The following updates has been released for openSUSE:

openSUSE-SU-2019:0173-1: important: Security update for curl
openSUSE-SU-2019:0174-1: important: Security update for curl
openSUSE-SU-2019:0175-1: moderate: Security update for lua53
openSUSE-SU-2019:0176-1: important: Security update for spice
openSUSE-SU-2019:0182-1: important: Security update for MozillaThunderbird
openSUSE-SU-2019:0183-1: important: Security update for mozilla-nss
openSUSE-SU-2019:0184-1: moderate: Security update for python
openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server

openSUSE-SU-2019:0173-1: important: Security update for curl

openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0173-1
Rating: important
References: #1123371 #1123377 #1123378
Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823

Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for curl fixes the following issues:

Security issues fixed:

- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the
end-of-response for SMTP (bsc#1123378).
- CVE-2019-3822: Fixed a stack based buffer overflow in the function
creating an outgoing NTLM type-3 message (bsc#1123377).
- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function
handling incoming NTLM type-2 messages (bsc#1123371).

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-173=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

curl-7.37.0-45.1
curl-debuginfo-7.37.0-45.1
curl-debugsource-7.37.0-45.1
libcurl-devel-7.37.0-45.1
libcurl4-7.37.0-45.1
libcurl4-debuginfo-7.37.0-45.1

- openSUSE Leap 42.3 (x86_64):

libcurl-devel-32bit-7.37.0-45.1
libcurl4-32bit-7.37.0-45.1
libcurl4-debuginfo-32bit-7.37.0-45.1


References:

https://www.suse.com/security/cve/CVE-2018-16890.html
https://www.suse.com/security/cve/CVE-2019-3822.html
https://www.suse.com/security/cve/CVE-2019-3823.html
https://bugzilla.suse.com/1123371
https://bugzilla.suse.com/1123377
https://bugzilla.suse.com/1123378

--

openSUSE-SU-2019:0174-1: important: Security update for curl

openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0174-1
Rating: important
References: #1123371 #1123377 #1123378
Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823

Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for curl fixes the following issues:

Security issues fixed:

- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the
end-of-response for SMTP (bsc#1123378).
- CVE-2019-3822: Fixed a stack based buffer overflow in the function
creating an outgoing NTLM type-3 message (bsc#1123377).
- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function
handling incoming NTLM type-2 messages (bsc#1123371).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-174=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

curl-7.60.0-lp150.2.18.1
curl-debuginfo-7.60.0-lp150.2.18.1
curl-debugsource-7.60.0-lp150.2.18.1
curl-mini-7.60.0-lp150.2.18.1
curl-mini-debuginfo-7.60.0-lp150.2.18.1
curl-mini-debugsource-7.60.0-lp150.2.18.1
libcurl-devel-7.60.0-lp150.2.18.1
libcurl-mini-devel-7.60.0-lp150.2.18.1
libcurl4-7.60.0-lp150.2.18.1
libcurl4-debuginfo-7.60.0-lp150.2.18.1
libcurl4-mini-7.60.0-lp150.2.18.1
libcurl4-mini-debuginfo-7.60.0-lp150.2.18.1

- openSUSE Leap 15.0 (x86_64):

libcurl-devel-32bit-7.60.0-lp150.2.18.1
libcurl4-32bit-7.60.0-lp150.2.18.1
libcurl4-32bit-debuginfo-7.60.0-lp150.2.18.1


References:

https://www.suse.com/security/cve/CVE-2018-16890.html
https://www.suse.com/security/cve/CVE-2019-3822.html
https://www.suse.com/security/cve/CVE-2019-3823.html
https://bugzilla.suse.com/1123371
https://bugzilla.suse.com/1123377
https://bugzilla.suse.com/1123378

--

openSUSE-SU-2019:0175-1: moderate: Security update for lua53

openSUSE Security Update: Security update for lua53
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0175-1
Rating: moderate
References: #1123043
Cross-References: CVE-2019-6706
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for lua53 fixes the following issues:

Security issue fixed:

- CVE-2019-6706: Fixed a use-after-free bug in the lua_upvaluejoin
function of lapi.c (bsc#1123043)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-175=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

liblua5_3-5-5.3.4-lp150.2.3.1
liblua5_3-5-debuginfo-5.3.4-lp150.2.3.1
lua53-5.3.4-lp150.2.3.1
lua53-debuginfo-5.3.4-lp150.2.3.1
lua53-debugsource-5.3.4-lp150.2.3.1
lua53-devel-5.3.4-lp150.2.3.1

