April 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1295-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1295-1 Rating: moderate References: #1132053 #1132054 #1132055 #1132058 #1132060 #1132061 Cross-References: CVE-2019-11005 CVE-2019-11006 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-11010 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2019-11005: Fixed a stack-based buffer overflow in SVGStartElement of coders/svg.c that allowed attackers to cause DOS or an unspecified impact (boo#1132058) - CVE-2019-11006: Fixed a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c that allowed attackers to cause DOS or information disclosure (boo#1132061) - CVE-2019-11010: Fixed a memory leak in ReadMPCImage of coders/mpc.c that which allowed attackers to cause DOS via a crafted image file (boo#1132055) - CVE-2019-11007: Fixed a heap-based buffer over-read in the ReadMNGImage function of coders/png.c that which allowed attackers to cause a denial of service or information disclosure (boo#1132060) - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c that which allowed remote attackers to cause DOS or other unspecified impact (boo#1132054) - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c that which allowed attackers to cause DOS or information disclosure (boo#1132053) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1295=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.18.1 GraphicsMagick-devel-1.3.29-bp150.2.18.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.18.1 libGraphicsMagick++-devel-1.3.29-bp150.2.18.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.18.1 libGraphicsMagick3-config-1.3.29-bp150.2.18.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.18.1 perl-GraphicsMagick-1.3.29-bp150.2.18.1 References: https://www.suse.com/security/cve/CVE-2019-11005.html https://www.suse.com/security/cve/CVE-2019-11006.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11010.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132055 https://bugzilla.suse.com/1132058 https://bugzilla.suse.com/1132060 https://bugzilla.suse.com/1132061

1 0

openSUSE-RU-2019:1297-1: moderate: Recommended update for python-python-gnupg
by maintenance＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Recommended Update: Recommended update for python-python-gnupg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1297-1 Rating: moderate References: #1130083 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-python-gnupg fixes the following issues: - Switch to pytest runner, which seems to be a way more stable in providing the results. (boo#1130083) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1297=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-python-gnupg-0.4.4-bp150.2.6.1 python3-python-gnupg-0.4.4-bp150.2.6.1 References: https://bugzilla.suse.com/1130083

1 0

openSUSE-RU-2019:1296-1: moderate: Recommended update for pugixml
by maintenance＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Recommended Update: Recommended update for pugixml ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1296-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for pugixml fixes the following issues: - Ship a pkg-config file. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1296=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libpugixml1-1.9-bp150.3.3.1 pugixml-devel-1.9-bp150.3.3.1 References:

