The following updates has been released for openSUSE:

openSUSE-SU-2019:1310-1: moderate: Security update for libsoup
openSUSE-SU-2019:1312-1: important: Security update for dovecot23
openSUSE-SU-2019:1313-1: moderate: Security update for ntfs-3g_ntfsprogs
openSUSE-SU-2019:1314-1: moderate: Security update for ntfs-3g_ntfsprogs
openSUSE-SU-2019:1315-1: moderate: Security update for jasper
openSUSE-SU-2019:1316-1: moderate: Security update for webkit2gtk3

openSUSE-SU-2019:1310-1: moderate: Security update for libsoup

openSUSE Security Update: Security update for libsoup
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1310-1
Rating: moderate
References: #1100097
Cross-References: CVE-2018-12910
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for libsoup fixes the following issues:

Security issue fixed:

- CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1310=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libsoup-2_4-1-2.62.2-lp150.2.3.1
libsoup-2_4-1-debuginfo-2.62.2-lp150.2.3.1
libsoup-debugsource-2.62.2-lp150.2.3.1
libsoup-devel-2.62.2-lp150.2.3.1
typelib-1_0-Soup-2_4-2.62.2-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

libsoup-2_4-1-32bit-2.62.2-lp150.2.3.1
libsoup-2_4-1-32bit-debuginfo-2.62.2-lp150.2.3.1
libsoup-devel-32bit-2.62.2-lp150.2.3.1

- openSUSE Leap 15.0 (noarch):

libsoup-lang-2.62.2-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2018-12910.html
https://bugzilla.suse.com/1100097

--

openSUSE-SU-2019:1312-1: important: Security update for dovecot23

openSUSE Security Update: Security update for dovecot23
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1312-1
Rating: important
References: #1132501
Cross-References: CVE-2019-10691
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for dovecot23 fixes the following issues:

Security issue fixed:

- CVE-2019-10691: Fixed a denial of service via reachable assertion when
processing invalid UTF-8 characters (bsc#1132501).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1312=1



Package List:

- openSUSE Leap 15.0 (x86_64):

dovecot23-2.3.3-lp150.11.1
dovecot23-backend-mysql-2.3.3-lp150.11.1
dovecot23-backend-mysql-debuginfo-2.3.3-lp150.11.1
dovecot23-backend-pgsql-2.3.3-lp150.11.1
dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.11.1
dovecot23-backend-sqlite-2.3.3-lp150.11.1
dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.11.1
dovecot23-debuginfo-2.3.3-lp150.11.1
dovecot23-debugsource-2.3.3-lp150.11.1
dovecot23-devel-2.3.3-lp150.11.1
dovecot23-fts-2.3.3-lp150.11.1
dovecot23-fts-debuginfo-2.3.3-lp150.11.1
dovecot23-fts-lucene-2.3.3-lp150.11.1
dovecot23-fts-lucene-debuginfo-2.3.3-lp150.11.1
dovecot23-fts-solr-2.3.3-lp150.11.1
dovecot23-fts-solr-debuginfo-2.3.3-lp150.11.1
dovecot23-fts-squat-2.3.3-lp150.11.1
dovecot23-fts-squat-debuginfo-2.3.3-lp150.11.1


References:

https://www.suse.com/security/cve/CVE-2019-10691.html
https://bugzilla.suse.com/1132501

--

openSUSE-SU-2019:1313-1: moderate: Security update for ntfs-3g_ntfsprogs

openSUSE Security Update: Security update for ntfs-3g_ntfsprogs
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1313-1
Rating: moderate
References: #1130165
Cross-References: CVE-2019-9755
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for ntfs-3g_ntfsprogs fixes the following issues:

Security issues fixed:

- CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to
local privilege escalation (bsc#1130165).

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1313=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libntfs-3g-devel-2013.1.13-7.6.1
libntfs-3g84-2013.1.13-7.6.1
libntfs-3g84-debuginfo-2013.1.13-7.6.1
ntfs-3g-2013.1.13-7.6.1
ntfs-3g-debuginfo-2013.1.13-7.6.1
ntfs-3g_ntfsprogs-debugsource-2013.1.13-7.6.1
ntfsprogs-2013.1.13-7.6.1
ntfsprogs-debuginfo-2013.1.13-7.6.1


References:

https://www.suse.com/security/cve/CVE-2019-9755.html
https://bugzilla.suse.com/1130165

--

openSUSE-SU-2019:1314-1: moderate: Security update for ntfs-3g_ntfsprogs

openSUSE Security Update: Security update for ntfs-3g_ntfsprogs
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1314-1
Rating: moderate
References: #1130165
Cross-References: CVE-2019-9755
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for ntfs-3g_ntfsprogs fixes the following issues:

Security issues fixed:

- CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to
local privilege escalation (bsc#1130165).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1314=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libntfs-3g-devel-2016.2.22-lp150.2.3.1
libntfs-3g87-2016.2.22-lp150.2.3.1
libntfs-3g87-debuginfo-2016.2.22-lp150.2.3.1
ntfs-3g-2016.2.22-lp150.2.3.1
ntfs-3g-debuginfo-2016.2.22-lp150.2.3.1
ntfs-3g_ntfsprogs-debuginfo-2016.2.22-lp150.2.3.1
ntfs-3g_ntfsprogs-debugsource-2016.2.22-lp150.2.3.1
ntfsprogs-2016.2.22-lp150.2.3.1
ntfsprogs-debuginfo-2016.2.22-lp150.2.3.1
ntfsprogs-extra-2016.2.22-lp150.2.3.1
ntfsprogs-extra-debuginfo-2016.2.22-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2019-9755.html
https://bugzilla.suse.com/1130165

--

openSUSE-SU-2019:1315-1: moderate: Security update for jasper

openSUSE Security Update: Security update for jasper
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1315-1
Rating: moderate
References: #1010783 #1117505 #1117511
Cross-References: CVE-2016-9396 CVE-2018-19539 CVE-2018-19542

Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for jasper fixes the following issues:

Security issues fixed:

- CVE-2018-19542: Fixed a denial of service in jp2_decode (bsc#1117505).
- CVE-2018-19539: Fixed a denial of service in jas_image_readcmpt
(bsc#1117511).
- CVE-2016-9396: Fixed a denial of service in jpc_cox_getcompparms
(bsc#1010783).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1315=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

jasper-2.0.14-lp150.2.3.1
jasper-debuginfo-2.0.14-lp150.2.3.1
jasper-debugsource-2.0.14-lp150.2.3.1
libjasper-devel-2.0.14-lp150.2.3.1
libjasper4-2.0.14-lp150.2.3.1
libjasper4-debuginfo-2.0.14-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

libjasper4-32bit-2.0.14-lp150.2.3.1
libjasper4-32bit-debuginfo-2.0.14-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2016-9396.html
https://www.suse.com/security/cve/CVE-2018-19539.html
https://www.suse.com/security/cve/CVE-2018-19542.html
https://bugzilla.suse.com/1010783
https://bugzilla.suse.com/1117505
https://bugzilla.suse.com/1117511

--

openSUSE-SU-2019:1316-1: moderate: Security update for webkit2gtk3

openSUSE Security Update: Security update for webkit2gtk3
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1316-1
Rating: moderate
References: #1126768
Cross-References: CVE-2019-8375
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for webkit2gtk3 fixes the following issues:

Security issue fixed:

- CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow
the script dialog size to exceed the web view size leading to Buffer
Overflow or other unspecified impact (bsc#1126768).

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1316=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libjavascriptcoregtk-4_0-18-2.24.0-24.1
libjavascriptcoregtk-4_0-18-debuginfo-2.24.0-24.1
libwebkit2gtk-4_0-37-2.24.0-24.1
libwebkit2gtk-4_0-37-debuginfo-2.24.0-24.1
typelib-1_0-JavaScriptCore-4_0-2.24.0-24.1
typelib-1_0-WebKit2-4_0-2.24.0-24.1
typelib-1_0-WebKit2WebExtension-4_0-2.24.0-24.1
webkit-jsc-4-2.24.0-24.1
webkit-jsc-4-debuginfo-2.24.0-24.1
webkit2gtk-4_0-injected-bundles-2.24.0-24.1
webkit2gtk-4_0-injected-bundles-debuginfo-2.24.0-24.1
webkit2gtk3-debugsource-2.24.0-24.1
webkit2gtk3-devel-2.24.0-24.1
webkit2gtk3-minibrowser-2.24.0-24.1
webkit2gtk3-minibrowser-debuginfo-2.24.0-24.1
webkit2gtk3-plugin-process-gtk2-2.24.0-24.1
webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.0-24.1

- openSUSE Leap 42.3 (noarch):

libwebkit2gtk3-lang-2.24.0-24.1

- openSUSE Leap 42.3 (x86_64):

libjavascriptcoregtk-4_0-18-32bit-2.24.0-24.1
libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.24.0-24.1
libwebkit2gtk-4_0-37-32bit-2.24.0-24.1
libwebkit2gtk-4_0-37-debuginfo-32bit-2.24.0-24.1


References:

https://www.suse.com/security/cve/CVE-2019-8375.html
https://bugzilla.suse.com/1126768

--