openSUSE-SU-2019:0089-1: important: Security update for nodejs8

openSUSE Security Update: Security update for nodejs8
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0089-1
Rating: important
References: #1117626 #1117627 #1117629 #1117630
Cross-References: CVE-2018-12116 CVE-2018-12121 CVE-2018-12122
CVE-2018-12123
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for nodejs8 to version 8.15.0 fixes the following issues:

Security issues fixed:

- CVE-2018-12121: Fixed a Denial of Service with large HTTP headers
(bsc#1117626)
- CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service
(bsc#1117627)
- CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)
- CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript
protocol (bsc#1117629)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-89=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

nodejs8-8.15.0-lp150.2.9.1
nodejs8-debuginfo-8.15.0-lp150.2.9.1
nodejs8-debugsource-8.15.0-lp150.2.9.1
nodejs8-devel-8.15.0-lp150.2.9.1
npm8-8.15.0-lp150.2.9.1

- openSUSE Leap 15.0 (noarch):

nodejs8-docs-8.15.0-lp150.2.9.1


References:

https://www.suse.com/security/cve/CVE-2018-12116.html
https://www.suse.com/security/cve/CVE-2018-12121.html
https://www.suse.com/security/cve/CVE-2018-12122.html
https://www.suse.com/security/cve/CVE-2018-12123.html
https://bugzilla.suse.com/1117626
https://bugzilla.suse.com/1117627
https://bugzilla.suse.com/1117629
https://bugzilla.suse.com/1117630

--

openSUSE-SU-2019:0090-1: moderate: Security update for PackageKit

openSUSE Security Update: Security update for PackageKit
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0090-1
Rating: moderate
References: #1038425
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that contains security fixes can now be installed.

Description:

This update for PackageKit fixes the following issues:

- Fixed displaying the license agreement pop up window during package
update (bsc#1038425).

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-90=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

PackageKit-1.1.3-5.6.1
PackageKit-backend-zypp-1.1.3-5.6.1
PackageKit-backend-zypp-debuginfo-1.1.3-5.6.1
PackageKit-debuginfo-1.1.3-5.6.1
PackageKit-debugsource-1.1.3-5.6.1
PackageKit-devel-1.1.3-5.6.1
PackageKit-devel-debuginfo-1.1.3-5.6.1
PackageKit-gstreamer-plugin-1.1.3-5.6.1
PackageKit-gstreamer-plugin-debuginfo-1.1.3-5.6.1
PackageKit-gtk3-module-1.1.3-5.6.1
PackageKit-gtk3-module-debuginfo-1.1.3-5.6.1
libpackagekit-glib2-18-1.1.3-5.6.1
libpackagekit-glib2-18-debuginfo-1.1.3-5.6.1
libpackagekit-glib2-devel-1.1.3-5.6.1
typelib-1_0-PackageKitGlib-1_0-1.1.3-5.6.1

- openSUSE Leap 42.3 (x86_64):

libpackagekit-glib2-18-32bit-1.1.3-5.6.1
libpackagekit-glib2-18-debuginfo-32bit-1.1.3-5.6.1
libpackagekit-glib2-devel-32bit-1.1.3-5.6.1

- openSUSE Leap 42.3 (noarch):

PackageKit-branding-upstream-1.1.3-5.6.1
PackageKit-lang-1.1.3-5.6.1


References:

https://bugzilla.suse.com/1038425

--

openSUSE-SU-2019:0091-1: important: Security update for openssh

openSUSE Security Update: Security update for openssh
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0091-1
Rating: important
References: #1121571 #1121816 #1121818 #1121821
Cross-References: CVE-2018-20685 CVE-2019-6109 CVE-2019-6110
CVE-2019-6111
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for openssh fixes the following issues:

Security issues fixed:

- CVE-2018-20685: Fixed an issue where scp client allows remote SSH
servers to bypass intended access restrictions (bsc#1121571)
- CVE-2019-6109: Fixed an issue where the scp client would allow malicious
remote SSH servers to manipulate terminal output via the object name,
e.g. by inserting ANSI escape sequences (bsc#1121816)
- CVE-2019-6110: Fixed an issue where the scp client would allow malicious
remote SSH servers to manipulate stderr output, e.g. by inserting ANSI
escape sequences (bsc#1121818)
- CVE-2019-6111: Fixed an issue where the scp client would allow malicious
remote SSH servers to execute directory traversal attacks and overwrite
files (bsc#1121821)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-91=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

openssh-7.6p1-lp150.8.9.1
openssh-cavs-7.6p1-lp150.8.9.1
openssh-cavs-debuginfo-7.6p1-lp150.8.9.1
openssh-debuginfo-7.6p1-lp150.8.9.1
openssh-debugsource-7.6p1-lp150.8.9.1
openssh-fips-7.6p1-lp150.8.9.1
openssh-helpers-7.6p1-lp150.8.9.1
openssh-helpers-debuginfo-7.6p1-lp150.8.9.1

- openSUSE Leap 15.0 (x86_64):

openssh-askpass-gnome-7.6p1-lp150.8.9.1
openssh-askpass-gnome-debuginfo-7.6p1-lp150.8.9.1


References:

https://www.suse.com/security/cve/CVE-2018-20685.html
https://www.suse.com/security/cve/CVE-2019-6109.html
https://www.suse.com/security/cve/CVE-2019-6110.html
https://www.suse.com/security/cve/CVE-2019-6111.html
https://bugzilla.suse.com/1121571
https://bugzilla.suse.com/1121816
https://bugzilla.suse.com/1121818
https://bugzilla.suse.com/1121821

--

openSUSE-SU-2019:0092-1: moderate: Security update for wireshark

openSUSE Security Update: Security update for wireshark
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0092-1
Rating: moderate
References: #1121232 #1121233 #1121234 #1121235
Cross-References: CVE-2019-5717 CVE-2019-5718 CVE-2019-5719
CVE-2019-5721
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for wireshark to version 2.4.12 fixes the following issues:

Security issues fixed:

- CVE-2019-5717: Fixed a denial of service in the P_MUL dissector
(bsc#1121232)
- CVE-2019-5718: Fixed a denial of service in the RTSE dissector and other
dissectors (bsc#1121233)
- CVE-2019-5719: Fixed a denial of service in the ISAKMP dissector
(bsc#1121234)
- CVE-2019-5721: Fixed a denial of service in the ISAKMP dissector
(bsc#1121235)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-92=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libwireshark9-2.4.12-lp150.2.19.1
libwireshark9-debuginfo-2.4.12-lp150.2.19.1
libwiretap7-2.4.12-lp150.2.19.1
libwiretap7-debuginfo-2.4.12-lp150.2.19.1
libwscodecs1-2.4.12-lp150.2.19.1
libwscodecs1-debuginfo-2.4.12-lp150.2.19.1
libwsutil8-2.4.12-lp150.2.19.1
libwsutil8-debuginfo-2.4.12-lp150.2.19.1
wireshark-2.4.12-lp150.2.19.1
wireshark-debuginfo-2.4.12-lp150.2.19.1
wireshark-debugsource-2.4.12-lp150.2.19.1
wireshark-devel-2.4.12-lp150.2.19.1
wireshark-ui-qt-2.4.12-lp150.2.19.1
wireshark-ui-qt-debuginfo-2.4.12-lp150.2.19.1


References:

https://www.suse.com/security/cve/CVE-2019-5717.html
https://www.suse.com/security/cve/CVE-2019-5718.html
https://www.suse.com/security/cve/CVE-2019-5719.html
https://www.suse.com/security/cve/CVE-2019-5721.html
https://bugzilla.suse.com/1121232
https://bugzilla.suse.com/1121233
https://bugzilla.suse.com/1121234
https://bugzilla.suse.com/1121235

--