The following updates has been released for openSUSE:
openSUSE-SU-2019:1475-1: Security update for libu2f-host
openSUSE-SU-2019:1476-1: moderate: Security update for bluez
openSUSE-SU-2019:1477-1: important: Security update for gnutls
openSUSE-SU-2019:1475-1: Security update for libu2f-host
openSUSE-SU-2019:1476-1: moderate: Security update for bluez
openSUSE-SU-2019:1477-1: important: Security update for gnutls
openSUSE-SU-2019:1475-1: Security update for libu2f-host
openSUSE Security Update: Security update for libu2f-host
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1475-1
Rating: low
References: #1124781
Cross-References: CVE-2018-20340
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for libu2f-host fixes the following issues:
Security issue fixed:
- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer
overflow with a custom made malicious USB device (bsc#1124781).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1475=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1475=1
Package List:
- openSUSE Leap 15.1 (x86_64):
libu2f-host-debuginfo-1.1.6-lp151.2.3.1
libu2f-host-debugsource-1.1.6-lp151.2.3.1
libu2f-host-devel-1.1.6-lp151.2.3.1
libu2f-host-doc-1.1.6-lp151.2.3.1
libu2f-host0-1.1.6-lp151.2.3.1
libu2f-host0-debuginfo-1.1.6-lp151.2.3.1
u2f-host-1.1.6-lp151.2.3.1
u2f-host-debuginfo-1.1.6-lp151.2.3.1
- openSUSE Leap 15.0 (x86_64):
libu2f-host-debuginfo-1.1.6-lp150.7.1
libu2f-host-debugsource-1.1.6-lp150.7.1
libu2f-host-devel-1.1.6-lp150.7.1
libu2f-host-doc-1.1.6-lp150.7.1
libu2f-host0-1.1.6-lp150.7.1
libu2f-host0-debuginfo-1.1.6-lp150.7.1
u2f-host-1.1.6-lp150.7.1
u2f-host-debuginfo-1.1.6-lp150.7.1
References:
https://www.suse.com/security/cve/CVE-2018-20340.html
https://bugzilla.suse.com/1124781
--
openSUSE-SU-2019:1476-1: moderate: Security update for bluez
openSUSE Security Update: Security update for bluez
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1476-1
Rating: moderate
References: #1013708 #1013712 #1013893 #1015171
Cross-References: CVE-2016-9797 CVE-2016-9798 CVE-2016-9802
CVE-2016-9917
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for bluez fixes the following issues:
Security issues fixed:
- CVE-2016-9797: Fixed a buffer over-read in l2cap_dump() (bsc#1013708).
- CVE-2016-9798: Fixed a use-after-free in conf_opt() (bsc#1013712).
- CVE-2016-9917: Fixed a heap-based buffer overflow in read_n()
(bsc#1015171).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1476=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1476=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
bluez-5.48-lp151.8.3.1
bluez-cups-5.48-lp151.8.3.1
bluez-cups-debuginfo-5.48-lp151.8.3.1
bluez-debuginfo-5.48-lp151.8.3.1
bluez-debugsource-5.48-lp151.8.3.1
bluez-devel-5.48-lp151.8.3.1
bluez-test-5.48-lp151.8.3.1
bluez-test-debuginfo-5.48-lp151.8.3.1
libbluetooth3-5.48-lp151.8.3.1
libbluetooth3-debuginfo-5.48-lp151.8.3.1
- openSUSE Leap 15.1 (x86_64):
bluez-devel-32bit-5.48-lp151.8.3.1
libbluetooth3-32bit-5.48-lp151.8.3.1
libbluetooth3-32bit-debuginfo-5.48-lp151.8.3.1
- openSUSE Leap 15.1 (noarch):
bluez-auto-enable-devices-5.48-lp151.8.3.1
- openSUSE Leap 15.0 (i586 x86_64):
