019-9852.html https://bugzilla.suse.com/1133534 https://bugzilla.suse.com/1141861 https://bugzilla.suse.com/1141862 https://bugzilla.suse.com/1146098 https://bugzilla.suse.com/1146105 https://bugzilla.suse.com/1146107

1 0

openSUSE-RU-2019:2048-1: moderate: Recommended update for plasma5-pk-updates
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for plasma5-pk-updates ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2048-1 Rating: moderate References: #1086068 #1148168 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for plasma5-pk-updates fixes the following issues: Various fixes were done to improve the french translations (boo#1086068) Also implemented EULA handling (boo#1148168): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2048=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2048=1 Package List: - openSUSE Leap 15.1 (x86_64): plasma5-pk-updates-0.3.2-lp151.4.3.1 plasma5-pk-updates-debuginfo-0.3.2-lp151.4.3.1 plasma5-pk-updates-debugsource-0.3.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): plasma5-pk-updates-lang-0.3.2-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): plasma5-pk-updates-0.3.2-lp150.26.1 plasma5-pk-updates-debuginfo-0.3.2-lp150.26.1 plasma5-pk-updates-debugsource-0.3.2-lp150.26.1 - openSUSE Leap 15.0 (noarch): plasma5-pk-updates-lang-0.3.2-lp150.26.1 References: https://bugzilla.suse.com/1086068 https://bugzilla.suse.com/1148168

1 0

openSUSE-RU-2019:2047-1: moderate: Recommended update for gnome-music
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for gnome-music ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2047-1 Rating: moderate References: #1115708 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-music fixes the following issues: - Mark albums view as initialized, to avoid populating duplicate albums. (bsc#1115708). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2047=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2047=1 Package List: - openSUSE Leap 15.1 (noarch): gnome-music-lang-3.26.2-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): gnome-music-3.26.2-lp151.4.3.1 gnome-music-debuginfo-3.26.2-lp151.4.3.1 gnome-music-debugsource-3.26.2-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): gnome-music-lang-3.26.2-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): gnome-music-3.26.2-lp150.3.3.1 gnome-music-debuginfo-3.26.2-lp150.3.3.1 gnome-music-debugsource-3.26.2-lp150.3.3.1 References: https://bugzilla.suse.com/1115708

1 0

openSUSE-SU-2019:2052-1: important: Security update for slurm
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2052-1 Rating: important References: #1140709 Cross-References: CVE-2019-12838 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm to version 18.08.8 fixes the following issues: Security issue fixed: - CVE-2019-12838: Fixed a SQL injection in slurmdbd (bsc#1140709). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2052=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.8-lp151.2.3.1 libpmi0-debuginfo-18.08.8-lp151.2.3.1 libslurm33-18.08.8-lp151.2.3.1 libslurm33-debuginfo-18.08.8-lp151.2.3.1 perl-slurm-18.08.8-lp151.2.3.1 perl-slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-18.08.8-lp151.2.3.1 slurm-auth-none-18.08.8-lp151.2.3.1 slurm-auth-none-debuginfo-18.08.8-lp151.2.3.1 slurm-config-18.08.8-lp151.2.3.1 slurm-config-man-18.08.8-lp151.2.3.1 slurm-cray-18.08.8-lp151.2.3.1 slurm-cray-debuginfo-18.08.8-lp151.2.3.1 slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-debugsource-18.08.8-lp151.2.3.1 slurm-devel-18.08.8-lp151.2.3.1 slurm-doc-18.08.8-lp151.2.3.1 slurm-hdf5-18.08.8-lp151.2.3.1 slurm-hdf5-debuginfo-18.08.8-lp151.2.3.1 slurm-lua-18.08.8-lp151.2.3.1 slurm-lua-debuginfo-18.08.8-lp151.2.3.1 slurm-munge-18.08.8-lp151.2.3.1 slurm-munge-debuginfo-18.08.8-lp151.2.3.1 slurm-node-18.08.8-lp151.2.3.1 slurm-node-debuginfo-18.08.8-lp151.2.3.1 slurm-openlava-18.08.8-lp151.2.3.1 slurm-pam_slurm-18.08.8-lp151.2.3.1 slurm-pam_slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-plugins-18.08.8-lp151.2.3.1 slurm-plugins-debuginfo-18.08.8-lp151.2.3.1 slurm-seff-18.08.8-lp151.2.3.1 slurm-sjstat-18.08.8-lp151.2.3.1 slurm-slurmdbd-18.08.8-lp151.2.3.1 slurm-slurmdbd-debuginfo-18.08.8-lp151.2.3.1 slurm-sql-18.08.8-lp151.2.3.1 slurm-sql-debuginfo-18.08.8-lp151.2.3.1 slurm-sview-18.08.8-lp151.2.3.1 slurm-sview-debuginfo-18.08.8-lp151.2.3.1 slurm-torque-18.08.8-lp151.2.3.1 slurm-torque-debuginfo-18.08.8-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12838.html https://bugzilla.suse.com/1140709