1 0

openSUSE-SU-2019:1292-1: moderate: Security update for samba
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1292-1 Rating: moderate References: #1099590 #1123755 #1124223 #1127153 #1131060 Cross-References: CVE-2019-3880 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for samba fixes the following issues: Security issue fixed: - CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060). Non-security issues fixed: - Fix vfs_ceph ftruncate and fallocate handling (bsc#1127153). - Abide by load_printers smb.conf parameter (bsc#1124223). - s3:winbindd: let normalize_name_map() call find_domain_from_name_noinit() (bsc#1123755). - s3:passdb: Do not return OK if we don't have pinfo set up (bsc#1099590). - s3:winbind: Fix regression (bsc#1123755). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1292=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ctdb-4.6.16+git.154.2998451b912-27.1 ctdb-debuginfo-4.6.16+git.154.2998451b912-27.1 ctdb-tests-4.6.16+git.154.2998451b912-27.1 ctdb-tests-debuginfo-4.6.16+git.154.2998451b912-27.1 libdcerpc-binding0-4.6.16+git.154.2998451b912-27.1 libdcerpc-binding0-debuginfo-4.6.16+git.154.2998451b912-27.1 libdcerpc-devel-4.6.16+git.154.2998451b912-27.1 libdcerpc-samr-devel-4.6.16+git.154.2998451b912-27.1 libdcerpc-samr0-4.6.16+git.154.2998451b912-27.1 libdcerpc-samr0-debuginfo-4.6.16+git.154.2998451b912-27.1 libdcerpc0-4.6.16+git.154.2998451b912-27.1 libdcerpc0-debuginfo-4.6.16+git.154.2998451b912-27.1 libndr-devel-4.6.16+git.154.2998451b912-27.1 libndr-krb5pac-devel-4.6.16+git.154.2998451b912-27.1 libndr-krb5pac0-4.6.16+git.154.2998451b912-27.1 libndr-krb5pac0-debuginfo-4.6.16+git.154.2998451b912-27.1 libndr-nbt-devel-4.6.16+git.154.2998451b912-27.1 libndr-nbt0-4.6.16+git.154.2998451b912-27.1 libndr-nbt0-debuginfo-4.6.16+git.154.2998451b912-27.1 libndr-standard-devel-4.6.16+git.154.2998451b912-27.1 libndr-standard0-4.6.16+git.154.2998451b912-27.1 libndr-standard0-debuginfo-4.6.16+git.154.2998451b912-27.1 libndr0-4.6.16+git.154.2998451b912-27.1 libndr0-debuginfo-4.6.16+git.154.2998451b912-27.1 libnetapi-devel-4.6.16+git.154.2998451b912-27.1 libnetapi0-4.6.16+git.154.2998451b912-27.1 libnetapi0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-credentials-devel-4.6.16+git.154.2998451b912-27.1 libsamba-credentials0-4.6.16+git.154.2998451b912-27.1 libsamba-credentials0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-errors-devel-4.6.16+git.154.2998451b912-27.1 libsamba-errors0-4.6.16+git.154.2998451b912-27.1 libsamba-errors0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-hostconfig-devel-4.6.16+git.154.2998451b912-27.1 libsamba-hostconfig0-4.6.16+git.154.2998451b912-27.1 libsamba-hostconfig0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-passdb-devel-4.6.16+git.154.2998451b912-27.1 libsamba-passdb0-4.6.16+git.154.2998451b912-27.1 libsamba-passdb0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-policy-devel-4.6.16+git.154.2998451b912-27.1 libsamba-policy0-4.6.16+git.154.2998451b912-27.1 libsamba-policy0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamba-util-devel-4.6.16+git.154.2998451b912-27.1 libsamba-util0-4.6.16+git.154.2998451b912-27.1 libsamba-util0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsamdb-devel-4.6.16+git.154.2998451b912-27.1 libsamdb0-4.6.16+git.154.2998451b912-27.1 libsamdb0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsmbclient-devel-4.6.16+git.154.2998451b912-27.1 libsmbclient0-4.6.16+git.154.2998451b912-27.1 libsmbclient0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsmbconf-devel-4.6.16+git.154.2998451b912-27.1 libsmbconf0-4.6.16+git.154.2998451b912-27.1 libsmbconf0-debuginfo-4.6.16+git.154.2998451b912-27.1 libsmbldap-devel-4.6.16+git.154.2998451b912-27.1 libsmbldap0-4.6.16+git.154.2998451b912-27.1 libsmbldap0-debuginfo-4.6.16+git.154.2998451b912-27.1 libtevent-util-devel-4.6.16+git.154.2998451b912-27.1 libtevent-util0-4.6.16+git.154.2998451b912-27.1 libtevent-util0-debuginfo-4.6.16+git.154.2998451b912-27.1 libwbclient-devel-4.6.16+git.154.2998451b912-27.1 