November 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2595-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2595-1 Rating: moderate References: #1144504 #1149458 #1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files (bsc#1144504). - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1149458). Non-security issues fixed: - Added the --max-scantime clamscan option and MaxScanTime clamd configuration option (bsc#1144504). - Increased the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed (bsc#1151839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2595=1 Package List: - openSUSE Leap 15.1 (x86_64): clamav-0.100.3-lp151.2.3.1 clamav-debuginfo-0.100.3-lp151.2.3.1 clamav-debugsource-0.100.3-lp151.2.3.1 clamav-devel-0.100.3-lp151.2.3.1 libclamav7-0.100.3-lp151.2.3.1 libclamav7-debuginfo-0.100.3-lp151.2.3.1 libclammspack0-0.100.3-lp151.2.3.1 libclammspack0-debuginfo-0.100.3-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1151839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2594-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2594-1 Rating: important References: #1093536 #1094462 #1107874 #1109845 Cross-References: CVE-2018-10811 CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2018-5388 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket (bsc#1094462). - CVE-2018-10811: Fixed a denial of service during the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (bsc#1093536). - CVE-2018-16151,CVE-2018-16152: Fixed multiple flaws in the gmp plugin which might lead to authorization bypass (bsc#1107874). - CVE-2018-17540: Fixed an improper input validation in gmp plugin (bsc#1109845). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2594=1 Package List: - openSUSE Leap 15.0 (noarch): strongswan-doc-5.6.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): strongswan-5.6.0-lp150.3.3.1 strongswan-debuginfo-5.6.0-lp150.3.3.1 strongswan-debugsource-5.6.0-lp150.3.3.1 strongswan-hmac-5.6.0-lp150.3.3.1 strongswan-ipsec-5.6.0-lp150.3.3.1 strongswan-ipsec-debuginfo-5.6.0-lp150.3.3.1 strongswan-libs0-5.6.0-lp150.3.3.1 strongswan-libs0-debuginfo-5.6.0-lp150.3.3.1 strongswan-mysql-5.6.0-lp150.3.3.1 strongswan-mysql-debuginfo-5.6.0-lp150.3.3.1 strongswan-nm-5.6.0-lp150.3.3.1 strongswan-nm-debuginfo-5.6.0-lp150.3.3.1 strongswan-sqlite-5.6.0-lp150.3.3.1 strongswan-sqlite-debuginfo-5.6.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10811.html https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2018-5388.html https://bugzilla.suse.com/1093536 https://bugzilla.suse.com/1094462 https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2596-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2596-1 Rating: moderate References: #1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the to_oct() function which could have led to unexpected TAR generation (bsc#1155199). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2596=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cpio-2.12-lp151.3.3.1 cpio-debuginfo-2.12-lp151.3.3.1 cpio-debugsource-2.12-lp151.3.3.1 cpio-mt-2.12-lp151.3.3.1 cpio-mt-debuginfo-2.12-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): cpio-lang-2.12-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14866.html https://bugzilla.suse.com/1155199 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2593-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2593-1 Rating: moderate References: #1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the to_oct() function which could have led to unexpected TAR generation (bsc#1155199). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2593=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cpio-2.12-lp150.2.3.1 cpio-debuginfo-2.12-lp150.2.3.1 cpio-debugsource-2.12-lp150.2.3.1 cpio-mt-2.12-lp150.2.3.1 cpio-mt-debuginfo-2.12-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): cpio-lang-2.12-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14866.html https://bugzilla.suse.com/1155199 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2591-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2591-1 Rating: important References: #1155321 #1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 CVE-2019-8707 CVE-2019-8710 CVE-2019-8719 CVE-2019-8720 CVE-2019-8726 CVE-2019-8733 CVE-2019-8735 CVE-2019-8743 CVE-2019-8763 CVE-2019-8764 CVE-2019-8765 CVE-2019-8766 CVE-2019-8768 CVE-2019-8769 CVE-2019-8771 CVE-2019-8782 CVE-2019-8783 CVE-2019-8808 CVE-2019-8811 CVE-2019-8812 CVE-2019-8813 CVE-2019-8814 CVE-2019-8815 CVE-2019-8816 CVE-2019-8819 CVE-2019-8820 CVE-2019-8821 CVE-2019-8822 CVE-2019-8823 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 42 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.26.2 fixes the following issues: Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) Security issues addressed: - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items. - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history. - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy. - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2591=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.26.2-lp151.2.9.1 libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp151.2.9.1 typelib-1_0-JavaScriptCore-4_0-2.26.2-lp151.2.9.1 typelib-1_0-WebKit2-4_0-2.26.2-lp151.2.9.1 typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp151.2.9.1 webkit-jsc-4-2.26.2-lp151.2.9.1 webkit-jsc-4-debuginfo-2.26.2-lp151.2.9.1 webkit2gtk-4_0-injected-bundles-2.26.2-lp151.2.9.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp151.2.9.1 webkit2gtk3-debugsource-2.26.2-lp151.2.9.1 webkit2gtk3-devel-2.26.2-lp151.2.9.1 webkit2gtk3-minibrowser-2.26.2-lp151.2.9.1 webkit2gtk3-minibrowser-debuginfo-2.26.2-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp151.2.9.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-32bit-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.26.2-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://www.suse.com/security/cve/CVE-2019-8625.html https://www.suse.com/security/cve/CVE-2019-8674.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://www.suse.com/security/cve/CVE-2019-8707.html https://www.suse.com/security/cve/CVE-2019-8710.html https://www.suse.com/security/cve/CVE-2019-8719.html https://www.suse.com/security/cve/CVE-2019-8720.html https://www.suse.com/security/cve/CVE-2019-8726.html https://www.suse.com/security/cve/CVE-2019-8733.html https://www.suse.com/security/cve/CVE-2019-8735.html https://www.suse.com/security/cve/CVE-2019-8743.html https://www.suse.com/security/cve/CVE-2019-8763.html https://www.suse.com/security/cve/CVE-2019-8764.html https://www.suse.com/security/cve/CVE-2019-8765.html https://www.suse.com/security/cve/CVE-2019-8766.html https://www.suse.com/security/cve/CVE-2019-8768.html https://www.suse.com/security/cve/CVE-2019-8769.html https://www.suse.com/security/cve/CVE-2019-8771.html https://www.suse.com/security/cve/CVE-2019-8782.html https://www.suse.com/security/cve/CVE-2019-8783.html https://www.suse.com/security/cve/CVE-2019-8808.html https://www.suse.com/security/cve/CVE-2019-8811.html https://www.suse.com/security/cve/CVE-2019-8812.html https://www.suse.com/security/cve/CVE-2019-8813.html https://www.suse.com/security/cve/CVE-2019-8814.html https://www.suse.com/security/cve/CVE-2019-8815.html https://www.suse.com/security/cve/CVE-2019-8816.html https://www.suse.com/security/cve/CVE-2019-8819.html https://www.suse.com/security/cve/CVE-2019-8820.html https://www.suse.com/security/cve/CVE-2019-8821.html https://www.suse.com/security/cve/CVE-2019-8822.html https://www.suse.com/security/cve/CVE-2019-8823.html https://bugzilla.suse.com/1155321 https://bugzilla.suse.com/1156318 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2587-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2587-1 Rating: important References: #1155321 #1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 CVE-2019-8707 CVE-2019-8710 CVE-2019-8719 CVE-2019-8720 CVE-2019-8726 CVE-2019-8733 CVE-2019-8735 CVE-2019-8743 CVE-2019-8763 CVE-2019-8764 CVE-2019-8765 CVE-2019-8766 CVE-2019-8768 CVE-2019-8769 CVE-2019-8771 CVE-2019-8782 CVE-2019-8783 CVE-2019-8808 CVE-2019-8811 CVE-2019-8812 CVE-2019-8813 CVE-2019-8814 CVE-2019-8815 CVE-2019-8816 CVE-2019-8819 CVE-2019-8820 CVE-2019-8821 CVE-2019-8822 CVE-2019-8823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 