1 0

openSUSE-SU-2019:2051-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2051-1 Rating: important References: #1145575 #1145738 #1145739 #1145740 #1145741 #1145742 Cross-References: CVE-2019-10081 CVE-2019-10082 CVE-2019-10092 CVE-2019-10097 CVE-2019-10098 CVE-2019-9517 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1145575). - CVE-2019-10081: Fixed mod_http2 that is vulnerable to memory corruption on early pushes (bsc#1145742). - CVE-2019-10082: Fixed mod_http2 that is vulnerable to read-after-free in h2 connection shutdown (bsc#1145741). - CVE-2019-10092: Fixed limited cross-site scripting in mod_proxy (bsc#1145740). - CVE-2019-10097: Fixed mod_remoteip stack buffer overflow and NULL pointer dereference (bsc#1145739). - CVE-2019-10098: Fixed mod_rewrite configuration vulnerablility to open redirect (bsc#1145738). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2051=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2051=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-2.4.33-lp151.8.6.1 apache2-debuginfo-2.4.33-lp151.8.6.1 apache2-debugsource-2.4.33-lp151.8.6.1 apache2-devel-2.4.33-lp151.8.6.1 apache2-event-2.4.33-lp151.8.6.1 apache2-event-debuginfo-2.4.33-lp151.8.6.1 apache2-example-pages-2.4.33-lp151.8.6.1 apache2-prefork-2.4.33-lp151.8.6.1 apache2-prefork-debuginfo-2.4.33-lp151.8.6.1 apache2-utils-2.4.33-lp151.8.6.1 apache2-utils-debuginfo-2.4.33-lp151.8.6.1 apache2-worker-2.4.33-lp151.8.6.1 apache2-worker-debuginfo-2.4.33-lp151.8.6.1 - openSUSE Leap 15.1 (noarch): apache2-doc-2.4.33-lp151.8.6.1 - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.23.1 apache2-debuginfo-2.4.33-lp150.2.23.1 apache2-debugsource-2.4.33-lp150.2.23.1 apache2-devel-2.4.33-lp150.2.23.1 apache2-event-2.4.33-lp150.2.23.1 apache2-event-debuginfo-2.4.33-lp150.2.23.1 apache2-example-pages-2.4.33-lp150.2.23.1 apache2-prefork-2.4.33-lp150.2.23.1 apache2-prefork-debuginfo-2.4.33-lp150.2.23.1 apache2-utils-2.4.33-lp150.2.23.1 apache2-utils-debuginfo-2.4.33-lp150.2.23.1 apache2-worker-2.4.33-lp150.2.23.1 apache2-worker-debuginfo-2.4.33-lp150.2.23.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.23.1 References: https://www.suse.com/security/cve/CVE-2019-10081.html https://www.suse.com/security/cve/CVE-2019-10082.html https://www.suse.com/security/cve/CVE-2019-10092.html https://www.suse.com/security/cve/CVE-2019-10097.html https://www.suse.com/security/cve/CVE-2019-10098.html https://www.suse.com/security/cve/CVE-2019-9517.html https://bugzilla.suse.com/1145575 https://bugzilla.suse.com/1145738 https://bugzilla.suse.com/1145739 https://bugzilla.suse.com/1145740 https://bugzilla.suse.com/1145741 https://bugzilla.suse.com/1145742