- openSUSE Leap 15.0 (noarch):

lua53-doc-5.3.4-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

liblua5_3-5-32bit-5.3.4-lp150.2.3.1
liblua5_3-5-32bit-debuginfo-5.3.4-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2019-6706.html
https://bugzilla.suse.com/1123043

--

openSUSE-SU-2019:0176-1: important: Security update for spice

openSUSE Security Update: Security update for spice
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0176-1
Rating: important
References: #1122706
Cross-References: CVE-2019-3813
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for spice fixes the following issues:

Security issue fixed:

- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt
function that could lead to denial-of-service or code-execution
(bsc#1122706).

This update was imported from the SUSE:SLE-12-SP3:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-176=1



Package List:

- openSUSE Leap 42.3 (x86_64):

libspice-server-devel-0.12.8-13.1
libspice-server1-0.12.8-13.1
libspice-server1-debuginfo-0.12.8-13.1
spice-debugsource-0.12.8-13.1


References:

https://www.suse.com/security/cve/CVE-2019-3813.html
https://bugzilla.suse.com/1122706

--

openSUSE-SU-2019:0182-1: important: Security update for MozillaThunderbird

openSUSE Security Update: Security update for MozillaThunderbird
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0182-1
Rating: important
References: #1122983
Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466
CVE-2018-18492 CVE-2018-18493 CVE-2018-18494
CVE-2018-18498 CVE-2018-18500 CVE-2018-18501
CVE-2018-18505
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes 10 vulnerabilities is now available.

Description:

This update for MozillaThunderbird to version 60.5.0 fixes the following
issues:

Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31):

- CVE-2018-18500: Use-after-free parsing HTML5 stream
- CVE-2018-18505: Privilege escalation through IPC channel messages
- CVE-2016-5824: DoS (use-after-free) via a crafted ics file
- CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR
60.5
- CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library
with TextureStorage11
- CVE-2018-18492: Use-after-free with select element
- CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
- CVE-2018-18494: Same-origin policy violation using location attribute
and performance.getEntries to steal cross-origin URLs
- CVE-2018-18498: Integer overflow when calculating buffer sizes for images
- CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and
Thunderbird 60.4

Other bugs fixed and changes made:

- FileLink provider WeTransfer to upload large attachments
- Thunderbird now allows the addition of OpenSearch search engines from a
local XML file using a minimal user inferface: [+] button to select a
file an add, [-] to remove.
- More search engines: Google and DuckDuckGo available by default in some
locales
- During account creation, Thunderbird will now detect servers using the
Microsoft Exchange protocol. It will offer the installation of a 3rd
party add-on (Owl) which supports that protocol.
- Thunderbird now compatible with other WebExtension-based FileLink
add-ons like the Dropbox add-on
- New WebExtensions FileLink API to facilitate add-ons
- Fix decoding problems for messages with less common charsets (cp932,
cp936)
- New messages in the drafts folder (and other special or virtual folders)
will no longer be included in the new messages notification
- Thunderbird 60 will migrate security databases (key3.db, cert8.db to
key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault
that potentially deleted saved passwords and private certificate keys
for users using a master password. Version 60.3.3 will prevent the loss
of data; affected users who have already upgraded to version 60.3.2 or
earlier can restore the deleted key3.db file from backup to complete the
migration.
- Address book search and auto-complete slowness introduced in Thunderbird
60.3.2
- Plain text markup with * for bold, / for italics, _ for underline and |
for code did not work when the enclosed text contained non-ASCII
characters
- While composing a message, a link not removed when link location was
removed in the link properties panel
- Encoding problems when exporting address books or messages using the
system charset. Messages are now always exported using the UTF-8 encoding
- If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was
displayed. Now using date from "Received" header instead.
- Body search/filtering didn't reliably ignore content of tags
- Inappropriate warning "Thunderbird prevented the site
(addons.thunderbird.net) from asking you to install software on your
computer" when installing add-ons
- Incorrect display of correspondents column since own email address was
not always detected
- Spurious (encoded newline) inserted into drafts and sent email
- Double-clicking on a word in the Write window sometimes launched the
Advanced Property Editor or Link Properties dialog
- Fixe Cookie removal
- "Download rest of message" was not working if global inbox was used
- Fix Encoding problems for users (especially in Poland) when a file was
sent via a folder using "Sent to > Mail recipient" due to a problem in
the Thunderbird MAPI interface
- According to RFC 4616 and RFC 5721, passwords containing non-ASCII
characters are encoded using UTF-8 which can lead to problems with
non-compliant providers, for example
office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods
are now using a Latin-1 encoding again to work around this issue
- Fix shutdown crash/hang after entering an empty IMAP password


