The following security updates has been released for openSUSE:

openSUSE-SU-2019:1844-1: important: Security update for osc
openSUSE-SU-2019:1845-1: moderate: Security update for zstd
openSUSE-SU-2019:1846-1: important: Security update for nodejs10
openSUSE-SU-2019:1848-1: important: Security update for chromium
openSUSE-SU-2019:1849-1: important: Security update for chromium

openSUSE-SU-2019:1844-1: important: Security update for osc

openSUSE Security Update: Security update for osc
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1844-1
Rating: important
References: #1129889 #1138977 #1140697 #1142518 #1142662
#1144211
Cross-References: CVE-2019-3685
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that solves one vulnerability and has 5 fixes is
now available.

Description:

This update for osc to version 0.165.4 fixes the following issues:

Security issue fixed:

- CVE-2019-3685: Fixed broken TLS certificate handling allowing for a
Man-in-the-middle attack (bsc#1142518).

Non-security issues fixed:

- support different token operations (runservice, release and rebuild)
(requires OBS 2.10)
- fix osc token decode error
- offline build mode is now really offline and does not try to download
the buildconfig
- osc build -define now works with python3
- fixes an issue where the error message on osc meta -e was not parsed
correctly
- osc maintainer -s now works with python3
- simplified and fixed osc meta -e (bsc#1138977)
- osc lbl now works with non utf8 encoding (bsc#1129889)
- add simpleimage as local build type
- allow optional fork when creating a maintenance request
- fix RPMError fallback
- fix local caching for all package formats
- fix appname for trusted cert store
- osc -h does not break anymore when using plugins
- switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing.
This will fix all decoding issues with osc diff, osc ci and osc rq -d
- fix osc ls -lb handling empty size and mtime
- removed decoding on osc api command.

This update was imported from the SUSE:SLE-15-SP1:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-1844=1



Package List:

- openSUSE Leap 15.1 (noarch):

osc-0.165.4-lp151.2.6.1


References:

https://www.suse.com/security/cve/CVE-2019-3685.html
https://bugzilla.suse.com/1129889
https://bugzilla.suse.com/1138977
https://bugzilla.suse.com/1140697
https://bugzilla.suse.com/1142518
https://bugzilla.suse.com/1142662
https://bugzilla.suse.com/1144211

--

openSUSE-SU-2019:1845-1: moderate: Security update for zstd

openSUSE Security Update: Security update for zstd
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1845-1
Rating: moderate
References: #1082318 #1133297 #1142941
Cross-References: CVE-2019-11922
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that solves one vulnerability and has two fixes
is now available.

Description:

This update for zstd to version 1.4.2 fixes the following issues:

Security issues fixed:

- CVE-2019-11922: Fixed race condition in one-pass compression functions
that could allow out of bounds write (boo#1142941).

Non-security issues fixed:

- Added --[no-]compress-literals CLI flag to enable or disable literal
compression.
- Added new --rsyncable mode.
- Added handling of -f flag to zstdgrep.
- Added CPU load indicator for each file on -vv mode.
- Changed --no-progress flag to preserve the final summary.
- Added new command --adapt for compressed network piping of data adjusted
to the perceived network conditions.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-1845=1



Package List:

- openSUSE Leap 15.1 (i586 x86_64):

libzstd-devel-1.4.2-lp151.3.3.1
libzstd-devel-static-1.4.2-lp151.3.3.1
libzstd1-1.4.2-lp151.3.3.1
libzstd1-debuginfo-1.4.2-lp151.3.3.1
zstd-1.4.2-lp151.3.3.1
zstd-debuginfo-1.4.2-lp151.3.3.1
zstd-debugsource-1.4.2-lp151.3.3.1

- openSUSE Leap 15.1 (x86_64):

libzstd1-32bit-1.4.2-lp151.3.3.1
libzstd1-32bit-debuginfo-1.4.2-lp151.3.3.1


References:

https://www.suse.com/security/cve/CVE-2019-11922.html
https://bugzilla.suse.com/1082318
https://bugzilla.suse.com/1133297
https://bugzilla.suse.com/1142941

--

openSUSE-SU-2019:1846-1: important: Security update for nodejs10

openSUSE Security Update: Security update for nodejs10
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1846-1
Rating: important
References: #1134208 #1140290
Cross-References: CVE-2019-13173
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for nodejs10 to version 10.16.0 fixes the following issues:

Security issue fixed:

- CVE-2019-13173: Fixed a potential file overwrite via hardlink in
fstream.DirWriter() (bsc#1140290).

Non-security issue fixed:

- Update to new upstream LTS version 10.16.0, including npm version 6.9.0
and openssl version 1.1.1b (bsc#1134208).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-1846=1



Package List:

- openSUSE Leap 15.1 (i586 x86_64):

nodejs10-10.16.0-lp151.2.3.1
nodejs10-debuginfo-10.16.0-lp151.2.3.1
nodejs10-debugsource-10.16.0-lp151.2.3.1
nodejs10-devel-10.16.0-lp151.2.3.1
npm10-10.16.0-lp151.2.3.1

- openSUSE Leap 15.1 (noarch):

nodejs10-docs-10.16.0-lp151.2.3.1


References:

https://www.suse.com/security/cve/CVE-2019-13173.html
https://bugzilla.suse.com/1134208
https://bugzilla.suse.com/1140290

--

openSUSE-SU-2019:1848-1: important: Security update for chromium

openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1848-1
Rating: important
References: #1143492 #1144625
Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852
CVE-2019-5853 CVE-2019-5854 CVE-2019-5855
CVE-2019-5856 CVE-2019-5857 CVE-2019-5858
CVE-2019-5859 CVE-2019-5860 CVE-2019-5861
CVE-2019-5862 CVE-2019-5863 CVE-2019-5864
CVE-2019-5865
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes 16 vulnerabilities is now available.