42 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.26.2 fixes the following issues: Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) Security issues addressed: - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items. - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history. - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy. - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2587=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.26.2-lp150.2.28.1 libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp150.2.28.1 typelib-1_0-JavaScriptCore-4_0-2.26.2-lp150.2.28.1 typelib-1_0-WebKit2-4_0-2.26.2-lp150.2.28.1 typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp150.2.28.1 webkit-jsc-4-2.26.2-lp150.2.28.1 webkit-jsc-4-debuginfo-2.26.2-lp150.2.28.1 webkit2gtk-4_0-injected-bundles-2.26.2-lp150.2.28.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp150.2.28.1 webkit2gtk3-debugsource-2.26.2-lp150.2.28.1 webkit2gtk3-devel-2.26.2-lp150.2.28.1 webkit2gtk3-minibrowser-2.26.2-lp150.2.28.1 webkit2gtk3-minibrowser-debuginfo-2.26.2-lp150.2.28.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.26.2-lp150.2.28.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp150.2.28.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-32bit-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp150.2.28.1 References: https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://www.suse.com/security/cve/CVE-2019-8625.html https://www.suse.com/security/cve/CVE-2019-8674.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://www.suse.com/security/cve/CVE-2019-8707.html https://www.suse.com/security/cve/CVE-2019-8710.html https://www.suse.com/security/cve/CVE-2019-8719.html https://www.suse.com/security/cve/CVE-2019-8720.html https://www.suse.com/security/cve/CVE-2019-8726.html https://www.suse.com/security/cve/CVE-2019-8733.html https://www.suse.com/security/cve/CVE-2019-8735.html https://www.suse.com/security/cve/CVE-2019-8743.html https://www.suse.com/security/cve/CVE-2019-8763.html https://www.suse.com/security/cve/CVE-2019-8764.html https://www.suse.com/security/cve/CVE-2019-8765.html https://www.suse.com/security/cve/CVE-2019-8766.html https://www.suse.com/security/cve/CVE-2019-8768.html https://www.suse.com/security/cve/CVE-2019-8769.html https://www.suse.com/security/cve/CVE-2019-8771.html https://www.suse.com/security/cve/CVE-2019-8782.html https://www.suse.com/security/cve/CVE-2019-8783.html https://www.suse.com/security/cve/CVE-2019-8808.html https://www.suse.com/security/cve/CVE-2019-8811.html https://www.suse.com/security/cve/CVE-2019-8812.html https://www.suse.com/security/cve/CVE-2019-8813.html https://www.suse.com/security/cve/CVE-2019-8814.html https://www.suse.com/security/cve/CVE-2019-8815.html https://www.suse.com/security/cve/CVE-2019-8816.html https://www.suse.com/security/cve/CVE-2019-8819.html https://www.suse.com/security/cve/CVE-2019-8820.html https://www.suse.com/security/cve/CVE-2019-8821.html https://www.suse.com/security/cve/CVE-2019-8822.html https://www.suse.com/security/cve/CVE-2019-8823.html https://bugzilla.suse.com/1155321 https://bugzilla.suse.com/1156318 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2588-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2588-1 Rating: moderate References: #1013712 Cross-References: CVE-2016-9798 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2016-9798: Fixed a use-after-free in conf_opt() (bsc#1013712). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2588=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bluez-5.48-lp151.8.6.1 bluez-cups-5.48-lp151.8.6.1 bluez-cups-debuginfo-5.48-lp151.8.6.1 bluez-debuginfo-5.48-lp151.8.6.1 bluez-debugsource-5.48-lp151.8.6.1 bluez-devel-5.48-lp151.8.6.1 bluez-test-5.48-lp151.8.6.1 bluez-test-debuginfo-5.48-lp151.8.6.1 libbluetooth3-5.48-lp151.8.6.1 libbluetooth3-debuginfo-5.48-lp151.8.6.1 - openSUSE Leap 15.1 (x86_64): bluez-devel-32bit-5.48-lp151.8.6.1 libbluetooth3-32bit-5.48-lp151.8.6.1 libbluetooth3-32bit-debuginfo-5.48-lp151.8.6.1 - openSUSE Leap 15.1 (noarch): bluez-auto-enable-devices-5.48-lp151.8.6.1 References: https://www.suse.com/security/cve/CVE-2016-9798.html https://bugzilla.suse.com/1013712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2585-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2585-1 Rating: moderate References: #1013712 Cross-References: CVE-2016-9798 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2016-9798: Fixed a use-after-free in conf_opt() (bsc#1013712). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2585=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bluez-5.48-lp150.4.16.1 bluez-cups-5.48-lp150.4.16.1 bluez-cups-debuginfo-5.48-lp150.4.16.1 bluez-debuginfo-5.48-lp150.4.16.1 bluez-debugsource-5.48-lp150.4.16.1 bluez-devel-5.48-lp150.4.16.1 bluez-test-5.48-lp150.4.16.1 bluez-test-debuginfo-5.48-lp150.4.16.1 libbluetooth3-5.48-lp150.4.16.1 libbluetooth3-debuginfo-5.48-lp150.4.16.1 - openSUSE Leap 15.0 (x86_64): bluez-devel-32bit-5.48-lp150.4.16.1 libbluetooth3-32bit-5.48-lp150.4.16.1 libbluetooth3-32bit-debuginfo-5.48-lp150.4.16.1 - openSUSE Leap 15.0 (noarch): bluez-auto-enable-devices-5.48-lp150.4.16.1 References: https://www.suse.com/security/cve/CVE-2016-9798.html https://bugzilla.suse.com/1013712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2575-1: important: Security update for cups
by opensuse-security＠opensuse.org 27 Nov '19

27 Nov '19

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2575-1 Rating: important References: #1146358 #1146359 Cross-References: CVE-2019-8675 CVE-2019-8696 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cups fixes the following issues: - CVE-2019-8675: Fixed a stack buffer overflow in libcups's asn1_get_type function(bsc#1146358). - CVE-2019-8696: Fixed a stack buffer overflow in libcups's asn1_get_packed function (bsc#1146359). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2575=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cups-2.2.7-lp151.6.3.1 cups-client-2.2.7-lp151.6.3.1 cups-client-debuginfo-2.2.7-lp151.6.3.1 cups-config-2.2.7-lp151.6.3.1 cups-ddk-2.2.7-lp151.6.3.1 cups-ddk-debuginfo-2.2.7-lp151.6.3.1 cups-debuginfo-2.2.7-lp151.6.3.1 cups-debugsource-2.2.7-lp151.6.3.1 cups-devel-2.2.7-lp151.6.3.1 libcups2-2.2.7-lp151.6.3.1 libcups2-debuginfo-2.2.7-lp151.6.3.1 libcupscgi1-2.2.7-lp151.6.3.1 libcupscgi1-debuginfo-2.2.7-lp151.6.3.1 libcupsimage2-2.2.7-lp151.6.3.1 libcupsimage2-debuginfo-2.2.7-lp151.6.3.1 libcupsmime1-2.2.7-lp151.6.3.1 libcupsmime1-debuginfo-2.2.7-lp151.6.3.1 libcupsppdc1-2.2.7-lp151.6.3.1 libcupsppdc1-debuginfo-2.2.7-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): cups-devel-32bit-2.2.7-lp151.6.3.1 libcups2-32bit-2.2.7-lp151.6.3.1 libcups2-32bit-debuginfo-2.2.7-lp151.6.3.1 libcupscgi1-32bit-2.2.7-lp151.6.3.1 libcupscgi1-32bit-debuginfo-2.2.7-lp151.6.3.1 libcupsimage2-32bit-2.2.7-lp151.6.3.1 libcupsimage2-32bit-debuginfo-2.2.7-lp151.6.3.1 libcupsmime1-32bit-2.2.7-lp151.6.3.1 libcupsmime1-32bit-debuginfo-2.2.7-lp151.6.3.1 libcupsppdc1-32bit-2.2.7-lp151.6.3.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-8675.html https://www.suse.com/security/cve/CVE-2019-8696.html https://bugzilla.suse.com/1146358 https://bugzilla.suse.com/1146359 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2576-1: moderate: Security update for djvulibre
by opensuse-security＠opensuse.org 27 Nov '19

27 Nov '19

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2576-1 Rating: moderate References: #1154401 #1156188 Cross-References: CVE-2019-18804 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for djvulibre fixes the following issues: Security issue fixed: - CVE-2019-18804: Fixed a null pointer dereference (bsc#1156188). Other issue addressed: - Fixed a crash when mmx was enabled (bsc#1154401) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2576=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): djvulibre-3.5.27-lp151.3.6.1 djvulibre-debuginfo-3.5.27-lp151.3.6.1 djvulibre-debugsource-3.5.27-lp151.3.6.1 djvulibre-doc-3.5.27-lp151.3.6.1 libdjvulibre-devel-3.5.27-lp151.3.6.1 libdjvulibre21-3.5.27-lp151.3.6.1 libdjvulibre21-debuginfo-3.5.27-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-18804.html https://bugzilla.suse.com/1154401 https://bugzilla.suse.com/1156188 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0