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-182=1



Package List:

- openSUSE Leap 42.3 (x86_64):

MozillaThunderbird-60.5.0-83.1
MozillaThunderbird-buildsymbols-60.5.0-83.1
MozillaThunderbird-debuginfo-60.5.0-83.1
MozillaThunderbird-debugsource-60.5.0-83.1
MozillaThunderbird-translations-common-60.5.0-83.1
MozillaThunderbird-translations-other-60.5.0-83.1


References:

https://www.suse.com/security/cve/CVE-2016-5824.html
https://www.suse.com/security/cve/CVE-2018-12405.html
https://www.suse.com/security/cve/CVE-2018-17466.html
https://www.suse.com/security/cve/CVE-2018-18492.html
https://www.suse.com/security/cve/CVE-2018-18493.html
https://www.suse.com/security/cve/CVE-2018-18494.html
https://www.suse.com/security/cve/CVE-2018-18498.html
https://www.suse.com/security/cve/CVE-2018-18500.html
https://www.suse.com/security/cve/CVE-2018-18501.html
https://www.suse.com/security/cve/CVE-2018-18505.html
https://bugzilla.suse.com/1122983

--

openSUSE-SU-2019:0183-1: important: Security update for mozilla-nss

openSUSE Security Update: Security update for mozilla-nss
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0183-1
Rating: important
References: #1119069
Cross-References: CVE-2018-12404
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for mozilla-nss fixes the following issues:

Security issues fixed:

- CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack
(bsc#1119069).

Non-security issue fixed:

- Update to mozilla-nss 3.41.1

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-183=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libfreebl3-3.41.1-lp150.2.16.1
libfreebl3-debuginfo-3.41.1-lp150.2.16.1
libfreebl3-hmac-3.41.1-lp150.2.16.1
libsoftokn3-3.41.1-lp150.2.16.1
libsoftokn3-debuginfo-3.41.1-lp150.2.16.1
libsoftokn3-hmac-3.41.1-lp150.2.16.1
mozilla-nss-3.41.1-lp150.2.16.1
mozilla-nss-certs-3.41.1-lp150.2.16.1
mozilla-nss-certs-debuginfo-3.41.1-lp150.2.16.1
mozilla-nss-debuginfo-3.41.1-lp150.2.16.1
mozilla-nss-debugsource-3.41.1-lp150.2.16.1
mozilla-nss-devel-3.41.1-lp150.2.16.1
mozilla-nss-sysinit-3.41.1-lp150.2.16.1
mozilla-nss-sysinit-debuginfo-3.41.1-lp150.2.16.1
mozilla-nss-tools-3.41.1-lp150.2.16.1
mozilla-nss-tools-debuginfo-3.41.1-lp150.2.16.1

- openSUSE Leap 15.0 (x86_64):

libfreebl3-32bit-3.41.1-lp150.2.16.1
libfreebl3-32bit-debuginfo-3.41.1-lp150.2.16.1
libfreebl3-hmac-32bit-3.41.1-lp150.2.16.1
libsoftokn3-32bit-3.41.1-lp150.2.16.1
libsoftokn3-32bit-debuginfo-3.41.1-lp150.2.16.1
libsoftokn3-hmac-32bit-3.41.1-lp150.2.16.1
mozilla-nss-32bit-3.41.1-lp150.2.16.1
mozilla-nss-32bit-debuginfo-3.41.1-lp150.2.16.1
mozilla-nss-certs-32bit-3.41.1-lp150.2.16.1
mozilla-nss-certs-32bit-debuginfo-3.41.1-lp150.2.16.1
mozilla-nss-sysinit-32bit-3.41.1-lp150.2.16.1
mozilla-nss-sysinit-32bit-debuginfo-3.41.1-lp150.2.16.1