libwbclient0-4.6.16+git.154.2998451b912-27.1 libwbclient0-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-4.6.16+git.154.2998451b912-27.1 samba-client-4.6.16+git.154.2998451b912-27.1 samba-client-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-core-devel-4.6.16+git.154.2998451b912-27.1 samba-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-debugsource-4.6.16+git.154.2998451b912-27.1 samba-libs-4.6.16+git.154.2998451b912-27.1 samba-libs-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-pidl-4.6.16+git.154.2998451b912-27.1 samba-python-4.6.16+git.154.2998451b912-27.1 samba-python-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-test-4.6.16+git.154.2998451b912-27.1 samba-test-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-winbind-4.6.16+git.154.2998451b912-27.1 samba-winbind-debuginfo-4.6.16+git.154.2998451b912-27.1 - openSUSE Leap 42.3 (x86_64): libdcerpc-binding0-32bit-4.6.16+git.154.2998451b912-27.1 libdcerpc-binding0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libdcerpc-samr0-32bit-4.6.16+git.154.2998451b912-27.1 libdcerpc-samr0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libdcerpc0-32bit-4.6.16+git.154.2998451b912-27.1 libdcerpc0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libndr-krb5pac0-32bit-4.6.16+git.154.2998451b912-27.1 libndr-krb5pac0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libndr-nbt0-32bit-4.6.16+git.154.2998451b912-27.1 libndr-nbt0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libndr-standard0-32bit-4.6.16+git.154.2998451b912-27.1 libndr-standard0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libndr0-32bit-4.6.16+git.154.2998451b912-27.1 libndr0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libnetapi0-32bit-4.6.16+git.154.2998451b912-27.1 libnetapi0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-credentials0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-credentials0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-errors0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-errors0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-hostconfig0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-hostconfig0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-passdb0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-passdb0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-policy0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-policy0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-util0-32bit-4.6.16+git.154.2998451b912-27.1 libsamba-util0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsamdb0-32bit-4.6.16+git.154.2998451b912-27.1 libsamdb0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsmbclient0-32bit-4.6.16+git.154.2998451b912-27.1 libsmbclient0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsmbconf0-32bit-4.6.16+git.154.2998451b912-27.1 libsmbconf0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libsmbldap0-32bit-4.6.16+git.154.2998451b912-27.1 libsmbldap0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libtevent-util0-32bit-4.6.16+git.154.2998451b912-27.1 libtevent-util0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 libwbclient0-32bit-4.6.16+git.154.2998451b912-27.1 libwbclient0-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 samba-ceph-4.6.16+git.154.2998451b912-27.1 samba-ceph-debuginfo-4.6.16+git.154.2998451b912-27.1 samba-client-32bit-4.6.16+git.154.2998451b912-27.1 samba-client-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 samba-libs-32bit-4.6.16+git.154.2998451b912-27.1 samba-libs-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 samba-winbind-32bit-4.6.16+git.154.2998451b912-27.1 samba-winbind-debuginfo-32bit-4.6.16+git.154.2998451b912-27.1 - openSUSE Leap 42.3 (noarch): samba-doc-4.6.16+git.154.2998451b912-27.1 References: https://www.suse.com/security/cve/CVE-2019-3880.html https://bugzilla.suse.com/1099590 https://bugzilla.suse.com/1123755 https://bugzilla.suse.com/1124223 https://bugzilla.suse.com/1127153 https://bugzilla.suse.com/1131060

