The following updates has been released for openSUSE:

openSUSE-SU-2019:1272-1: moderate: Security update for GraphicsMagick
openSUSE-SU-2019:1273-1: important: Security update for python
openSUSE-SU-2019:1274-1: important: Security update for qemu
openSUSE-SU-2019:1275-1: important: Security update for lxc, lxcfs
openSUSE-SU-2019:1276-1: moderate: Security update for xmltooling

openSUSE-SU-2019:1272-1: moderate: Security update for GraphicsMagick

openSUSE Security Update: Security update for GraphicsMagick
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1272-1
Rating: moderate
References: #1132053 #1132054 #1132055 #1132058 #1132060
#1132061
Cross-References: CVE-2019-11005 CVE-2019-11006 CVE-2019-11007
CVE-2019-11008 CVE-2019-11009 CVE-2019-11010

Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes 6 vulnerabilities is now available.

Description:

This update for GraphicsMagick fixes the following issues:

- CVE-2019-11005: Fixed a stack-based buffer overflow in SVGStartElement
of coders/svg.c that allowed attackers to cause DOS or an unspecified
impact (boo#1132058)
- CVE-2019-11006: Fixed a heap-based buffer over-read in the function
ReadMIFFImage of coders/miff.c that allowed attackers to cause DOS or
information disclosure (boo#1132061)
- CVE-2019-11010: Fixed a memory leak in ReadMPCImage of coders/mpc.c that
which allowed attackers to cause DOS via a crafted image file
(boo#1132055)
- CVE-2019-11007: Fixed a heap-based buffer over-read in the ReadMNGImage
function of coders/png.c that which allowed attackers to cause a denial
of service or information disclosure (boo#1132060)
- CVE-2019-11008: Fixed a heap-based buffer overflow in the function
WriteXWDImage of coders/xwd.c that which allowed remote attackers to
cause DOS or other unspecified impact (boo#1132054)
- CVE-2019-11009: Fixed a heap-based buffer over-read in the function
ReadXWDImage of coders/xwd.c that which allowed attackers to cause DOS
or information disclosure (boo#1132053)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1272=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1272=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

GraphicsMagick-1.3.25-132.1
GraphicsMagick-debuginfo-1.3.25-132.1
GraphicsMagick-debugsource-1.3.25-132.1
GraphicsMagick-devel-1.3.25-132.1
libGraphicsMagick++-Q16-12-1.3.25-132.1
libGraphicsMagick++-Q16-12-debuginfo-1.3.25-132.1
libGraphicsMagick++-devel-1.3.25-132.1
libGraphicsMagick-Q16-3-1.3.25-132.1
libGraphicsMagick-Q16-3-debuginfo-1.3.25-132.1
libGraphicsMagick3-config-1.3.25-132.1
libGraphicsMagickWand-Q16-2-1.3.25-132.1
libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-132.1
perl-GraphicsMagick-1.3.25-132.1
perl-GraphicsMagick-debuginfo-1.3.25-132.1

- openSUSE Leap 15.0 (x86_64):

GraphicsMagick-1.3.29-lp150.3.25.1
GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1
GraphicsMagick-debugsource-1.3.29-lp150.3.25.1
GraphicsMagick-devel-1.3.29-lp150.3.25.1
libGraphicsMagick++-Q16-12-1.3.29-lp150.3.25.1
libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.25.1
libGraphicsMagick++-devel-1.3.29-lp150.3.25.1
libGraphicsMagick-Q16-3-1.3.29-lp150.3.25.1
libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.25.1
libGraphicsMagick3-config-1.3.29-lp150.3.25.1
libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.25.1
libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.25.1
perl-GraphicsMagick-1.3.29-lp150.3.25.1
perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1


References:

https://www.suse.com/security/cve/CVE-2019-11005.html
https://www.suse.com/security/cve/CVE-2019-11006.html
https://www.suse.com/security/cve/CVE-2019-11007.html
https://www.suse.com/security/cve/CVE-2019-11008.html
https://www.suse.com/security/cve/CVE-2019-11009.html
https://www.suse.com/security/cve/CVE-2019-11010.html
https://bugzilla.suse.com/1132053
https://bugzilla.suse.com/1132054
https://bugzilla.suse.com/1132055
https://bugzilla.suse.com/1132058
https://bugzilla.suse.com/1132060
https://bugzilla.suse.com/1132061