References:

https://www.suse.com/security/cve/CVE-2018-12404.html
https://bugzilla.suse.com/1119069

--

openSUSE-SU-2019:0184-1: moderate: Security update for python

openSUSE Security Update: Security update for python
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0184-1
Rating: moderate
References: #1122191
Cross-References: CVE-2019-5010
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for python fixes the following issues:

Security issue fixed:

- CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509
certificate parser (bsc#1122191)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-184=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libpython2_7-1_0-2.7.14-lp150.6.6.1
libpython2_7-1_0-debuginfo-2.7.14-lp150.6.6.1
python-2.7.14-lp150.6.6.1
python-base-2.7.14-lp150.6.6.1
python-base-debuginfo-2.7.14-lp150.6.6.1
python-base-debugsource-2.7.14-lp150.6.6.1
python-curses-2.7.14-lp150.6.6.1
python-curses-debuginfo-2.7.14-lp150.6.6.1
python-debuginfo-2.7.14-lp150.6.6.1
python-debugsource-2.7.14-lp150.6.6.1
python-demo-2.7.14-lp150.6.6.1
python-devel-2.7.14-lp150.6.6.1
python-gdbm-2.7.14-lp150.6.6.1
python-gdbm-debuginfo-2.7.14-lp150.6.6.1
python-idle-2.7.14-lp150.6.6.1
python-tk-2.7.14-lp150.6.6.1
python-tk-debuginfo-2.7.14-lp150.6.6.1
python-xml-2.7.14-lp150.6.6.1
python-xml-debuginfo-2.7.14-lp150.6.6.1

- openSUSE Leap 15.0 (x86_64):

libpython2_7-1_0-32bit-2.7.14-lp150.6.6.1
libpython2_7-1_0-32bit-debuginfo-2.7.14-lp150.6.6.1
python-32bit-2.7.14-lp150.6.6.1
python-32bit-debuginfo-2.7.14-lp150.6.6.1
python-base-32bit-2.7.14-lp150.6.6.1
python-base-32bit-debuginfo-2.7.14-lp150.6.6.1

- openSUSE Leap 15.0 (noarch):

python-doc-2.7.14-lp150.6.6.1
python-doc-pdf-2.7.14-lp150.6.6.1


References:

https://www.suse.com/security/cve/CVE-2019-5010.html
https://bugzilla.suse.com/1122191

--

openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server

openSUSE Security Update: Security update for rmt-server
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0185-1
Rating: moderate
References: #1102046 #1102193 #1109307 #1113760 #1113969
#1114831 #1117106 #1118579 #1118584
Cross-References: CVE-2018-14404 CVE-2018-16468 CVE-2018-16470

Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves three vulnerabilities and has 6 fixes
is now available.

Description:

This update for rmt-server to version 1.1.1 fixes the following issues:

The following issues have been fixed:

- Fixed migration problems which caused some extensions / modules to be
dropped (bsc#1118584, bsc#1118579)
- Fixed listing of mirrored products (bsc#1102193)
- Include online migration paths into offline migration (bsc#1117106)
- Sync products that do not have a base product (bsc#1109307)
- Fixed SLP auto discovery for RMT (bsc#1113760)

Update dependencies for security fixes:

- CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)
- CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)
- CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-185=1



Package List:

- openSUSE Leap 15.0 (x86_64):

rmt-server-1.1.1-lp150.2.12.1
rmt-server-debuginfo-1.1.1-lp150.2.12.1
rmt-server-pubcloud-1.1.1-lp150.2.12.1


References:

https://www.suse.com/security/cve/CVE-2018-14404.html
https://www.suse.com/security/cve/CVE-2018-16468.html
https://www.suse.com/security/cve/CVE-2018-16470.html
https://bugzilla.suse.com/1102046
https://bugzilla.suse.com/1102193
https://bugzilla.suse.com/1109307
https://bugzilla.suse.com/1113760
https://bugzilla.suse.com/1113969
https://bugzilla.suse.com/1114831
https://bugzilla.suse.com/1117106
https://bugzilla.suse.com/1118579
https://bugzilla.suse.com/1118584

--