1 0

openSUSE-SU-2019:1294-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1294-1 Rating: moderate References: #1120813 #1126325 #1127458 #1131595 #1131955 Cross-References: CVE-2019-3840 CVE-2019-3886 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-3840: Fixed a null pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458). - CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595). Other issue addressed: - cpu: add Skylake-Server and Skylake-Server-IBRS CPU models (FATE#327261, bsc#1131955) - libxl: save current memory value after successful balloon (bsc#1120813). - libxl: support Xen's max_grant_frames setting with maxGrantFrames attribute on the xenbus controller (bsc#1126325). - conf: add new 'xenbus' controller type This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1294=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-24.1 libvirt-admin-3.3.0-24.1 libvirt-admin-debuginfo-3.3.0-24.1 libvirt-client-3.3.0-24.1 libvirt-client-debuginfo-3.3.0-24.1 libvirt-daemon-3.3.0-24.1 libvirt-daemon-config-network-3.3.0-24.1 libvirt-daemon-config-nwfilter-3.3.0-24.1 libvirt-daemon-debuginfo-3.3.0-24.1 libvirt-daemon-driver-interface-3.3.0-24.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-24.1 libvirt-daemon-driver-lxc-3.3.0-24.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-24.1 libvirt-daemon-driver-network-3.3.0-24.1 libvirt-daemon-driver-network-debuginfo-3.3.0-24.1 libvirt-daemon-driver-nodedev-3.3.0-24.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-24.1 libvirt-daemon-driver-nwfilter-3.3.0-24.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-24.1 libvirt-daemon-driver-qemu-3.3.0-24.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-24.1 libvirt-daemon-driver-secret-3.3.0-24.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-3.3.0-24.1 libvirt-daemon-driver-storage-core-3.3.0-24.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-disk-3.3.0-24.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-iscsi-3.3.0-24.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-logical-3.3.0-24.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-mpath-3.3.0-24.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-scsi-3.3.0-24.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-24.1 libvirt-daemon-driver-uml-3.3.0-24.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-24.1 libvirt-daemon-driver-vbox-3.3.0-24.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-24.1 libvirt-daemon-hooks-3.3.0-24.1 libvirt-daemon-lxc-3.3.0-24.1 libvirt-daemon-qemu-3.3.0-24.1 libvirt-daemon-uml-3.3.0-24.1 libvirt-daemon-vbox-3.3.0-24.1 libvirt-debugsource-3.3.0-24.1 libvirt-devel-3.3.0-24.1 libvirt-doc-3.3.0-24.1 libvirt-libs-3.3.0-24.1 libvirt-libs-debuginfo-3.3.0-24.1 libvirt-lock-sanlock-3.3.0-24.1 libvirt-lock-sanlock-debuginfo-3.3.0-24.1 libvirt-nss-3.3.0-24.1 libvirt-nss-debuginfo-3.3.0-24.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-24.1 libvirt-daemon-driver-libxl-3.3.0-24.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-24.1 libvirt-daemon-driver-storage-rbd-3.3.0-24.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-24.1 libvirt-daemon-xen-3.3.0-24.1 libvirt-devel-32bit-3.3.0-24.1 References: https://www.suse.com/security/cve/CVE-2019-3840.html https://www.suse.com/security/cve/CVE-2019-3886.html https://bugzilla.suse.com/1120813 https://bugzilla.suse.com/1126325 https://bugzilla.suse.com/1127458 https://bugzilla.suse.com/1131595 https://bugzilla.suse.com/1131955