1 0

openSUSE-RU-2019:2049-1: moderate: Recommended update for youtube-dl
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for youtube-dl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2049-1 Rating: moderate References: #1120842 #1121694 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for youtube-dl fixes the following issues: youtube-dl was updated to new upstream release 2019.08.13: * downloader/fragment: Fix ETA calculation of resumed download * discovery: extract series meta field * roosterteeth: add support for watch URLs Update to new upstream release 2019.08.02 * [yahoo:japannews] Add support for yahoo.co.jp (#21698, #21265) * [discovery] Add support go.discovery.com URLs * [youtube:playlist] Relax video regular expression (#21844) * [generic] Restrict --default-search schemeless URLs detection pattern (#21842) * [vrv] Fix CMS signing query extraction (#21809) * [youtube] Fix and improve title and description extraction (#21934) * [tvigle] Add support for HLS and DASH formats (#21967) * [tvigle] Fix extraction (#21967) * [yandexvideo] Add support for DASH formats (#21971) * [discovery] Use API call for video data extraction (#21808) * [mgtv] Extract format_note (#21881) * [tvn24] Fix metadata extraction (#21833, #21834) * [dlive] Relax URL regular expression (#21909) * [openload] Add support for oload.best (#21913) * [youtube] Improve metadata extraction for age gate content (#21943) Update to new upstream release 2019.07.16: * [asiancrush] Add support for yuyutv.com, midnightpulp.com and cocoro.tv * (#21281, #21290) * [kaltura] Check source format URL (#21290) * [ctsnews] Fix YouTube embeds extraction (#21678) * [einthusan] Add support for einthusan.com (#21748, #21775) * [youtube] Add support for invidious.mastodon.host (#21777) * [gfycat] Extend URL regular expression (#21779, #21780) * [youtube] Restrict is_live extraction (#21782) Update to new upstream release 2019.07.02 * Introduce random_user_agent and use as default User-Agent (closes #21546) * dailymotion: add support embed with DM.player js call * openload: Add support for oload.biz Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2049=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2049=1 Package List: - openSUSE Leap 15.1 (noarch): python2-youtube-dl-2019.08.13-lp151.2.3.1 python3-youtube-dl-2019.08.13-lp151.2.3.1 youtube-dl-2019.08.13-lp151.2.3.1 youtube-dl-bash-completion-2019.08.13-lp151.2.3.1 youtube-dl-fish-completion-2019.08.13-lp151.2.3.1 youtube-dl-zsh-completion-2019.08.13-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): youtube-dl-2019.08.13-lp150.7.1 youtube-dl-bash-completion-2019.08.13-lp150.7.1 youtube-dl-fish-completion-2019.08.13-lp150.7.1 youtube-dl-zsh-completion-2019.08.13-lp150.7.1 References: https://bugzilla.suse.com/1120842 https://bugzilla.suse.com/1121694

1 0

openSUSE-RU-2019:2055-1: moderate: Recommended update for tcmu-runner
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for tcmu-runner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2055-1 Rating: moderate References: #1138443 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tcmu-runner fixes the following issues: - Move tcmu.conf into main package. (bsc#1138443) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2055=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2055=1 Package List: - openSUSE Leap 15.1 (x86_64): libtcmu2-1.4.0-lp151.3.6.1 libtcmu2-debuginfo-1.4.0-lp151.3.6.1 tcmu-runner-1.4.0-lp151.3.6.1 tcmu-runner-debuginfo-1.4.0-lp151.3.6.1 tcmu-runner-debugsource-1.4.0-lp151.3.6.1 tcmu-runner-handler-rbd-1.4.0-lp151.3.6.1 tcmu-runner-handler-rbd-debuginfo-1.4.0-lp151.3.6.1 - openSUSE Leap 15.0 (x86_64): libtcmu2-1.4.0-lp150.2.6.1 libtcmu2-debuginfo-1.4.0-lp150.2.6.1 tcmu-runner-1.4.0-lp150.2.6.1 tcmu-runner-debuginfo-1.4.0-lp150.2.6.1 tcmu-runner-debugsource-1.4.0-lp150.2.6.1 tcmu-runner-handler-rbd-1.4.0-lp150.2.6.1 tcmu-runner-handler-rbd-debuginfo-1.4.0-lp150.2.6.1 References: https://bugzilla.suse.com/1138443

