The following security updates has been released for openSUSE:
openSUSE-SU-2019:1532-1: important: Security update for bind
openSUSE-SU-2019:1533-1: important: Security update for bind
openSUSE-SU-2019:1534-1: important: Security update for MozillaFirefox
openSUSE-SU-2019:1535-1: moderate: Security update for bubblewrap
openSUSE-SU-2019:1532-1: important: Security update for bind
openSUSE-SU-2019:1533-1: important: Security update for bind
openSUSE-SU-2019:1534-1: important: Security update for MozillaFirefox
openSUSE-SU-2019:1535-1: moderate: Security update for bubblewrap
openSUSE-SU-2019:1532-1: important: Security update for bind
openSUSE Security Update: Security update for bind
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1532-1
Rating: important
References: #1104129 #1126068 #1126069 #1133185
Cross-References: CVE-2018-5740 CVE-2018-5743 CVE-2018-5745
CVE-2019-6465
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for bind fixes the following issues:
Security issues fixed:
- CVE-2018-5740: Fixed a denial of service vulnerability in the
"deny-answer-aliases" feature (bsc#1104129).
- CVE-2019-6465: Fixed an issue where controls for zone transfers may not
be properly applied to Dynamically Loadable Zones (bsc#1126069).
- CVE-2018-5745: An assertion failure can occur if a trust anchor rolls
over to an unsupported key algorithm when using managed-keys.
(bsc#1126068)
- CVE-2018-5743: Limiting simultaneous TCP clients is ineffective.
(bsc#1133185)
This update was imported from the SUSE:SLE-12-SP1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2019-1532=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
bind-9.9.9P1-56.1
bind-chrootenv-9.9.9P1-56.1
bind-debuginfo-9.9.9P1-56.1
bind-debugsource-9.9.9P1-56.1
bind-devel-9.9.9P1-56.1
bind-libs-9.9.9P1-56.1
bind-libs-debuginfo-9.9.9P1-56.1
bind-lwresd-9.9.9P1-56.1
bind-lwresd-debuginfo-9.9.9P1-56.1
bind-utils-9.9.9P1-56.1
bind-utils-debuginfo-9.9.9P1-56.1
- openSUSE Leap 42.3 (x86_64):
bind-libs-32bit-9.9.9P1-56.1
bind-libs-debuginfo-32bit-9.9.9P1-56.1
- openSUSE Leap 42.3 (noarch):
bind-doc-9.9.9P1-56.1
References:
https://www.suse.com/security/cve/CVE-2018-5740.html
https://www.suse.com/security/cve/CVE-2018-5743.html
https://www.suse.com/security/cve/CVE-2018-5745.html
https://www.suse.com/security/cve/CVE-2019-6465.html
https://bugzilla.suse.com/1104129
https://bugzilla.suse.com/1126068
https://bugzilla.suse.com/1126069
https://bugzilla.suse.com/1133185
--
openSUSE-SU-2019:1533-1: important: Security update for bind
openSUSE Security Update: Security update for bind
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1533-1
Rating: important
References: #1104129 #1126068 #1126069 #1133185
Cross-References: CVE-2018-5740 CVE-2018-5743 CVE-2018-5745
CVE-2019-6465
Affected Products:
openSUSE Leap 15.1
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for bind fixes the following issues:
Security issues fixed:
- CVE-2019-6465: Fixed an issue where controls for zone transfers may not
be properly applied to Dynamically Loadable Zones (bsc#1126069).
- CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor
rolls over to an unsupported key algorithm when using managed-keys
(bsc#1126068).
- CVE-2018-5743: Fixed a denial of service vulnerability which could be
caused by to many simultaneous TCP connections (bsc#1133185).