--

openSUSE-SU-2019:1273-1: important: Security update for python

openSUSE Security Update: Security update for python
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1273-1
Rating: important
References: #1129346 #1130847
Cross-References: CVE-2019-9636 CVE-2019-9948
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for python fixes the following issues:

Security issues fixed:

- CVE-2019-9948: Fixed a 'file:' blacklist bypass in URIs by using the
'local-file:' scheme instead (bsc#1130847).
- CVE-2019-9636: Fixed an information disclosure because of incorrect
handling of Unicode encoding during NFKC normalization (bsc#1129346).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1273=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

python-2.7.14-lp150.6.10.1
python-curses-2.7.14-lp150.6.10.1
python-curses-debuginfo-2.7.14-lp150.6.10.1
python-debuginfo-2.7.14-lp150.6.10.1
python-debugsource-2.7.14-lp150.6.10.1
python-demo-2.7.14-lp150.6.10.1
python-gdbm-2.7.14-lp150.6.10.1
python-gdbm-debuginfo-2.7.14-lp150.6.10.1
python-idle-2.7.14-lp150.6.10.1
python-tk-2.7.14-lp150.6.10.1
python-tk-debuginfo-2.7.14-lp150.6.10.1

- openSUSE Leap 15.0 (x86_64):

python-32bit-2.7.14-lp150.6.10.1
python-32bit-debuginfo-2.7.14-lp150.6.10.1


References:

https://www.suse.com/security/cve/CVE-2019-9636.html
https://www.suse.com/security/cve/CVE-2019-9948.html
https://bugzilla.suse.com/1129346
https://bugzilla.suse.com/1130847

--

openSUSE-SU-2019:1274-1: important: Security update for qemu

openSUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1274-1
Rating: important
References: #1118900 #1125721 #1126455 #1129622 #1130675
#1131955
Cross-References: CVE-2018-20815 CVE-2019-3812 CVE-2019-8934
CVE-2019-9824
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves four vulnerabilities and has two
fixes is now available.

Description:

This update for qemu fixes the following issues:

Security issues fixed:

- CVE-2019-9824: Fixed information leak in slirp (bsc#1129622).
- CVE-2019-8934: Added method to specify whether or not to expose certain
ppc64 hostinformation (bsc#1126455).
- CVE-2019-3812: Fixed Out-of-bounds memory access and information leak in
virtual monitor interface (bsc#1125721).
- CVE-2018-20815: Fixed a denial of service possibility in device tree
processing (bsc#1130675).

Non-security issue fixed:

- Backported Skylake-Server vcpu model support from qemu v2.11
(FATE#327261 bsc#1131955).
- Added ability to set virtqueue size using virtqueue_size parameter
(FATE#327255 bsc#1118900).

This update was imported from the SUSE:SLE-12-SP3:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1274=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

qemu-linux-user-2.9.1-59.1
qemu-linux-user-debuginfo-2.9.1-59.1
qemu-linux-user-debugsource-2.9.1-59.1

- openSUSE Leap 42.3 (noarch):

qemu-ipxe-1.0.0+-59.1
qemu-seabios-1.10.2-59.1
qemu-sgabios-8-59.1
qemu-vgabios-1.10.2-59.1

- openSUSE Leap 42.3 (x86_64):