bluez-5.48-lp150.4.13.1
bluez-cups-5.48-lp150.4.13.1
bluez-cups-debuginfo-5.48-lp150.4.13.1
bluez-debuginfo-5.48-lp150.4.13.1
bluez-debugsource-5.48-lp150.4.13.1
bluez-devel-5.48-lp150.4.13.1
bluez-test-5.48-lp150.4.13.1
bluez-test-debuginfo-5.48-lp150.4.13.1
libbluetooth3-5.48-lp150.4.13.1
libbluetooth3-debuginfo-5.48-lp150.4.13.1
- openSUSE Leap 15.0 (x86_64):
bluez-devel-32bit-5.48-lp150.4.13.1
libbluetooth3-32bit-5.48-lp150.4.13.1
libbluetooth3-32bit-debuginfo-5.48-lp150.4.13.1
- openSUSE Leap 15.0 (noarch):
bluez-auto-enable-devices-5.48-lp150.4.13.1
References:
https://www.suse.com/security/cve/CVE-2016-9797.html
https://www.suse.com/security/cve/CVE-2016-9798.html
https://www.suse.com/security/cve/CVE-2016-9802.html
https://www.suse.com/security/cve/CVE-2016-9917.html
https://bugzilla.suse.com/1013708
https://bugzilla.suse.com/1013712
https://bugzilla.suse.com/1013893
https://bugzilla.suse.com/1015171
--
openSUSE-SU-2019:1477-1: important: Security update for gnutls
openSUSE Security Update: Security update for gnutls
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1477-1
Rating: important
References: #1118087 #1134856
Cross-References: CVE-2018-16868
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for gnutls fixes the following issues:
Security issue fixed:
- CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1
v1.5 verification (bsc#1118087).
Non-security issue fixed:
- Explicitly require libnettle 3.4.1 to prevent missing symbol errors
(bsc#1134856).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1477=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1477=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
gnutls-3.6.7-lp151.2.3.1
gnutls-debuginfo-3.6.7-lp151.2.3.1
gnutls-debugsource-3.6.7-lp151.2.3.1
gnutls-guile-3.6.7-lp151.2.3.1
gnutls-guile-debuginfo-3.6.7-lp151.2.3.1
libgnutls-dane-devel-3.6.7-lp151.2.3.1
libgnutls-dane0-3.6.7-lp151.2.3.1
libgnutls-dane0-debuginfo-3.6.7-lp151.2.3.1
libgnutls-devel-3.6.7-lp151.2.3.1
libgnutls30-3.6.7-lp151.2.3.1
libgnutls30-debuginfo-3.6.7-lp151.2.3.1
libgnutlsxx-devel-3.6.7-lp151.2.3.1
libgnutlsxx28-3.6.7-lp151.2.3.1
libgnutlsxx28-debuginfo-3.6.7-lp151.2.3.1
- openSUSE Leap 15.1 (x86_64):
libgnutls-devel-32bit-3.6.7-lp151.2.3.1
libgnutls30-32bit-3.6.7-lp151.2.3.1
libgnutls30-32bit-debuginfo-3.6.7-lp151.2.3.1
- openSUSE Leap 15.0 (i586 x86_64):
gnutls-3.6.7-lp150.12.1
gnutls-debuginfo-3.6.7-lp150.12.1
gnutls-debugsource-3.6.7-lp150.12.1
gnutls-guile-3.6.7-lp150.12.1
gnutls-guile-debuginfo-3.6.7-lp150.12.1
libgnutls-dane-devel-3.6.7-lp150.12.1
libgnutls-dane0-3.6.7-lp150.12.1
libgnutls-dane0-debuginfo-3.6.7-lp150.12.1
libgnutls-devel-3.6.7-lp150.12.1
libgnutls30-3.6.7-lp150.12.1
libgnutls30-debuginfo-3.6.7-lp150.12.1
libgnutlsxx-devel-3.6.7-lp150.12.1
libgnutlsxx28-3.6.7-lp150.12.1
libgnutlsxx28-debuginfo-3.6.7-lp150.12.1
- openSUSE Leap 15.0 (x86_64):
libgnutls-devel-32bit-3.6.7-lp150.12.1
libgnutls30-32bit-3.6.7-lp150.12.1
libgnutls30-32bit-debuginfo-3.6.7-lp150.12.1
References:
https://www.suse.com/security/cve/CVE-2018-16868.html
https://bugzilla.suse.com/1118087
https://bugzilla.suse.com/1134856
--
