SUSE Container Update Advisory: suse/sles12sp4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2019:656-1
Container Tags        : suse/sles12sp4:26.69 , suse/sles12sp4:latest
Container Release     : 26.69
Severity              : important
Type                  : security
References            : 1124847 1131291 1141093 1143194 1143273 1148987 1149429 1149495
                        1149496 1150003 1150250 CVE-2019-13050 CVE-2019-13057 CVE-2019-13565
                        CVE-2019-13627 CVE-2019-1547 CVE-2019-1563 CVE-2019-15903 CVE-2019-5481
                        CVE-2019-5482 
-----------------------------------------------------------------

The container suse/sles12sp4 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2381-1
Released:    Mon Sep 16 15:18:28 2019
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1149495,1149496,CVE-2019-5481,CVE-2019-5482
This update for curl fixes the following issues:

Security issues fixed:

- CVE-2019-5481: Fixed a double-free during kerberos FTP data transfer. (bsc#1149495)
- CVE-2019-5482: Fixed a TFTP small block size heap buffer overflow (bsc#1149496).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2390-1
Released:    Tue Sep 17 15:46:02 2019
Summary:     Security update for openldap2
Type:        security
Severity:    moderate
References:  1143194,1143273,CVE-2019-13057,CVE-2019-13565
This update for openldap2 fixes the following issues:

Security issues fixed:

- CVE-2019-13565: Fixed ssf memory reuse that leads to incorrect authorization of another connection, granting excess connection rights (ssf) (bsc#1143194).
- CVE-2019-13057: Fixed rootDN of a backend that may proxyauth incorrectly to another backend, violating multi-tenant isolation (bsc#1143273).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2440-1
Released:    Mon Sep 23 17:15:13 2019
Summary:     Security update for expat
Type:        security
Severity:    moderate
References:  1149429,CVE-2019-15903
This update for expat fixes the following issues:

Security issue fixed:

- CVE-2019-15903: Fixed a heap-based buffer over-read caused by crafted XML documents. (bsc#1149429)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2480-1
Released:    Fri Sep 27 13:12:08 2019
Summary:     Security update for gpg2
Type:        security
Severity:    moderate
References:  1124847,1141093,CVE-2019-13050
This update for gpg2 fixes the following issues:

Security issue fixed:

- CVE-2019-13050: Fixed denial-of-service attacks via big keys. (bsc#1141093)

Non-security issue fixed:

- Allow coredumps in X11 desktop sessions (bsc#1124847).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2504-1
Released:    Tue Oct  1 13:07:07 2019
Summary:     Security update for openssl-1_0_0
Type:        security
Severity:    moderate
References:  1131291,1150003,1150250,CVE-2019-1547,CVE-2019-1563
This update for openssl-1_0_0 fixes the following issues:

OpenSSL Security Advisory [10 September 2019]

* CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003)
* CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250)

In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2019:2510-1
Released:    Tue Oct  1 17:37:12 2019
Summary:     Security update for libgcrypt
Type:        security
Severity:    moderate
References:  1148987,CVE-2019-13627
This update for libgcrypt fixes the following issues:

Security issues fixed:
	  
- CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)


The following package changes have been done:

- base-container-licenses-3.0-1.110 updated
- container-suseconnect-2.0.0-1.34 updated
- gpg2-2.0.24-9.8.1 updated
- libcurl4-7.60.0-4.9.1 updated
- libexpat1-2.1.0-21.9.1 updated
- libgcrypt20-1.6.1-16.68.1 updated
- libldap-2_4-2-2.4.41-18.63.1 updated
- libopenssl1_0_0-1.0.2p-3.11.1 updated
- openssl-1_0_0-1.0.2p-3.11.1 updated