- CVE-2018-5740: Fixed a denial of service vulnerability in the
"deny-answer-aliases" feature (bsc#1104129).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1533=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1533=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
bind-9.11.2-lp151.11.3.1
bind-chrootenv-9.11.2-lp151.11.3.1
bind-debuginfo-9.11.2-lp151.11.3.1
bind-debugsource-9.11.2-lp151.11.3.1
bind-devel-9.11.2-lp151.11.3.1
bind-lwresd-9.11.2-lp151.11.3.1
bind-lwresd-debuginfo-9.11.2-lp151.11.3.1
bind-utils-9.11.2-lp151.11.3.1
bind-utils-debuginfo-9.11.2-lp151.11.3.1
libbind9-160-9.11.2-lp151.11.3.1
libbind9-160-debuginfo-9.11.2-lp151.11.3.1
libdns169-9.11.2-lp151.11.3.1
libdns169-debuginfo-9.11.2-lp151.11.3.1
libirs-devel-9.11.2-lp151.11.3.1
libirs160-9.11.2-lp151.11.3.1
libirs160-debuginfo-9.11.2-lp151.11.3.1
libisc166-9.11.2-lp151.11.3.1
libisc166-debuginfo-9.11.2-lp151.11.3.1
libisccc160-9.11.2-lp151.11.3.1
libisccc160-debuginfo-9.11.2-lp151.11.3.1
libisccfg160-9.11.2-lp151.11.3.1
libisccfg160-debuginfo-9.11.2-lp151.11.3.1
liblwres160-9.11.2-lp151.11.3.1
liblwres160-debuginfo-9.11.2-lp151.11.3.1
- openSUSE Leap 15.1 (x86_64):
bind-devel-32bit-9.11.2-lp151.11.3.1
libbind9-160-32bit-9.11.2-lp151.11.3.1
libbind9-160-32bit-debuginfo-9.11.2-lp151.11.3.1
libdns169-32bit-9.11.2-lp151.11.3.1
libdns169-32bit-debuginfo-9.11.2-lp151.11.3.1
libirs160-32bit-9.11.2-lp151.11.3.1
libirs160-32bit-debuginfo-9.11.2-lp151.11.3.1
libisc166-32bit-9.11.2-lp151.11.3.1
libisc166-32bit-debuginfo-9.11.2-lp151.11.3.1
libisccc160-32bit-9.11.2-lp151.11.3.1
libisccc160-32bit-debuginfo-9.11.2-lp151.11.3.1
libisccfg160-32bit-9.11.2-lp151.11.3.1
libisccfg160-32bit-debuginfo-9.11.2-lp151.11.3.1
liblwres160-32bit-9.11.2-lp151.11.3.1
liblwres160-32bit-debuginfo-9.11.2-lp151.11.3.1
- openSUSE Leap 15.1 (noarch):
bind-doc-9.11.2-lp151.11.3.1
python3-bind-9.11.2-lp151.11.3.1
- openSUSE Leap 15.0 (i586 x86_64):
bind-9.11.2-lp150.8.13.1
bind-chrootenv-9.11.2-lp150.8.13.1
bind-debuginfo-9.11.2-lp150.8.13.1
bind-debugsource-9.11.2-lp150.8.13.1
bind-devel-9.11.2-lp150.8.13.1
bind-lwresd-9.11.2-lp150.8.13.1
bind-lwresd-debuginfo-9.11.2-lp150.8.13.1
bind-utils-9.11.2-lp150.8.13.1
bind-utils-debuginfo-9.11.2-lp150.8.13.1
libbind9-160-9.11.2-lp150.8.13.1
libbind9-160-debuginfo-9.11.2-lp150.8.13.1
libdns169-9.11.2-lp150.8.13.1
libdns169-debuginfo-9.11.2-lp150.8.13.1
libirs-devel-9.11.2-lp150.8.13.1
libirs160-9.11.2-lp150.8.13.1
libirs160-debuginfo-9.11.2-lp150.8.13.1
libisc166-9.11.2-lp150.8.13.1
libisc166-debuginfo-9.11.2-lp150.8.13.1
libisccc160-9.11.2-lp150.8.13.1
libisccc160-debuginfo-9.11.2-lp150.8.13.1
libisccfg160-9.11.2-lp150.8.13.1
libisccfg160-debuginfo-9.11.2-lp150.8.13.1
liblwres160-9.11.2-lp150.8.13.1
liblwres160-debuginfo-9.11.2-lp150.8.13.1
- openSUSE Leap 15.0 (noarch):
bind-doc-9.11.2-lp150.8.13.1
python3-bind-9.11.2-lp150.8.13.1
- openSUSE Leap 15.0 (x86_64):
bind-devel-32bit-9.11.2-lp150.8.13.1
libbind9-160-32bit-9.11.2-lp150.8.13.1
libbind9-160-32bit-debuginfo-9.11.2-lp150.8.13.1
libdns169-32bit-9.11.2-lp150.8.13.1
libdns169-32bit-debuginfo-9.11.2-lp150.8.13.1
libirs160-32bit-9.11.2-lp150.8.13.1
libirs160-32bit-debuginfo-9.11.2-lp150.8.13.1
libisc166-32bit-9.11.2-lp150.8.13.1
libisc166-32bit-debuginfo-9.11.2-lp150.8.13.1
libisccc160-32bit-9.11.2-lp150.8.13.1
libisccc160-32bit-debuginfo-9.11.2-lp150.8.13.1
libisccfg160-32bit-9.11.2-lp150.8.13.1
libisccfg160-32bit-debuginfo-9.11.2-lp150.8.13.1
liblwres160-32bit-9.11.2-lp150.8.13.1
liblwres160-32bit-debuginfo-9.11.2-lp150.8.13.1
References:
https://www.suse.com/security/cve/CVE-2018-5740.html
https://www.suse.com/security/cve/CVE-2018-5743.html
https://www.suse.com/security/cve/CVE-2018-5745.html
https://www.suse.com/security/cve/CVE-2019-6465.html
https://bugzilla.suse.com/1104129
https://bugzilla.suse.com/1126068
https://bugzilla.suse.com/1126069
https://bugzilla.suse.com/1133185
--
openSUSE-SU-2019:1534-1: important: Security update for MozillaFirefox
openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1534-1
Rating: important
References: #1135824
Cross-References: CVE-2018-18511 CVE-2019-11691 CVE-2019-11692
CVE-2019-11693 CVE-2019-11694 CVE-2019-11698
CVE-2019-5798 CVE-2019-7317 CVE-2019-9797
CVE-2019-9800 CVE-2019-9815 CVE-2019-9816
CVE-2019-9817 CVE-2019-9818 CVE-2019-9819
CVE-2019-9820 CVE-2019-9821
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes 17 vulnerabilities is now available.
