October 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1744-1: important: Security update for freetype2
by opensuse-security＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1744-1 Rating: important References: #1177914 Cross-References: CVE-2020-15999 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freetype2 fixes the following issues: - CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1744=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): freetype2-debugsource-2.10.1-lp152.2.5.1 freetype2-devel-2.10.1-lp152.2.5.1 ft2demos-2.10.1-lp152.2.5.1 ftbench-2.10.1-lp152.2.5.1 ftdiff-2.10.1-lp152.2.5.1 ftdump-2.10.1-lp152.2.5.1 ftgamma-2.10.1-lp152.2.5.1 ftgrid-2.10.1-lp152.2.5.1 ftinspect-2.10.1-lp152.2.5.1 ftlint-2.10.1-lp152.2.5.1 ftmulti-2.10.1-lp152.2.5.1 ftstring-2.10.1-lp152.2.5.1 ftvalid-2.10.1-lp152.2.5.1 ftview-2.10.1-lp152.2.5.1 libfreetype6-2.10.1-lp152.2.5.1 libfreetype6-debuginfo-2.10.1-lp152.2.5.1 - openSUSE Leap 15.2 (noarch): freetype2-profile-tti35-2.10.1-lp152.2.5.1 - openSUSE Leap 15.2 (x86_64): freetype2-devel-32bit-2.10.1-lp152.2.5.1 libfreetype6-32bit-2.10.1-lp152.2.5.1 libfreetype6-32bit-debuginfo-2.10.1-lp152.2.5.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://bugzilla.suse.com/1177914 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1743-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1743-1 Rating: moderate References: #1176086 #1176181 #1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gnutls fixes the following issues: - Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181) - FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086) - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086) - FIPS: Add TLS KDF selftest (bsc#1176671) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1743=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnutls-3.6.7-lp152.9.3.2 gnutls-debuginfo-3.6.7-lp152.9.3.2 gnutls-debugsource-3.6.7-lp152.9.3.2 gnutls-guile-3.6.7-lp152.9.3.2 gnutls-guile-debuginfo-3.6.7-lp152.9.3.2 libgnutls-dane-devel-3.6.7-lp152.9.3.2 libgnutls-dane0-3.6.7-lp152.9.3.2 libgnutls-dane0-debuginfo-3.6.7-lp152.9.3.2 libgnutls-devel-3.6.7-lp152.9.3.2 libgnutls30-3.6.7-lp152.9.3.2 libgnutls30-debuginfo-3.6.7-lp152.9.3.2 libgnutls30-hmac-3.6.7-lp152.9.3.2 libgnutlsxx-devel-3.6.7-lp152.9.3.2 libgnutlsxx28-3.6.7-lp152.9.3.2 libgnutlsxx28-debuginfo-3.6.7-lp152.9.3.2 - openSUSE Leap 15.2 (x86_64): libgnutls-devel-32bit-3.6.7-lp152.9.3.2 libgnutls30-32bit-3.6.7-lp152.9.3.2 libgnutls30-32bit-debuginfo-3.6.7-lp152.9.3.2 libgnutls30-hmac-32bit-3.6.7-lp152.9.3.2 References: https://www.suse.com/security/cve/CVE-2020-24659.html https://bugzilla.suse.com/1176086 https://bugzilla.suse.com/1176181 https://bugzilla.suse.com/1176671 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1737-1: important: Security update for chromium
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1737-1 Rating: important References: #1177936 Cross-References: CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1737=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-86.0.4240.111-lp152.2.42.1 chromedriver-debuginfo-86.0.4240.111-lp152.2.42.1 chromium-86.0.4240.111-lp152.2.42.1 chromium-debuginfo-86.0.4240.111-lp152.2.42.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://bugzilla.suse.com/1177936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1736-1: important: Security update for atftp
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for atftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1736-1 Rating: important References: #1176437 Cross-References: CVE-2020-6097 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for atftp fixes the following issues: - [boo#1176437, CVE-2020-6097] A specially crafted sequence of RRQ-Multicast requests can trigger an assert() call resulting denial-of-service. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1736=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): atftp-0.7.2-lp152.2.3.1 atftp-debuginfo-0.7.2-lp152.2.3.1 atftp-debugsource-0.7.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-6097.html https://bugzilla.suse.com/1176437 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1732-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1732-1 Rating: important References: #1176756 #1177872 Cross-References: CVE-2020-15683 CVE-2020-15969 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.4.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-46 (bsc#1177872, bsc#1176756) * CVE-2020-15969 Use-after-free in usersctp * CVE-2020-15683 Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 * Fixed: Fixed legacy preferences not being properly applied when set via GPO This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1732=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.4.0-lp151.2.73.1 MozillaFirefox-branding-upstream-78.4.0-lp151.2.73.1 MozillaFirefox-buildsymbols-78.4.0-lp151.2.73.1 MozillaFirefox-debuginfo-78.4.0-lp151.2.73.1 MozillaFirefox-debugsource-78.4.0-lp151.2.73.1 MozillaFirefox-devel-78.4.0-lp151.2.73.1 MozillaFirefox-translations-common-78.4.0-lp151.2.73.1 MozillaFirefox-translations-other-78.4.0-lp151.2.73.1 References: https://www.suse.com/security/cve/CVE-2020-15683.html https://www.suse.com/security/cve/CVE-2020-15969.html https://bugzilla.suse.com/1176756 https://bugzilla.suse.com/1177872 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1734-1: important: Security update for freetype2
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1734-1 Rating: important References: #1177914 Cross-References: CVE-2020-15999 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freetype2 fixes the following issues: - CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1734=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetype2-debugsource-2.10.1-lp151.4.6.1 freetype2-devel-2.10.1-lp151.4.6.1 libfreetype6-2.10.1-lp151.4.6.1 libfreetype6-debuginfo-2.10.1-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): freetype2-devel-32bit-2.10.1-lp151.4.6.1 ft2demos-2.10.1-lp151.4.6.1 ftbench-2.10.1-lp151.4.6.1 ftdiff-2.10.1-lp151.4.6.1 ftdump-2.10.1-lp151.4.6.1 ftgamma-2.10.1-lp151.4.6.1 ftgrid-2.10.1-lp151.4.6.1 ftinspect-2.10.1-lp151.4.6.1 ftlint-2.10.1-lp151.4.6.1 ftmulti-2.10.1-lp151.4.6.1 ftstring-2.10.1-lp151.4.6.1 ftvalid-2.10.1-lp151.4.6.1 ftview-2.10.1-lp151.4.6.1 libfreetype6-32bit-2.10.1-lp151.4.6.1 libfreetype6-32bit-debuginfo-2.10.1-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): freetype2-profile-tti35-2.10.1-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://bugzilla.suse.com/1177914 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1731-1: important: Security update for chromium
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1731-1 Rating: important References: #1177936 Cross-References: CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1731=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-86.0.4240.111-bp151.3.116.1 chromium-86.0.4240.111-bp151.3.116.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://bugzilla.suse.com/1177936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1724-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1724-1 Rating: moderate References: #1176086 #1176181 #1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gnutls fixes the following issues: - Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181) - FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086) - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086) - FIPS: Add TLS KDF selftest (bsc#1176671) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1724=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gnutls-3.6.7-lp151.2.21.1 gnutls-debuginfo-3.6.7-lp151.2.21.1 gnutls-debugsource-3.6.7-lp151.2.21.1 gnutls-guile-3.6.7-lp151.2.21.1 gnutls-guile-debuginfo-3.6.7-lp151.2.21.1 libgnutls-dane-devel-3.6.7-lp151.2.21.1 libgnutls-dane0-3.6.7-lp151.2.21.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.21.1 libgnutls-devel-3.6.7-lp151.2.21.1 libgnutls30-3.6.7-lp151.2.21.1 libgnutls30-debuginfo-3.6.7-lp151.2.21.1 libgnutls30-hmac-3.6.7-lp151.2.21.1 libgnutlsxx-devel-3.6.7-lp151.2.21.1 libgnutlsxx28-3.6.7-lp151.2.21.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.21.1 - openSUSE Leap 15.1 (x86_64): libgnutls-devel-32bit-3.6.7-lp151.2.21.1 libgnutls30-32bit-3.6.7-lp151.2.21.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.21.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-24659.html https://bugzilla.suse.com/1176086 https://bugzilla.suse.com/1176181 https://bugzilla.suse.com/1176671 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1723-1: moderate: Security update for kleopatra
by opensuse-security＠opensuse.org 24 Oct '20