Description:

This update for chromium to version 76.0.3809.87 fixes the following
issues:

- CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492)
- CVE-2019-5860: Use-after-free in PDFium (boo#1143492)
- CVE-2019-5853: Memory corruption in regexp length check (boo#1143492)
- CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492)
- CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492)
- CVE-2019-5856: Insufficient checks on filesystem: URI permissions
(boo#1143492)
- CVE-2019-5855: Integer overflow in PDFium (boo#1143492)
- CVE-2019-5865: Site isolation bypass from compromised renderer
(boo#1143492)
- CVE-2019-5858: Insufficient filtering of Open URL service parameters
(boo#1143492)
- CVE-2019-5864: Insufficient port filtering in CORS for extensions
(boo#1143492)
- CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492)
- CVE-2019-5861: Click location incorrectly checked (boo#1143492)
- CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492)
- CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492)
- CVE-2019-5852: Object leak of utility functions (boo#1143492)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-1848=1



Package List:

- openSUSE Leap 15.0 (x86_64):

chromedriver-76.0.3809.87-lp150.224.1
chromedriver-debuginfo-76.0.3809.87-lp150.224.1
chromium-76.0.3809.87-lp150.224.1
chromium-debuginfo-76.0.3809.87-lp150.224.1
chromium-debugsource-76.0.3809.87-lp150.224.1


References:

https://www.suse.com/security/cve/CVE-2019-5850.html
https://www.suse.com/security/cve/CVE-2019-5851.html
https://www.suse.com/security/cve/CVE-2019-5852.html
https://www.suse.com/security/cve/CVE-2019-5853.html
https://www.suse.com/security/cve/CVE-2019-5854.html
https://www.suse.com/security/cve/CVE-2019-5855.html
https://www.suse.com/security/cve/CVE-2019-5856.html
https://www.suse.com/security/cve/CVE-2019-5857.html
https://www.suse.com/security/cve/CVE-2019-5858.html
https://www.suse.com/security/cve/CVE-2019-5859.html
https://www.suse.com/security/cve/CVE-2019-5860.html
https://www.suse.com/security/cve/CVE-2019-5861.html
https://www.suse.com/security/cve/CVE-2019-5862.html
https://www.suse.com/security/cve/CVE-2019-5863.html
https://www.suse.com/security/cve/CVE-2019-5864.html
https://www.suse.com/security/cve/CVE-2019-5865.html
https://bugzilla.suse.com/1143492
https://bugzilla.suse.com/1144625

--

openSUSE-SU-2019:1849-1: important: Security update for chromium

openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:1849-1
Rating: important
References: #1143492 #1144625
Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852
CVE-2019-5853 CVE-2019-5854 CVE-2019-5855
CVE-2019-5856 CVE-2019-5857 CVE-2019-5858
CVE-2019-5859 CVE-2019-5860 CVE-2019-5861
CVE-2019-5862 CVE-2019-5863 CVE-2019-5864
CVE-2019-5865
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that fixes 16 vulnerabilities is now available.

Description:

This update for chromium to version 76.0.3809.87 fixes the following
issues:

- CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492)
- CVE-2019-5860: Use-after-free in PDFium (boo#1143492)
- CVE-2019-5853: Memory corruption in regexp length check (boo#1143492)
- CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492)
- CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492)
- CVE-2019-5856: Insufficient checks on filesystem: URI permissions
(boo#1143492)
- CVE-2019-5855: Integer overflow in PDFium (boo#1143492)
- CVE-2019-5865: Site isolation bypass from compromised renderer
(boo#1143492)
- CVE-2019-5858: Insufficient filtering of Open URL service parameters
(boo#1143492)
- CVE-2019-5864: Insufficient port filtering in CORS for extensions
(boo#1143492)
- CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492)
- CVE-2019-5861: Click location incorrectly checked (boo#1143492)
- CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492)
- CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492)
- CVE-2019-5852: Object leak of utility functions (boo#1143492)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-1849=1



Package List:

- openSUSE Leap 15.1 (x86_64):

chromedriver-76.0.3809.87-lp151.2.15.1
chromedriver-debuginfo-76.0.3809.87-lp151.2.15.1
chromium-76.0.3809.87-lp151.2.15.1
chromium-debuginfo-76.0.3809.87-lp151.2.15.1
chromium-debugsource-76.0.3809.87-lp151.2.15.1


References:

https://www.suse.com/security/cve/CVE-2019-5850.html
https://www.suse.com/security/cve/CVE-2019-5851.html
https://www.suse.com/security/cve/CVE-2019-5852.html
https://www.suse.com/security/cve/CVE-2019-5853.html
https://www.suse.com/security/cve/CVE-2019-5854.html
https://www.suse.com/security/cve/CVE-2019-5855.html
https://www.suse.com/security/cve/CVE-2019-5856.html
https://www.suse.com/security/cve/CVE-2019-5857.html
https://www.suse.com/security/cve/CVE-2019-5858.html
https://www.suse.com/security/cve/CVE-2019-5859.html
https://www.suse.com/security/cve/CVE-2019-5860.html
https://www.suse.com/security/cve/CVE-2019-5861.html
https://www.suse.com/security/cve/CVE-2019-5862.html
https://www.suse.com/security/cve/CVE-2019-5863.html
https://www.suse.com/security/cve/CVE-2019-5864.html
https://www.suse.com/security/cve/CVE-2019-5865.html
https://bugzilla.suse.com/1143492
https://bugzilla.suse.com/1144625

--