Description:
This update for MozillaFirefox fixes the following issues:
MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14):
* CVE-2018-18511: Cross-origin theft of images with
ImageBitmapRenderingContext
* CVE-2019-11691: Use-after-free in XMLHttpRequest
* CVE-2019-11692: Use-after-free removing listeners in the event listener
manager
* CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
* CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in
Windows sandbox
* CVE-2019-11698: Theft of user history data through drag and drop of
hyperlinks to and from bookmarks
* CVE-2019-5798: Out-of-bounds read in Skia
* CVE-2019-7317: Use-after-free in png_image_free of libpng library
* CVE-2019-9797: Cross-origin theft of images with createImageBitmap
* CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR
60.7
* CVE-2019-9815: Disable hyperthreading on content JavaScript threads on
macOS
* CVE-2019-9816: Type confusion with object groups and UnboxedObjects
* CVE-2019-9817: Stealing of cross-domain images using canvas
* CVE-2019-9818: (Windows only) Use-after-free in crash generation server
* CVE-2019-9819: Compartment mismatch with fetch API
* CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
* CVE-2019-9821: Use-after-free in AssertWorkerThread
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2019-1534=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2019-1534=1
Package List:
- openSUSE Leap 42.3 (x86_64):
MozillaFirefox-60.7.0-145.2
MozillaFirefox-branding-upstream-60.7.0-145.2
MozillaFirefox-buildsymbols-60.7.0-145.2
MozillaFirefox-debuginfo-60.7.0-145.2
MozillaFirefox-debugsource-60.7.0-145.2
MozillaFirefox-devel-60.7.0-145.2
MozillaFirefox-translations-common-60.7.0-145.2
MozillaFirefox-translations-other-60.7.0-145.2
- openSUSE Leap 15.0 (x86_64):
MozillaFirefox-60.7.0-lp150.3.54.5
MozillaFirefox-branding-upstream-60.7.0-lp150.3.54.5
MozillaFirefox-buildsymbols-60.7.0-lp150.3.54.5
MozillaFirefox-debuginfo-60.7.0-lp150.3.54.5
MozillaFirefox-debugsource-60.7.0-lp150.3.54.5
MozillaFirefox-devel-60.7.0-lp150.3.54.5
MozillaFirefox-translations-common-60.7.0-lp150.3.54.5
MozillaFirefox-translations-other-60.7.0-lp150.3.54.5
References:
https://www.suse.com/security/cve/CVE-2018-18511.html
https://www.suse.com/security/cve/CVE-2019-11691.html
https://www.suse.com/security/cve/CVE-2019-11692.html
https://www.suse.com/security/cve/CVE-2019-11693.html
https://www.suse.com/security/cve/CVE-2019-11694.html
https://www.suse.com/security/cve/CVE-2019-11698.html
https://www.suse.com/security/cve/CVE-2019-5798.html
https://www.suse.com/security/cve/CVE-2019-7317.html
https://www.suse.com/security/cve/CVE-2019-9797.html
https://www.suse.com/security/cve/CVE-2019-9800.html
https://www.suse.com/security/cve/CVE-2019-9815.html
https://www.suse.com/security/cve/CVE-2019-9816.html
https://www.suse.com/security/cve/CVE-2019-9817.html
https://www.suse.com/security/cve/CVE-2019-9818.html
https://www.suse.com/security/cve/CVE-2019-9819.html
https://www.suse.com/security/cve/CVE-2019-9820.html
https://www.suse.com/security/cve/CVE-2019-9821.html
https://bugzilla.suse.com/1135824
--
openSUSE-SU-2019:1535-1: moderate: Security update for bubblewrap
openSUSE Security Update: Security update for bubblewrap
______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:1535-1
Rating: moderate
References: #1136958
Cross-References: CVE-2019-12439
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for bubblewrap to version 0.3.3 fixes the following issue:
Security issue fixed:
- CVE-2019-12439: Fixed a temporary directory misuse as mount point which
could have allowed local user to prevent others from running bubblewrap.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-1535=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
bubblewrap-0.3.3-lp151.2.3.1
bubblewrap-debuginfo-0.3.3-lp151.2.3.1
bubblewrap-debugsource-0.3.3-lp151.2.3.1
References:
https://www.suse.com/security/cve/CVE-2019-12439.html
https://bugzilla.suse.com/1136958
--