1 0

openSUSE-SU-2019:1293-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1293-1 Rating: moderate References: #1126711 #1126713 #1126821 #1126823 #1127122 #1128722 #1128883 #1128886 #1128887 #1128889 #1128892 #1129032 Cross-References: CVE-2018-20783 CVE-2019-9020 CVE-2019-9021 CVE-2019-9023 CVE-2019-9024 CVE-2019-9637 CVE-2019-9638 CVE-2019-9639 CVE-2019-9640 CVE-2019-9641 CVE-2019-9675 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). - CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). - CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). - CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). Other issue addressed: - Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1293=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-58.1 apache2-mod_php7-debuginfo-7.0.7-58.1 php7-7.0.7-58.1 php7-bcmath-7.0.7-58.1 php7-bcmath-debuginfo-7.0.7-58.1 php7-bz2-7.0.7-58.1 php7-bz2-debuginfo-7.0.7-58.1 php7-calendar-7.0.7-58.1 php7-calendar-debuginfo-7.0.7-58.1 php7-ctype-7.0.7-58.1 php7-ctype-debuginfo-7.0.7-58.1 php7-curl-7.0.7-58.1 php7-curl-debuginfo-7.0.7-58.1 php7-dba-7.0.7-58.1 php7-dba-debuginfo-7.0.7-58.1 php7-debuginfo-7.0.7-58.1 php7-debugsource-7.0.7-58.1 php7-devel-7.0.7-58.1 php7-dom-7.0.7-58.1 php7-dom-debuginfo-7.0.7-58.1 php7-enchant-7.0.7-58.1 php7-enchant-debuginfo-7.0.7-58.1 php7-exif-7.0.7-58.1 php7-exif-debuginfo-7.0.7-58.1 php7-fastcgi-7.0.7-58.1 php7-fastcgi-debuginfo-7.0.7-58.1 php7-fileinfo-7.0.7-58.1 php7-fileinfo-debuginfo-7.0.7-58.1 php7-firebird-7.0.7-58.1 php7-firebird-debuginfo-7.0.7-58.1 php7-fpm-7.0.7-58.1 php7-fpm-debuginfo-7.0.7-58.1 php7-ftp-7.0.7-58.1 php7-ftp-debuginfo-7.0.7-58.1 php7-gd-7.0.7-58.1 php7-gd-debuginfo-7.0.7-58.1 php7-gettext-7.0.7-58.1 php7-gettext-debuginfo-7.0.7-58.1 php7-gmp-7.0.7-58.1 php7-gmp-debuginfo-7.0.7-58.1 php7-iconv-7.0.7-58.1 php7-iconv-debuginfo-7.0.7-58.1 php7-imap-7.0.7-58.1 php7-imap-debuginfo-7.0.7-58.1 php7-intl-7.0.7-58.1 php7-intl-debuginfo-7.0.7-58.1 php7-json-7.0.7-58.1 php7-json-debuginfo-7.0.7-58.1 php7-ldap-7.0.7-58.1 php7-ldap-debuginfo-7.0.7-58.1 php7-mbstring-7.0.7-58.1 php7-mbstring-debuginfo-7.0.7-58.1 php7-mcrypt-7.0.7-58.1 php7-mcrypt-debuginfo-7.0.7-58.1 php7-mysql-7.0.7-58.1 php7-mysql-debuginfo-7.0.7-58.1 php7-odbc-7.0.7-58.1 php7-odbc-debuginfo-7.0.7-58.1 php7-opcache-7.0.7-58.1 php7-opcache-debuginfo-7.0.7-58.1 php7-openssl-7.0.7-58.1 php7-openssl-debuginfo-7.0.7-58.1 php7-pcntl-7.0.7-58.1 php7-pcntl-debuginfo-7.0.7-58.1 php7-pdo-7.0.7-58.1 php7-pdo-debuginfo-7.0.7-58.1 php7-pgsql-7.0.7-58.1 php7-pgsql-debuginfo-7.0.7-58.1 php7-phar-7.0.7-58.1 php7-phar-debuginfo-7.0.7-58.1 php7-posix-7.0.7-58.1 php7-posix-debuginfo-7.0.7-58.1 php7-pspell-7.0.7-58.1 php7-pspell-debuginfo-7.0.7-58.1 php7-readline-7.0.7-58.1 php7-readline-debuginfo-7.0.7-58.1 php7-shmop-7.0.7-58.1 php7-shmop-debuginfo-7.0.7-58.1 php7-snmp-7.0.7-58.1 php7-snmp-debuginfo-7.0.7-58.1 php7-soap-7.0.7-58.1 php7-soap-debuginfo-7.0.7-58.1 php7-sockets-7.0.7-58.1 php7-sockets-debuginfo-7.0.7-58.1 php7-sqlite-7.0.7-58.1 php7-sqlite-debuginfo-7.0.7-58.1 php7-sysvmsg-7.0.7-58.1 php7-sysvmsg-debuginfo-7.0.7-58.1 php7-sysvsem-7.0.7-58.1 php7-sysvsem-debuginfo-7.0.7-58.1 php7-sysvshm-7.0.7-58.1 php7-sysvshm-debuginfo-7.0.7-58.1 php7-tidy-7.0.7-58.1 php7-tidy-debuginfo-7.0.7-58.1 php7-tokenizer-7.0.7-58.1 php7-tokenizer-debuginfo-7.0.7-58.1 php7-wddx-7.0.7-58.1 php7-wddx-debuginfo-7.0.7-58.1 php7-xmlreader-7.0.7-58.1 php7-xmlreader-debuginfo-7.0.7-58.1 php7-xmlrpc-7.0.7-58.1 php7-xmlrpc-debuginfo-7.0.7-58.1 php7-xmlwriter-7.0.7-58.1 php7-xmlwriter-debuginfo-7.0.7-58.1 php7-xsl-7.0.7-58.1 php7-xsl-debuginfo-7.0.7-58.1 php7-zip-7.0.7-58.1 php7-zip-debuginfo-7.0.7-58.1 php7-zlib-7.0.7-58.1 php7-zlib-debuginfo-7.0.7-58.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-58.1 php7-pear-Archive_Tar-7.0.7-58.1 References: https://www.suse.com/security/cve/CVE-2018-20783.html https://www.suse.com/security/cve/CVE-2019-9020.html https://www.suse.com/security/cve/CVE-2019-9021.html https://www.suse.com/security/cve/CVE-2019-9023.html https://www.suse.com/security/cve/CVE-2019-9024.html https://www.suse.com/security/cve/CVE-2019-9637.html https://www.suse.com/security/cve/CVE-2019-9638.html https://www.suse.com/security/cve/CVE-2019-9639.html https://www.suse.com/security/cve/CVE-2019-9640.html https://www.suse.com/security/cve/CVE-2019-9641.html https://www.suse.com/security/cve/CVE-2019-9675.html https://bugzilla.suse.com/1126711 https://bugzilla.suse.com/1126713 https://bugzilla.suse.com/1126821 https://bugzilla.suse.com/1126823 https://bugzilla.suse.com/1127122 https://bugzilla.suse.com/1128722 https://bugzilla.suse.com/1128883 https://bugzilla.suse.com/1128886 https://bugzilla.suse.com/1128887 https://bugzilla.suse.com/1128889 https://bugzilla.suse.com/1128892 https://bugzilla.suse.com/1129032