1 0

openSUSE-SU-2019:2050-1: moderate: Security update for httpie
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for httpie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2050-1 Rating: moderate References: #1148466 Cross-References: CVE-2019-10751 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for httpie fixes the following issues: httpie was updated to version 1.0.3: * Fix CVE-2019-10751 (HTTPie is volnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2050=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2050=1 Package List: - openSUSE Leap 15.1 (noarch): python3-httpie-1.0.3-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): python3-httpie-1.0.3-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10751.html https://bugzilla.suse.com/1148466

1 0

openSUSE-RU-2019:2045-1: moderate: Recommended update for ebtables
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for ebtables ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2045-1 Rating: moderate References: #1140898 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ebtables fixes the following issues: - Fix path /sbin to /usr/sbin in ebtables.systemd. (bsc#1140898) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2045=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2045=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ebtables-2.0.10.4-lp151.5.3.1 ebtables-debuginfo-2.0.10.4-lp151.5.3.1 ebtables-debugsource-2.0.10.4-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): ebtables-2.0.10.4-lp150.4.3.1 ebtables-debuginfo-2.0.10.4-lp150.4.3.1 ebtables-debugsource-2.0.10.4-lp150.4.3.1 References: https://bugzilla.suse.com/1140898

1 0

openSUSE-SU-2019:2056-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2056-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2056=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2056=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.13.1 go1.12-doc-1.12.9-lp151.2.13.1 go1.12-race-1.12.9-lp151.2.13.1 - openSUSE Leap 15.0 (x86_64): go1.12-1.12.9-lp150.8.1 go1.12-doc-1.12.9-lp150.8.1 go1.12-race-1.12.9-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123

1 0

openSUSE-RU-2019:2053-1: moderate: Recommended update for kompare
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for kompare ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2053-1 Rating: moderate References: #1146394 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kompare fixes the following issues: - Fixed the "Compare" button not getting enabled in the initial dialog when selecting files via the file browser (boo#1146394, kde#390024): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2053=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2053=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2053=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2053=1 Package List: - openSUSE Leap 15.1 (x86_64): kompare-18.12.3-lp151.2.4.1 kompare-debuginfo-18.12.3-lp151.2.4.1 kompare-debugsource-18.12.3-lp151.2.4.1 kompare-devel-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (noarch): kompare-lang-18.12.3-lp151.2.4.1 - openSUSE Leap 15.0 (x86_64): kompare-17.12.3-lp150.2.3.1 kompare-debuginfo-17.12.3-lp150.2.3.1 kompare-debugsource-17.12.3-lp150.2.3.1 kompare-devel-17.12.3-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): kompare-lang-17.12.3-lp150.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kompare-18.12.3-bp151.3.3.1 kompare-devel-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): kompare-lang-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kompare-17.12.3-bp150.3.3.1 kompare-debuginfo-17.12.3-bp150.3.3.1 kompare-debugsource-17.12.3-bp150.3.3.1 kompare-devel-17.12.3-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kompare-lang-17.12.3-bp150.3.3.1 References: https://bugzilla.suse.com/1146394

1 0

openSUSE-RU-2019:2054-1: Recommended update for quota
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for quota ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2054-1 Rating: low References: #1144265 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for quota fixes the following issues: - quota will stop processing the config file in case of errors (bsc#1144265) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2054=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2054=1 Package List: - openSUSE Leap 15.1 (x86_64): quota-4.05-lp151.2.3.1 quota-debuginfo-4.05-lp151.2.3.1 quota-debugsource-4.05-lp151.2.3.1 quota-nfs-4.05-lp151.2.3.1 quota-nfs-debuginfo-4.05-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): quota-4.05-lp150.10.1 quota-debuginfo-4.05-lp150.10.1 quota-debugsource-4.05-lp150.10.1 quota-nfs-4.05-lp150.10.1 quota-nfs-debuginfo-4.05-lp150.10.1 References: https://bugzilla.suse.com/1144265

