The following SUSE updates has been released:

openSUSE-SU-2019:2276-1: moderate: Security update for putty
openSUSE-SU-2019:2277-1: moderate: Security update for putty
openSUSE-SU-2019:2278-1: important: Security update for dovecot23
openSUSE-SU-2019:2279-1: moderate: Security update for jasper
openSUSE-SU-2019:2280-1: moderate: Security update for libseccomp
openSUSE-SU-2019:2281-1: important: Security update for dovecot23
openSUSE-SU-2019:2282-1: moderate: Security update for jasper
openSUSE-SU-2019:2283-1: moderate: Security update for libseccomp
openSUSE-SU-2019:2286-1: moderate: Security update for lxc
openSUSE-SU-2019:2288-1: moderate: Security update for singularity
openSUSE-SU-2019:2292-1: moderate: Security update for putty

openSUSE-SU-2019:2276-1: moderate: Security update for putty

openSUSE Security Update: Security update for putty
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2276-1
Rating: moderate
References: #1152753
Cross-References: CVE-2019-17068 CVE-2019-17069
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for putty to version 0.73 fixes the following issues:

Security issues fixed:

- CVE-2019-17068: Fixed the insufficient handling of terminal escape
sequences, that should delimit the pasted data in bracketed paste mode
(boo#1152753).
- CVE-2019-17069: Fixed a possible information leak caused by SSH-1
disconnection messages (boo#1152753).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-2276=1



Package List:

- openSUSE Leap 15.0 (x86_64):

putty-0.73-lp150.18.1
putty-debuginfo-0.73-lp150.18.1
putty-debugsource-0.73-lp150.18.1


References:

https://www.suse.com/security/cve/CVE-2019-17068.html
https://www.suse.com/security/cve/CVE-2019-17069.html
https://bugzilla.suse.com/1152753

--

openSUSE-SU-2019:2277-1: moderate: Security update for putty

openSUSE Security Update: Security update for putty
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2277-1
Rating: moderate
References: #1152753
Cross-References: CVE-2019-17068 CVE-2019-17069
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for putty to version 0.73 fixes the following issues:

- CVE-2019-17068: Fixed the insufficient handling of terminal escape
sequences, that should delimit the pasted data in bracketed paste mode
(boo#1152753).
- CVE-2019-17069: Fixed a possible information leak caused by SSH-1
disconnection messages (boo#1152753).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2277=1



Package List:

- openSUSE Leap 15.1 (x86_64):

putty-0.73-lp151.3.6.1
putty-debuginfo-0.73-lp151.3.6.1
putty-debugsource-0.73-lp151.3.6.1


References:

https://www.suse.com/security/cve/CVE-2019-17068.html
https://www.suse.com/security/cve/CVE-2019-17069.html
https://bugzilla.suse.com/1152753

--

openSUSE-SU-2019:2278-1: important: Security update for dovecot23

openSUSE Security Update: Security update for dovecot23
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2278-1
Rating: important
References: #1133624 #1133625 #1145559
Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500

Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for dovecot23 fixes the following issue:

- CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve
protocol parsers. (bsc#1145559)
- CVE-2019-11499: Fixed a vulnerability where the submission-login would
crash over a TLS secured channel (bsc#1133625).
- CVE-2019-11494: Fixed a denial of service if the authentication is
aborted by disconnecting (bsc#1133624).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-2278=1



Package List:

- openSUSE Leap 15.0 (x86_64):

dovecot23-2.3.3-lp150.14.1
dovecot23-backend-mysql-2.3.3-lp150.14.1
dovecot23-backend-mysql-debuginfo-2.3.3-lp150.14.1
dovecot23-backend-pgsql-2.3.3-lp150.14.1
dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.14.1
dovecot23-backend-sqlite-2.3.3-lp150.14.1
dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.14.1
dovecot23-debuginfo-2.3.3-lp150.14.1
dovecot23-debugsource-2.3.3-lp150.14.1
dovecot23-devel-2.3.3-lp150.14.1
dovecot23-fts-2.3.3-lp150.14.1
dovecot23-fts-debuginfo-2.3.3-lp150.14.1
dovecot23-fts-lucene-2.3.3-lp150.14.1
dovecot23-fts-lucene-debuginfo-2.3.3-lp150.14.1
dovecot23-fts-solr-2.3.3-lp150.14.1
dovecot23-fts-solr-debuginfo-2.3.3-lp150.14.1
dovecot23-fts-squat-2.3.3-lp150.14.1
dovecot23-fts-squat-debuginfo-2.3.3-lp150.14.1