qemu-2.9.1-59.1
qemu-arm-2.9.1-59.1
qemu-arm-debuginfo-2.9.1-59.1
qemu-block-curl-2.9.1-59.1
qemu-block-curl-debuginfo-2.9.1-59.1
qemu-block-dmg-2.9.1-59.1
qemu-block-dmg-debuginfo-2.9.1-59.1
qemu-block-iscsi-2.9.1-59.1
qemu-block-iscsi-debuginfo-2.9.1-59.1
qemu-block-rbd-2.9.1-59.1
qemu-block-rbd-debuginfo-2.9.1-59.1
qemu-block-ssh-2.9.1-59.1
qemu-block-ssh-debuginfo-2.9.1-59.1
qemu-debugsource-2.9.1-59.1
qemu-extra-2.9.1-59.1
qemu-extra-debuginfo-2.9.1-59.1
qemu-guest-agent-2.9.1-59.1
qemu-guest-agent-debuginfo-2.9.1-59.1
qemu-ksm-2.9.1-59.1
qemu-kvm-2.9.1-59.1
qemu-lang-2.9.1-59.1
qemu-ppc-2.9.1-59.1
qemu-ppc-debuginfo-2.9.1-59.1
qemu-s390-2.9.1-59.1
qemu-s390-debuginfo-2.9.1-59.1
qemu-testsuite-2.9.1-59.2
qemu-tools-2.9.1-59.1
qemu-tools-debuginfo-2.9.1-59.1
qemu-x86-2.9.1-59.1
qemu-x86-debuginfo-2.9.1-59.1


References:

https://www.suse.com/security/cve/CVE-2018-20815.html
https://www.suse.com/security/cve/CVE-2019-3812.html
https://www.suse.com/security/cve/CVE-2019-8934.html
https://www.suse.com/security/cve/CVE-2019-9824.html
https://bugzilla.suse.com/1118900
https://bugzilla.suse.com/1125721
https://bugzilla.suse.com/1126455
https://bugzilla.suse.com/1129622
https://bugzilla.suse.com/1130675
https://bugzilla.suse.com/1131955

--

openSUSE-SU-2019:1275-1: important: Security update for lxc, lxcfs

openSUSE Security Update: Security update for lxc, lxcfs
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1275-1
Rating: important
References: #1122185 #1131762 #988348
Cross-References: CVE-2018-6556 CVE-2019-5736
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:

This update for lxc, lxcfs to version 3.1.0 fixes the following issues:

Security issues fixed:

- CVE-2019-5736: Fixed a container breakout vulnerability (boo#1122185).
- CVE-2018-6556: Enable setuid bit on lxc-user-nic (boo#988348).

Non-security issues fixed:

- Update to LXC 3.1.0. The changelog is far too long to include here,
please look at https://linuxcontainers.org/. (boo#1131762)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1275=1



Package List:

- openSUSE Leap 15.0 (x86_64):

liblxc-devel-3.1.0-lp150.2.10.1
liblxc1-3.1.0-lp150.2.10.1
liblxc1-debuginfo-3.1.0-lp150.2.10.1
lxc-3.1.0-lp150.2.10.1
lxc-debuginfo-3.1.0-lp150.2.10.1
lxc-debugsource-3.1.0-lp150.2.10.1
lxcfs-3.0.3-lp150.2.3.1
lxcfs-debuginfo-3.0.3-lp150.2.3.1
lxcfs-debugsource-3.0.3-lp150.2.3.1
pam_cgfs-3.1.0-lp150.2.10.1
pam_cgfs-debuginfo-3.1.0-lp150.2.10.1

- openSUSE Leap 15.0 (noarch):

lxc-bash-completion-3.1.0-lp150.2.10.1
lxcfs-hooks-lxc-3.0.3-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2018-6556.html
https://www.suse.com/security/cve/CVE-2019-5736.html
https://bugzilla.suse.com/1122185
https://bugzilla.suse.com/1131762
https://bugzilla.suse.com/988348

--

openSUSE-SU-2019:1276-1: moderate: Security update for xmltooling

openSUSE Security Update: Security update for xmltooling
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1276-1
Rating: moderate
References: #1129537
Cross-References: CVE-2019-9628
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for xmltooling fixes the following issue:

Security issue fixed:

- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling
library which could result in denial of service against the application
using XMLTooling (bsc#1129537).

This update was imported from the SUSE:SLE-12-SP1:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1276=1



Package List:

- openSUSE Leap 42.3 (x86_64):

libxmltooling-devel-1.5.6-12.1
libxmltooling6-1.5.6-12.1
libxmltooling6-debuginfo-1.5.6-12.1
xmltooling-debugsource-1.5.6-12.1
xmltooling-schemas-1.5.6-12.1


References:

https://www.suse.com/security/cve/CVE-2019-9628.html
https://bugzilla.suse.com/1129537

--