1 0

openSUSE-SU-2019:1291-1: important: Security update for libssh2_org
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1291-1 Rating: important References: #1130103 #1133528 Cross-References: CVE-2019-3859 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libssh2_org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication [bsc#1133528, bsc#1130103] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1291=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libssh2-1-1.8.0-lp150.3.6.1 libssh2-1-debuginfo-1.8.0-lp150.3.6.1 libssh2-devel-1.8.0-lp150.3.6.1 libssh2_org-debugsource-1.8.0-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libssh2-1-32bit-1.8.0-lp150.3.6.1 libssh2-1-32bit-debuginfo-1.8.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3859.html https://bugzilla.suse.com/1130103 https://bugzilla.suse.com/1133528

1 0

openSUSE-SU-2019:1290-1: important: Security update for libssh2_org
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1290-1 Rating: important References: #1130103 #1133528 Cross-References: CVE-2019-3859 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libssh2_org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication [bsc#1133528, bsc#1130103] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1290=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libssh2-1-1.4.3-19.6.1 libssh2-1-debuginfo-1.4.3-19.6.1 libssh2-devel-1.4.3-19.6.1 libssh2_org-debugsource-1.4.3-19.6.1 - openSUSE Leap 42.3 (x86_64): libssh2-1-32bit-1.4.3-19.6.1 libssh2-1-debuginfo-32bit-1.4.3-19.6.1 References: https://www.suse.com/security/cve/CVE-2019-3859.html https://bugzilla.suse.com/1130103 https://bugzilla.suse.com/1133528