1 0

openSUSE-RU-2019:2046-1: moderate: Recommended update for aaa_base
by maintenance＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2046-1 Rating: moderate References: #1140647 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for aaa_base fixes the following issues: - Make systemd detection cgroup oblivious. (bsc#1140647) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2046=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2046=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp151.5.6.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp151.5.6.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp151.5.6.1 aaa_base-extras-84.87+git20180409.04c9dae-lp151.5.6.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp151.5.6.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp151.5.6.1 - openSUSE Leap 15.0 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp150.14.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp150.14.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp150.14.1 aaa_base-extras-84.87+git20180409.04c9dae-lp150.14.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp150.14.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp150.14.1 References: https://bugzilla.suse.com/1140647

1 0

openSUSE-SU-2019:2044-1: moderate: Security update for podman, slirp4netns and libcontainers-common
by opensuse-security＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Security Update: Security update for podman, slirp4netns and libcontainers-common ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2044-1 Rating: moderate References: #1096726 #1123156 #1123387 #1135460 #1136974 #1137860 #1143386 Cross-References: CVE-2018-15664 CVE-2019-10152 CVE-2019-6778 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top: - Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386) - Update libpod.conf to use correct infra_command - Update libpod.conf to use better versioned pause container - Update libpod.conf to use official kubic pause container - Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json - Add podman-remote varlink client Version update podman to v1.4.4: - Features - Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime - The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340) - The podman diff command now supports the --latest flag - Bugfixes - Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations - Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL - Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once - Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored - Fixed a bug where images with no layers could not properly be displayed and removed by Podman - Fixed a bug where locks were not properly freed on failure to create a container or pod - Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384) - Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts - Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405) - Fixed a bug where podman ps --sync would segfault (#3411) - Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408) - Misc - Updated containers/storage to v1.12.13 - Podman now performs much better on systems with heavy I/O load - The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf - For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo\ d/issues/3363)) - Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed Update podman to v1.4.2: - Fixed a bug where Podman could not run containers using an older version of Systemd as init - Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions - The error message for running podman kill on containers that are not running has been improved - Podman remote client can now log to a file if syslog is not available - The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist - The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes - The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running) - The podman run --mount command now supports the bind-nonrecursive option for bind mounts - Fixed a bug where podman play kube would fail to create containers due to an unspecified log driver - Fixed a bug where Podman would fail to build with musl libc - Fixed a bug where rootless Podman using slirp4netns networking in an environment with no nameservers on the host other than localhost would result in nonfunctional networking - Fixed a bug where podman import would not properly set environment variables, discarding their values and retaining only keys - Fixed a bug where Podman would fail to run when built with Apparmor support but run on systems without the Apparmor kernel module loaded - Remote Podman will now default the username it uses to log in to remote systems to the username of the current user - Podman