References:

https://www.suse.com/security/cve/CVE-2019-11494.html
https://www.suse.com/security/cve/CVE-2019-11499.html
https://www.suse.com/security/cve/CVE-2019-11500.html
https://bugzilla.suse.com/1133624
https://bugzilla.suse.com/1133625
https://bugzilla.suse.com/1145559

--

openSUSE-SU-2019:2279-1: moderate: Security update for jasper

openSUSE Security Update: Security update for jasper
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2279-1
Rating: moderate
References: #1117507 #1117508
Cross-References: CVE-2018-19540 CVE-2018-19541
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for jasper fixes the following issues:

Security issues fixed:

- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input
(bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize
(bsc#1117507).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-2279=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

jasper-2.0.14-lp150.2.6.1
jasper-debuginfo-2.0.14-lp150.2.6.1
jasper-debugsource-2.0.14-lp150.2.6.1
libjasper-devel-2.0.14-lp150.2.6.1
libjasper4-2.0.14-lp150.2.6.1
libjasper4-debuginfo-2.0.14-lp150.2.6.1

- openSUSE Leap 15.0 (x86_64):

libjasper4-32bit-2.0.14-lp150.2.6.1
libjasper4-32bit-debuginfo-2.0.14-lp150.2.6.1


References:

https://www.suse.com/security/cve/CVE-2018-19540.html
https://www.suse.com/security/cve/CVE-2018-19541.html
https://bugzilla.suse.com/1117507
https://bugzilla.suse.com/1117508

--

openSUSE-SU-2019:2280-1: moderate: Security update for libseccomp

openSUSE Security Update: Security update for libseccomp
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2280-1
Rating: moderate
References: #1082318 #1128828 #1142614
Cross-References: CVE-2019-9893
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves one vulnerability and has two fixes
is now available.

Description:

This update for libseccomp fixes the following issues:

Security issues fixed:

- CVE-2019-9893: An incorrect generation of syscall filters in libseccomp
was fixed (bsc#1128828)

libseccomp was updated to new upstream release 2.4.1:

- Fix a BPF generation bug where the optimizer mistakenly identified
duplicate BPF code blocks.

libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893):

- Update the syscall table for Linux v5.0-rc5
- Added support for the SCMP_ACT_KILL_PROCESS action
- Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG
attribute
- Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...))
argument comparison macros to help protect against unexpected sign
extension
- Added support for the parisc and parisc64 architectures
- Added the ability to query and set the libseccomp API level via
seccomp_api_get(3) and seccomp_api_set(3)
- Return -EDOM on an endian mismatch when adding an architecture to a
filter
- Renumber the pseudo syscall number for subpage_prot() so it no longer
conflicts with spu_run()
- Fix PFC generation when a syscall is prioritized, but no rule exists
- Numerous fixes to the seccomp-bpf filter generation code
- Switch our internal hashing function to jhash/Lookup3 to MurmurHash3
- Numerous tests added to the included test suite, coverage now at ~92%
- Update our Travis CI configuration to use Ubuntu 16.04
- Numerous documentation fixes and updates

libseccomp was updated to release 2.3.3:

- Updated the syscall table for Linux v4.15-rc7


This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-2280=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libseccomp-debugsource-2.4.1-lp150.2.3.1
libseccomp-devel-2.4.1-lp150.2.3.1
libseccomp-tools-2.4.1-lp150.2.3.1
libseccomp-tools-debuginfo-2.4.1-lp150.2.3.1
libseccomp2-2.4.1-lp150.2.3.1
libseccomp2-debuginfo-2.4.1-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

libseccomp2-32bit-2.4.1-lp150.2.3.1
libseccomp2-32bit-debuginfo-2.4.1-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2019-9893.html
https://bugzilla.suse.com/1082318
https://bugzilla.suse.com/1128828
https://bugzilla.suse.com/1142614

--

openSUSE-SU-2019:2281-1: important: Security update for dovecot23

openSUSE Security Update: Security update for dovecot23
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2281-1
Rating: important
References: #1133624 #1133625 #1145559
Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500

Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for dovecot23 fixes the following issues:

- CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve
protocol parsers. (bsc#1145559)
- CVE-2019-11499: Fixed a vulnerability where the submission-login would
crash over a TLS secured channel (bsc#1133625).
- CVE-2019-11494: Fixed a denial of service if the authentication is
aborted by disconnecting (bsc#1133624).