1 0

openSUSE-RU-2019:1289-1: moderate: Recommended update for python-kiwi
by maintenance＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1289-1 Rating: moderate References: #1108508 #1110869 #1110871 #1119416 #1123185 #1123186 #1126283 #1126318 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for python-kiwi provides the following fixes: - Change the default value for bundler compression. If no compression is configured in the kiwi config file the default was set to False. However this led to big trouble on the OBS side for images which have fixed storage disk sizes configured (for example Azure images which request 30G disk size per instance). The default has changed to be True. - Support alternative EFI and grub modules paths. In SUSE products EFI binaries are historically located in /usr/lib*/efi. In a recent move to package grub2 as noarch, a collision between x86_64 and aarch64 has been identified as both packages place platform-specific files in the same location. To fix this, a new location was devised: /usr/share/efi/$(uname -m). At the same time /usr/lib/grub2 will move to /usr/share/grub2. (fate#326960) - Fix Xen guest detection. Xen setup (e.g in the Amazon Cloud) is only supported for the x86_64 architecture. (bsc#1123186, bsc#1123185) - Fix the location of grub unicode font file. grub2 is expecting the unicode font under the fonts directory in the /boot/grub*/ depending on how the distribution installs grub2. (bsc#1119416) - Add Codec utils for bytes literals decoding. In case of a literal decoding failure it tries to decode the result in utf-8. This is handy in python2 environments where python and the host might be using different charset configurations. In python3 this issue seems to be solved. (bsc#1110871) - Fixed URI handling with token query option. So far only the query format "?credentials=" was supported. In case of "?random_token_data" the returned uri was truncated and also the format check on the query caused a python trace. (bsc#1110869, bsc#1108508) - Fix disk size calculation for VMX. Disk size calculation must take into account the empty volumes that are to be mounted in a directory that does not exist in the root tree otherwise there is KeyError. The result of storate/setup._calculate_volume_mbytes must be a dictionary including all defined volumes. - Fixes an issue where the resize of a disk didn't work if the system is multipath based (bsc#1126283) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1289=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-kiwi-lib-9.17.14-lp150.2.17.1 dracut-kiwi-live-9.17.14-lp150.2.17.1 dracut-kiwi-oem-dump-9.17.14-lp150.2.17.1 dracut-kiwi-oem-repart-9.17.14-lp150.2.17.1 dracut-kiwi-overlay-9.17.14-lp150.2.17.1 kiwi-man-pages-9.17.14-lp150.2.17.1 kiwi-pxeboot-9.17.14-lp150.2.17.1 kiwi-tools-9.17.14-lp150.2.17.1 kiwi-tools-debuginfo-9.17.14-lp150.2.17.1 python-kiwi-debugsource-9.17.14-lp150.2.17.1 python2-kiwi-9.17.14-lp150.2.17.1 python3-kiwi-9.17.14-lp150.2.17.1 References: https://bugzilla.suse.com/1108508 https://bugzilla.suse.com/1110869 https://bugzilla.suse.com/1110871 https://bugzilla.suse.com/1119416 https://bugzilla.suse.com/1123185 https://bugzilla.suse.com/1123186 https://bugzilla.suse.com/1126283 https://bugzilla.suse.com/1126318

1 0

openSUSE-SU-2019:1288-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 29 Apr '19