now uses JSON logging with OCI runtimes that support it, allowing for better error reporting - Updated vendored containers/image to v2.0 - Update conmon to v0.3.0 - Support OOM Monitor under cgroup V2 - Add config binary and make target for configuring conmon with a go library for importing values Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460) - Podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems. - The podman cp now supports pause flag. - The remote client now supports a configuration file for pre-configuring connections to remote Podman installations - CVE-2019-10152: Fixed an iproper dereference of symlinks of the the podman cp command which introduced in version 1.1.0 (bsc#1136974). - Fixed a bug where podman commit could improperly set environment variables that contained = characters - Fixed a bug where rootless podman would sometimes fail to start containers with forwarded ports - Fixed a bug where podman version on the remote client could segfault - Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed - Fixed a bug where filtering images by label did not work - Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start - Fixed a bug where podman generate kube did not work with containers with named volumes - Fixed a bug where rootless podman would receive permission denied errors accessing conmon.pid - Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it - Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash - Fixed a bug where podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime - Fixed a bug where podman exec would fail on older kernels - Podman commit command is now usable with the Podman remote client - Signature-policy flag has been deprecated - Updated vendored containers/storage and containers/image libraries with numerous bugfixes - Updated vendored Buildah to v1.8.3 - Podman now requires Conmon v0.2.0 - The podman cp command is now aliased as podman container cp - Rootless podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration - Added fuse-overlayfs dependency to support overlay based rootless image manipulations - The podman cp command can now read input redirected to STDIN, and output to STDOUT instead of a file, using - instead of an argument. - The podman remote client now displays version information from both the client and server in podman version - The podman unshare command has been added, allowing easy entry into the user namespace set up by rootless Podman (allowing the removal of files created by rootless podman, among other things) - Fixed a bug where Podman containers with the --rm flag were removing created volumes when they were automatically removed - Fixed a bug where container and pod locks were incorrectly marked as released after a system reboot, causing errors on container and pod removal - Fixed a bug where Podman pods could not be removed if any container in the pod encountered an error during removal - Fixed a bug where Podman pods run with the cgroupfs CGroup driver would encounter a race condition during removal, potentially failing to remove the pod CGroup - Fixed a bug where the podman container checkpoint and podman container restore commands were not visible in the remote client - Fixed a bug where podman remote ps --ns would not print the container's namespaces - Fixed a bug where removing stopped containers with healthchecks could cause an error - Fixed a bug where the default libpod.conf file was causing parsing errors - Fixed a bug where pod locks were not being freed when pods were removed, potentially leading to lock exhaustion - Fixed a bug where 'podman run' with SD_NOTIFY set could, on short-running containers, create an inconsistent state rendering the container unusable - The remote Podman client now uses the Varlink bridge to establish remote connections by default - Fixed an issue with apparmor_parser (bsc#1123387) - Update to libpod v1.4.0 (bsc#1137860): - The podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems - The podman cp command now supports a pause flag to pause containers while copying into them - The remote client now supports a configuration file for pre-configuring connections to remote Podman installations - Fixed CVE-2019-10152 - The podman cp command improperly dereferenced symlinks in host context - Fixed a bug where podman commit could improperly set environment variables that contained = characters - Fixed a bug where rootless Podman would sometimes fail to start containers with forwarded ports - Fixed a bug where podman version on the remote client could segfault - Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed - Fixed a bug where filtering images by label did not work - Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start - Fixed a bug where podman generate kube did not work with containers with named volumes - Fixed a bug where rootless Podman would receive permission denied errors accessing conmon.pid - Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it - Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash - Fixed a bug where Podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime - Fixed a bug where podman exec would fail on older kernels - The podman commit command is now usable with the Podman remote client - The --signature-policy flag (used with several image-related commands) has been deprecated - The podman unshare command now defines two environment variables in the spawned shell: CONTAINERS_RUNROOT and CONTAINERS_GRAPHROOT, pointing to temporary and permanent storage for rootless containers - Updated vendored containers/storage and containers/image libraries with numerous bugfixes - Updated vendored Buildah to v1.8.3 - Podman now requires Conmon v0.2.0 - The podman cp command is now aliased as podman container cp - Rootless Podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration - Update to image v1.5.1 - Vendor in latest containers/storage - docker/docker_client: Drop redundant Domain(ref.ref) call - pkg/blobinfocache: Split implementations into subpackages - copy: progress bar: show messages on completion - docs: rename manpages to *.5.command - add container-certs.d.md manpage - pkg/docker/config: Bring auth tests from docker/docker_client_test - Don't allocate a sync.Mutex separately Update to storage v1.12.10: - Add function to parse out mount options from graphdriver - Merge the disparate parts of all of the Unix-like lockfiles - Fix unix-but-not-Linux compilation - Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set - Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes - lockfile: add RecursiveLock() API - Update generated files - Fix crash on tesing of aufs code - Let consumers know when Layers and Images came from read-only stores - chown: do not change owner for the mountpoint - locks: correctly mark updates to the layers list - CreateContainer: don't worry about mapping layers unless necessary - docs: fix manpage for containers-storage.conf - docs: sort configuration options alphabetically - docs: document OSTree file deduplication - Add missing options to man page for containers-storage - overlay: use the layer idmapping if present - vfs: prefer layer custom idmappings - layers: propagate down the idmapping settings - Recreate symlink when not found - docs: fix manpage for configuration file - docs: add special handling for manpages in sect 5 - overlay: fix single-lower test - Recreate symlink when not found - overlay: propagate errors from mountProgram - utils: root in a userns uses global conf file - Fix handling of additional stores - Correctly check permissions on rootless directory - Fix possible integer overflow on 32bit builds - Evaluate device path for lvm - lockfile test: make concurrent RW test determinisitc - lockfile test: make concurrent read tests deterministic - drivers.DirCopy: fix filemode detection - storage: move the logic to detect rootless into utils.go - Don't set (struct flock).l_pid - Improve documentation of getLockfile - Rename getLockFile to createLockerForPath, and document it - Add FILES section to containers-storage.5 man page - add digest locks - drivers/copy: add a non-cgo fallback slirp4netns was updated to 0.3.0: - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() (bsc#1123156) This update also includes: - fuse3 and fuse-overlayfs to support rootless containers. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2044=1 Package List: - openSUSE Leap 15.1 (x86_64): fuse-overlayfs-0.4.1-lp151.2.1 fuse-overlayfs-debuginfo-0.4.1-lp151.2.1 fuse-overlayfs-debugsource-0.4.1-lp151.2.1 fuse3-3.6.1-lp151.2.1 fuse3-debuginfo-3.6.1-lp151.2.1 fuse3-debugsource-3.6.1-lp151.2.1 fuse3-devel-3.6.1-lp151.2.1 fuse3-doc-3.6.1-lp151.2.1 libfuse3-3-3.6.1-lp151.2.1 libfuse3-3-debuginfo-3.6.1-lp151.2.1 podman-1.4.4-lp151.3.3.1 slirp4netns-0.3.0-lp151.2.3.1 slirp4netns-debuginfo-0.3.0-lp151.2.3.1 slirp4netns-debugsource-0.3.0-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): libcontainers-common-20190401-lp151.2.3.1 podman-cni-config-1.4.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15664.html https://www.suse.com/security/cve/CVE-2019-10152.html https://www.suse.com/security/cve/CVE-2019-6778.html https://bugzilla.suse.com/1096726 https://bugzilla.suse.com/1123156 https://bugzilla.suse.com/1123387 https://bugzilla.suse.com/1135460 https://bugzilla.suse.com/1136974 https://bugzilla.suse.com/1137860 https://bugzilla.suse.com/1143386