This update was imported from the SUSE:SLE-15-SP1:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2281=1



Package List:

- openSUSE Leap 15.1 (x86_64):

dovecot23-2.3.3-lp151.2.6.1
dovecot23-backend-mysql-2.3.3-lp151.2.6.1
dovecot23-backend-mysql-debuginfo-2.3.3-lp151.2.6.1
dovecot23-backend-pgsql-2.3.3-lp151.2.6.1
dovecot23-backend-pgsql-debuginfo-2.3.3-lp151.2.6.1
dovecot23-backend-sqlite-2.3.3-lp151.2.6.1
dovecot23-backend-sqlite-debuginfo-2.3.3-lp151.2.6.1
dovecot23-debuginfo-2.3.3-lp151.2.6.1
dovecot23-debugsource-2.3.3-lp151.2.6.1
dovecot23-devel-2.3.3-lp151.2.6.1
dovecot23-fts-2.3.3-lp151.2.6.1
dovecot23-fts-debuginfo-2.3.3-lp151.2.6.1
dovecot23-fts-lucene-2.3.3-lp151.2.6.1
dovecot23-fts-lucene-debuginfo-2.3.3-lp151.2.6.1
dovecot23-fts-solr-2.3.3-lp151.2.6.1
dovecot23-fts-solr-debuginfo-2.3.3-lp151.2.6.1
dovecot23-fts-squat-2.3.3-lp151.2.6.1
dovecot23-fts-squat-debuginfo-2.3.3-lp151.2.6.1


References:

https://www.suse.com/security/cve/CVE-2019-11494.html
https://www.suse.com/security/cve/CVE-2019-11499.html
https://www.suse.com/security/cve/CVE-2019-11500.html
https://bugzilla.suse.com/1133624
https://bugzilla.suse.com/1133625
https://bugzilla.suse.com/1145559

--

openSUSE-SU-2019:2282-1: moderate: Security update for jasper

openSUSE Security Update: Security update for jasper
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2282-1
Rating: moderate
References: #1117507 #1117508
Cross-References: CVE-2018-19540 CVE-2018-19541
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for jasper fixes the following issues:

Security issues fixed:

- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input
(bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize
(bsc#1117507).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2282=1



Package List:

- openSUSE Leap 15.1 (i586 x86_64):

jasper-2.0.14-lp151.4.3.1
jasper-debuginfo-2.0.14-lp151.4.3.1
jasper-debugsource-2.0.14-lp151.4.3.1
libjasper-devel-2.0.14-lp151.4.3.1
libjasper4-2.0.14-lp151.4.3.1
libjasper4-debuginfo-2.0.14-lp151.4.3.1

- openSUSE Leap 15.1 (x86_64):

libjasper4-32bit-2.0.14-lp151.4.3.1
libjasper4-32bit-debuginfo-2.0.14-lp151.4.3.1


References:

https://www.suse.com/security/cve/CVE-2018-19540.html
https://www.suse.com/security/cve/CVE-2018-19541.html
https://bugzilla.suse.com/1117507
https://bugzilla.suse.com/1117508

--

openSUSE-SU-2019:2283-1: moderate: Security update for libseccomp

openSUSE Security Update: Security update for libseccomp
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2283-1
Rating: moderate
References: #1082318 #1128828 #1142614
Cross-References: CVE-2019-9893
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________

An update that solves one vulnerability and has two fixes
is now available.

Description:

This update for libseccomp fixes the following issues:

Security issues fixed:

- CVE-2019-9893: An incorrect generation of syscall filters in libseccomp
was fixed (bsc#1128828)

libseccomp was updated to new upstream release 2.4.1:

- Fix a BPF generation bug where the optimizer mistakenly identified
duplicate BPF code blocks.

libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893):

- Update the syscall table for Linux v5.0-rc5
- Added support for the SCMP_ACT_KILL_PROCESS action
- Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG
attribute
- Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...))
argument comparison macros to help protect against unexpected sign
extension
- Added support for the parisc and parisc64 architectures
- Added the ability to query and set the libseccomp API level via
seccomp_api_get(3) and seccomp_api_set(3)
- Return -EDOM on an endian mismatch when adding an architecture to a
filter
- Renumber the pseudo syscall number for subpage_prot() so it no longer
conflicts with spu_run()
- Fix PFC generation when a syscall is prioritized, but no rule exists
- Numerous fixes to the seccomp-bpf filter generation code
- Switch our internal hashing function to jhash/Lookup3 to MurmurHash3
- Numerous tests added to the included test suite, coverage now at ~92%
- Update our Travis CI configuration to use Ubuntu 16.04
- Numerous documentation fixes and updates

libseccomp was updated to release 2.3.3:

- Updated the syscall table for Linux v4.15-rc7


This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2283=1



Package List:

- openSUSE Leap 15.1 (i586 x86_64):

libseccomp-debugsource-2.4.1-lp151.3.3.1
libseccomp-devel-2.4.1-lp151.3.3.1
libseccomp-tools-2.4.1-lp151.3.3.1
libseccomp-tools-debuginfo-2.4.1-lp151.3.3.1
libseccomp2-2.4.1-lp151.3.3.1
libseccomp2-debuginfo-2.4.1-lp151.3.3.1

- openSUSE Leap 15.1 (x86_64):

libseccomp2-32bit-2.4.1-lp151.3.3.1
libseccomp2-32bit-debuginfo-2.4.1-lp151.3.3.1


References:

https://www.suse.com/security/cve/CVE-2019-9893.html
https://bugzilla.suse.com/1082318
https://bugzilla.suse.com/1128828
https://bugzilla.suse.com/1142614

--

openSUSE-SU-2019:2286-1: moderate: Security update for lxc

openSUSE Security Update: Security update for lxc
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2286-1
Rating: moderate
References: #1131762
Cross-References: CVE-2019-5736
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for lxc fixes the following issues:

Update to lxc 3.2.1. The changelog can be found at

https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322

+ seccomp: support syscall forwarding to userspace
+ add lxc.seccomp.allow_nesting
+ pidfd: Add initial support for the new pidfd api
* Many hardening improvements.
* Use /sys/kernel/cgroup/delegate file for cgroup v2.
* Fix CVE-2019-5736 equivalent bug.

- fix apparmor dropin to be compatible with LXC 3.1.0 (boo#1131762) This
update was imported from the openSUSE:Leap:15.1:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP1:

zypper in -t patch openSUSE-2019-2286=1



Package List:

- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

liblxc-devel-3.2.1-bp151.5.3.1
liblxc1-3.2.1-bp151.5.3.1
lxc-3.2.1-bp151.5.3.1
pam_cgfs-3.2.1-bp151.5.3.1

- openSUSE Backports SLE-15-SP1 (noarch):

lxc-bash-completion-3.2.1-bp151.5.3.1


References:

https://www.suse.com/security/cve/CVE-2019-5736.html
https://bugzilla.suse.com/1131762

--

openSUSE-SU-2019:2288-1: moderate: Security update for singularity

openSUSE Security Update: Security update for singularity
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2288-1
Rating: moderate
References: #1125369 #1128598
Cross-References: CVE-2019-11328
Affected Products:
openSUSE Backports SLE-15-SP1
openSUSE Backports SLE-15
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for singularity fixes the following issues:

singularity was updated to version 3.4.1:

This point release addresses the following issues:

- Fixes an issue where a PID namespace was always being used
- Fixes compilation on non 64-bit architectures
- Allows fakeroot builds for zypper, pacstrap, and debootstrap
- Correctly detects seccomp on OpenSUSE
- Honors GO_MODFLAGS properly in the mconfig generated makefile
- Passes the Mac hostname to the VM in MacOS Singularity builds
- Handles temporary EAGAIN failures when setting up loop devices on recent
kernels.

New version 3.4.0. Many changes since 3.2.1, for the full changelog please
read CHANGELOG.md

Update to version 3.2.1:

This point release fixes the following bugs:

- Allows users to join instances with non-suid workflow
- Removes false warning when seccomp is disabled on the host
- Fixes an issue in the terminal when piping output to commands
- Binds NVIDIA persistenced socket when `--nv` is invoked

Improve integration with SUSE Products: add support to create Singularity
images with SLE.

* Newer SUSE versions use a different path for the RPM database.
* When the installation succeeds by an installation scriptlet fails zypper
returns error code 107. Don't treat this as an error.
* In order to specify a repository GPG key, add support for multi line
variables.
* In order to specify a list of additional repos, add support to 'indexed'
variables.
* Improve handling of SUSE repositires:

- For SLE, use SUSEConnect to get all product repos.
- Allow to specify a repository GPG key.
- Allow to specify additional installation repositories.

- Add group 'singularity', fix ownerships.