29 Apr '19

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1288-1 Rating: important References: #1081516 #1102604 #1104662 #1106420 #1108086 #1108395 #1112182 #1117058 #1118952 #1120813 #1123642 #1124667 #1125665 #1126325 #1127458 #1130129 Cross-References: CVE-2019-3840 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 15 fixes is now available. Description: This update for libvirt provides the following fixes: Security issue fixed: - CVE-2019-3840: Fixed a null pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458). Other issues addressed: - apparmor: reintroduce upstream lxc mount rules (bsc#1130129). - hook: encode incoming XML to UTF-8 before passing to lxml etree from string method (bsc#1123642). - supportconfig: collect rotated logs in /var/log/libvirt/* (bsc#1124667). - libxl: support Xen's max_grant_frames setting with maxGrantFrames attribute on the xenbus controller (bsc#1126325). - conf: added new 'xenbus' controller type - util: skip RDMA detection for non-PCI network devices (bsc#1112182). - qemu: don't use CAP_DAC_OVERRIDE capability if non-root (bsc#1125665). - qemu: fix issues related to restricted permissions on /dev/sev(bsc#1102604). - apparmor: add support for named profiles (bsc#1118952). - libxl: save current memory value after successful balloon (bsc#1120813). - apparmor: Fix ptrace rules. (bsc#1117058) - libxl: Add support for soft reset. (bsc#1081516) - libxl: Fix VM migration on busy hosts. (bsc#1108086) - qemu: Add support for SEV guests. (fate#325817) - util: Don't check for parallel iteration in hash-related functions. (bsc#1106420) - spec: Don't restart libvirt-guests when updating libvirt-client. (bsc#1104662) - Fix virNodeGetSEVInfo API crashing libvirtd on AMD SEV enabled hosts. (bsc#1108395) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1288=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvirt-4.0.0-lp150.7.10.4 libvirt-admin-4.0.0-lp150.7.10.4 libvirt-admin-debuginfo-4.0.0-lp150.7.10.4 libvirt-client-4.0.0-lp150.7.10.4 libvirt-client-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-4.0.0-lp150.7.10.4 libvirt-daemon-config-network-4.0.0-lp150.7.10.4 libvirt-daemon-config-nwfilter-4.0.0-lp150.7.10.4 libvirt-daemon-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-interface-4.0.0-lp150.7.10.4 libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-lxc-4.0.0-lp150.7.10.4 libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-network-4.0.0-lp150.7.10.4 libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-nodedev-4.0.0-lp150.7.10.4 libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.10.4 libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-qemu-4.0.0-lp150.7.10.4 libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-secret-4.0.0-lp150.7.10.4 libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-core-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-uml-4.0.0-lp150.7.10.4 libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-vbox-4.0.0-lp150.7.10.4 libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-hooks-4.0.0-lp150.7.10.4 libvirt-daemon-lxc-4.0.0-lp150.7.10.4 libvirt-daemon-qemu-4.0.0-lp150.7.10.4 libvirt-daemon-uml-4.0.0-lp150.7.10.4 libvirt-daemon-vbox-4.0.0-lp150.7.10.4 libvirt-debugsource-4.0.0-lp150.7.10.4 libvirt-devel-4.0.0-lp150.7.10.4 libvirt-doc-4.0.0-lp150.7.10.4 libvirt-libs-4.0.0-lp150.7.10.4 libvirt-libs-debuginfo-4.0.0-lp150.7.10.4 libvirt-lock-sanlock-4.0.0-lp150.7.10.4 libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.10.4 libvirt-nss-4.0.0-lp150.7.10.4 libvirt-nss-debuginfo-4.0.0-lp150.7.10.4 wireshark-plugin-libvirt-4.0.0-lp150.7.10.4 wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.10.4 - openSUSE Leap 15.0 (x86_64): libvirt-client-32bit-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-libxl-4.0.0-lp150.7.10.4 libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.10.4 libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.10.4 libvirt-daemon-xen-4.0.0-lp150.7.10.4 libvirt-devel-32bit-4.0.0-lp150.7.10.4 References: https://www.suse.com/security/cve/CVE-2019-3840.html https://bugzilla.suse.com/1081516 https://bugzilla.suse.com/1102604 https://bugzilla.suse.com/1104662 https://bugzilla.suse.com/1106420 https://bugzilla.suse.com/1108086 https://bugzilla.suse.com/1108395 https://bugzilla.suse.com/1112182 https://bugzilla.suse.com/1117058 https://bugzilla.suse.com/1118952 https://bugzilla.suse.com/1120813 https://bugzilla.suse.com/1123642 https://bugzilla.suse.com/1124667 https://bugzilla.suse.com/1125665 https://bugzilla.suse.com/1126325 https://bugzilla.suse.com/1127458 https://bugzilla.suse.com/1130129

1 0