1 0

openSUSE-RU-2019:2043-1: important: Recommended update for yast2-users
by maintenance＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2043-1 Rating: important References: #1141017 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-users fixes the following issues: - Does no longer log passwords to logfile (bsc#1141017). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2043=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): yast2-users-4.1.14-lp151.2.6.1 yast2-users-debuginfo-4.1.14-lp151.2.6.1 yast2-users-debugsource-4.1.14-lp151.2.6.1 References: https://bugzilla.suse.com/1141017

1 0

openSUSE-RU-2019:2042-1: moderate: Recommended update for calamaris
by maintenance＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Recommended Update: Recommended update for calamaris ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2042-1 Rating: moderate References: #1145328 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calamaris fixes the following issues: - Fix generation of reports with Perl 5.12 (boo#1145328) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2042=1 Package List: - openSUSE Leap 15.1 (noarch): calamaris-2.59-lp151.3.3.1 References: https://bugzilla.suse.com/1145328

1 0

openSUSE-SU-2019:2041-1: important: Security update for qemu
by opensuse-security＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2041-1 Rating: important References: #1128106 #1133031 #1134883 #1135210 #1135902 #1136540 #1136778 #1138534 #1140402 #1143794 #1144087 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 CVE-2019-5008 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). - CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031). Bug fixes and enhancements: - Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883) - Add SnowRidge-Server vcpu model (jsc#SLE-4883) - Add in documentation about md-clear feature (bsc#1138534) - Fix SEV issue where older machine type is not processed correctly (bsc#1144087) - Fix case of a bad pointer in Xen PV usb support code (bsc#1128106) - Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764) - Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796) - Ignore csske for expanding the cpu model (bsc#1136540) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2041=1 Package List: - openSUSE Leap 15.1 (x86_64): qemu-3.1.1-lp151.7.3.3 qemu-arm-3.1.1-lp151.7.3.3 qemu-arm-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-alsa-3.1.1-lp151.7.3.3 qemu-audio-alsa-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-oss-3.1.1-lp151.7.3.3 qemu-audio-oss-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-pa-3.1.1-lp151.7.3.3 qemu-audio-pa-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-sdl-3.1.1-lp151.7.3.3 qemu-audio-sdl-debuginfo-3.1.1-lp151.7.3.3 qemu-block-curl-3.1.1-lp151.7.3.3 qemu-block-curl-debuginfo-3.1.1-lp151.7.3.3 qemu-block-dmg-3.1.1-lp151.7.3.3 qemu-block-dmg-debuginfo-3.1.1-lp151.7.3.3 qemu-block-gluster-3.1.1-lp151.7.3.3 qemu-block-gluster-debuginfo-3.1.1-lp151.7.3.3 qemu-block-iscsi-3.1.1-lp151.7.3.3 qemu-block-iscsi-debuginfo-3.1.1-lp151.7.3.3 qemu-block-nfs-3.1.1-lp151.7.3.3 qemu-block-nfs-debuginfo-3.1.1-lp151.7.3.3 qemu-block-rbd-3.1.1-lp151.7.3.3 qemu-block-rbd-debuginfo-3.1.1-lp151.7.3.3 qemu-block-ssh-3.1.1-lp151.7.3.3 qemu-block-ssh-debuginfo-3.1.1-lp151.7.3.3 qemu-debuginfo-3.1.1-lp151.7.3.3 qemu-debugsource-3.1.1-lp151.7.3.3 qemu-extra-3.1.1-lp151.7.3.3 qemu-extra-debuginfo-3.1.1-lp151.7.3.3 qemu-guest-agent-3.1.1-lp151.7.3.3 qemu-guest-agent-debuginfo-3.1.1-lp151.7.3.3 qemu-ksm-3.1.1-lp151.7.3.3 qemu-kvm-3.1.1-lp151.7.3.3 qemu-lang-3.1.1-lp151.7.3.3 qemu-linux-user-3.1.1-lp151.7.3.2 qemu-linux-user-debuginfo-3.1.1-lp151.7.3.2 qemu-linux-user-debugsource-3.1.1-lp151.7.3.2 qemu-ppc-3.1.1-lp151.7.3.3 qemu-ppc-debuginfo-3.1.1-lp151.7.3.3 qemu-s390-3.1.1-lp151.7.3.3 qemu-s390-debuginfo-3.1.1-lp151.7.3.3 qemu-testsuite-3.1.1-lp151.7.3.3 qemu-tools-3.1.1-lp151.7.3.3 qemu-tools-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-curses-3.1.1-lp151.7.3.3 qemu-ui-curses-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-gtk-3.1.1-lp151.7.3.3 qemu-ui-gtk-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-sdl-3.1.1-lp151.7.3.3 qemu-ui-sdl-debuginfo-3.1.1-lp151.7.3.3 qemu-x86-3.1.1-lp151.7.3.3 qemu-x86-debuginfo-3.1.1-lp151.7.3.3 - openSUSE Leap 15.1 (noarch): qemu-ipxe-1.0.0+-lp151.7.3.3 qemu-seabios-1.12.0-lp151.7.3.3 qemu-sgabios-8-lp151.7.3.3 qemu-vgabios-1.12.0-lp151.7.3.3 References: https://www.suse.com/security/cve/CVE-2019-12155.html https://www.suse.com/security/cve/CVE-2019-13164.html https://www.suse.com/security/cve/CVE-2019-14378.html https://www.suse.com/security/cve/CVE-2019-5008.html https://bugzilla.suse.com/1128106 https://bugzilla.suse.com/1133031 https://bugzilla.suse.com/1134883 https://bugzilla.suse.com/1135210 https://bugzilla.suse.com/1135902 https://bugzilla.suse.com/1136540 https://bugzilla.suse.com/1136778 https://bugzilla.suse.com/1138534 https://bugzilla.suse.com/1140402 https://bugzilla.suse.com/1143794 https://bugzilla.suse.com/1144087

1 0