CVE-2019-18900

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

Libzypp from mageia 7 is affected by a security issue. This update fixes this.

Incorrect Default Permissions vulnerability in libzypp allowed local attackers to read a cookie store used by libzypp, exposing private cookies.

This update for libsolv, libzypp, zypper fixes the following issues:

Security issue fixed:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

Bug fixes

• Fixed removing orphaned packages dropped by to-be-installed products (bsc#1155819).
• Adds libzypp API to mark all obsolete kernels according to the existing purge-kernel script rules (bsc#1155198).
• Do not enforce 'en' being in RequestedLocales If the user decides to have a system without explicit language support he may do so (bsc#1155678).
• Load only target resolvables for zypper rm (bsc#1157377).
• Fix broken search by filelist (bsc#1135114).
• Replace python by a bash script in zypper-log (fixes#304, fixes#306, bsc#1156158).
• Do not sort out requested locales which are not available (bsc#1155678).
• Prevent listing duplicate matches in tables. XML result is provided within the new list-patches-byissue element (bsc#1154805).
• XML add patch issue-date and issue-list (bsc#1154805).
• Fix zypper lp --cve/bugzilla/issue options (bsc#1155298).
• Always execute commit when adding/removing locales (fixes bsc#1155205).
• Fix description of --table-style,-s in man page (bsc#1154804).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the libzypp-17.28.4-1.2 package on the GA media of openSUSE Tumbleweed.

This update for libzypp fixes the following issues:

Security issue fixed:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

This update for libzypp fixes the following issues:

Security issue fixed:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

This update for libsolv, libzypp, zypper fixes the following issues:

Security issue fixed:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

Bug fixes

• Fixed removing orphaned packages dropped by to-be-installed products (bsc#1155819).
• Adds libzypp API to mark all obsolete kernels according to the existing purge-kernel script rules (bsc#1155198).
• Do not enforce 'en' being in RequestedLocales If the user decides to have a system without explicit language support he may do so (bsc#1155678).
• Load only target resolvables for zypper rm (bsc#1157377).
• Fix broken search by filelist (bsc#1135114).
• Replace python by a bash script in zypper-log (fixes#304, fixes#306, bsc#1156158).
• Do not sort out requested locales which are not available (bsc#1155678).
• Prevent listing duplicate matches in tables. XML result is provided within the new list-patches-byissue element (bsc#1154805).
• XML add patch issue-date and issue-list (bsc#1154805).
• Fix zypper lp --cve/bugzilla/issue options (bsc#1155298).
• Always execute commit when adding/removing locales (fixes bsc#1155205).
• Fix description of --table-style,-s in man page (bsc#1154804).

This update for libsolv, libzypp, zypper fixes the following issues:

Security issue fixed:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

Bug fixes

• Fixed removing orphaned packages dropped by to-be-installed products (bsc#1155819).
• Adds libzypp API to mark all obsolete kernels according to the existing purge-kernel script rules (bsc#1155198).
• Do not enforce 'en' being in RequestedLocales If the user decides to have a system without explicit language support he may do so (bsc#1155678).
• Load only target resolvables for zypper rm (bsc#1157377).
• Fix broken search by filelist (bsc#1135114).
• Replace python by a bash script in zypper-log (fixes#304, fixes#306, bsc#1156158).
• Do not sort out requested locales which are not available (bsc#1155678).
• Prevent listing duplicate matches in tables. XML result is provided within the new list-patches-byissue element (bsc#1154805).
• XML add patch issue-date and issue-list (bsc#1154805).
• Fix zypper lp --cve/bugzilla/issue options (bsc#1155298).
• Always execute commit when adding/removing locales (fixes bsc#1155205).
• Fix description of --table-style,-s in man page (bsc#1154804).

This update for libzypp, zypper fixes the following issues:

libzypp fixes the following security issue:

• CVE-2019-18900: Fixed assert cookie file that was world readable (bsc#1158763).

zypper was updated to fix the following issues:

• Fixed an issue, where zypper crashed when the system language is set to Spanish and the user tried to patch their system with 'zypper patch --category security' (bsc#1178038)
• Fixed a typo in man page (bsc#1169947)