Updated to singularity v3.2.0

* CVE-2019-11328: Instance files are now stored in user's home directory
for privacy and many checks have been added to ensure that a user can't
manipulate files to change `starter-suid` behavior when instances are
joined (many thanks to Matthias Gerstner from the SUSE security team for
finding and securely reporting this vulnerability) (boo#1128598)

* New features / functionalities

- Introduced a new basic framework for creating and managing plugins
- Added the ability to create containers through multi-stage builds
- Created the concept of a Sylabs Cloud "remote" endpoint and added the
ability for users and admins to set them through CLI and conf files
- Added caching for images from Singularity Hub
- Made it possible to compile Singularity outside of `$GOPATH`
- Added a json partition to SIF files for OCI configuration when
building from an OCI source
- Full integration with Singularity desktop for MacOS code base

* New Commands

- Introduced the `plugin` command group for creating and managing
plugins.

* Introduced the `remote` command group to support management of
Singularity endpoints.
* Added to the `key` command group to improve PGP key management.
* Added the `Stage: ` keyword to the definition file header and the
`from ` option/argument pair to the `%files` section to
support multistage builds
* Deprecated / removed commands

- The `--token/-t` option has been deprecated in favor of the
`singularity remote` command group

* Changed defaults / behaviors

- Ask to confirm password on a newly generated PGP key
- Prompt to push a key to the KeyStore when generated
- Refuse to push an unsigned container unless overridden with
`--allow-unauthenticated/-U` option
- Warn and prompt when pulling an unsigned container without the
`--allow-unauthenticated/-U` option For more information check:
https://github.com/sylabs/singularity/blob/release-3.2/CHANGELOG.md

Updated to singularity v3.1.1:

* New Commands

- New hidden `buildcfg` command to display compile-time parameters
- Added support for `LDFLAGS`, `CFLAGS`, `CGO_` variables in build system
- Added `--nocolor` flag to Singularity client to disable color in
logging

* Removed Commands

- `singularity capability --desc` has been removed
- `singularity capability list ` flags have all
been removed

* New features / functionalities
- The `--builder` flag to the `build` command implicitly sets `--remote`
- Repeated binds no longer cause Singularity to exit and fail, just warn
instead
- Corrected typos and improved docstrings throughout
- Removed warning when CWD does not exist on the host system
- Added support to spec file for RPM building on SLES 11

Update to singularity 3.1.0 what is reimplementaion in go so this is a
complete new build and just reusing the changelog entries, following build
differences were made to the upstream spec file

* build position independent executable
* build stripped executable

- Change from /var/singularity to /var/lib/singularity
- Fix warning on bash-completion file about non-executible script.

- Add bash completions directory to file list for suse_version < 1500 to
keep the build checker happy.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP1:

zypper in -t patch openSUSE-2019-2288=1

- openSUSE Backports SLE-15:

zypper in -t patch openSUSE-2019-2288=1



Package List:

- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

singularity-3.4.1-bp151.3.3.1
singularity-debuginfo-3.4.1-bp151.3.3.1

- openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):

singularity-3.4.1-bp150.2.10.1


References:

https://www.suse.com/security/cve/CVE-2019-11328.html
https://bugzilla.suse.com/1125369
https://bugzilla.suse.com/1128598

--

openSUSE-SU-2019:2292-1: moderate: Security update for putty

openSUSE Security Update: Security update for putty
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2292-1
Rating: moderate
References: #1152753
Cross-References: CVE-2019-17068 CVE-2019-17069
Affected Products:
openSUSE Backports SLE-15-SP1
openSUSE Backports SLE-15
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for putty to version 0.73 fixes the following issues:

Security issues fixed:

- CVE-2019-17068: Fixed the insufficient handling of terminal escape
sequences, that should delimit the pasted data in bracketed paste mode
(boo#1152753).
- CVE-2019-17069: Fixed a possible information leak caused by SSH-1
disconnection messages (boo#1152753).

This update was imported from the openSUSE:Leap:15.0:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP1:

zypper in -t patch openSUSE-2019-2292=1

- openSUSE Backports SLE-15:

zypper in -t patch openSUSE-2019-2292=1



Package List:

- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

putty-0.73-bp151.4.6.1
putty-debuginfo-0.73-bp151.4.6.1
putty-debugsource-0.73-bp151.4.6.1

- openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):

putty-0.73-bp150.4.12.1


References:

https://www.suse.com/security/cve/CVE-2019-17068.html
https://www.suse.com/security/cve/CVE-2019-17069.html
https://bugzilla.suse.com/1152753

--