24 Oct '20

openSUSE Security Update: Security update for kleopatra ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1723-1 Rating: moderate References: #1177932 Cross-References: CVE-2020-24972 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kleopatra fixes the following issues: - CVE-2020-24972: Add upstream patch to prevent potential arbitrary code execution (boo#1177932): Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1723=1 Package List: - openSUSE Leap 15.1 (noarch): kleopatra-lang-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (x86_64): kleopatra-18.12.3-lp151.2.4.1 kleopatra-debuginfo-18.12.3-lp151.2.4.1 kleopatra-debugsource-18.12.3-lp151.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-24972.html https://bugzilla.suse.com/1177932 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1719-1: Security update for hunspell
by opensuse-security＠opensuse.org 24 Oct '20

24 Oct '20

openSUSE Security Update: Security update for hunspell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1719-1 Rating: low References: #1151867 Cross-References: CVE-2019-16707 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hunspell fixes the following issues: - CVE-2019-16707: Fixed an invalid read in SuggestMgr:leftcommonsubstring (bsc#1151867). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1719=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): hunspell-1.6.2-lp152.4.3.1 hunspell-debuginfo-1.6.2-lp152.4.3.1 hunspell-debugsource-1.6.2-lp152.4.3.1 hunspell-devel-1.6.2-lp152.4.3.1 hunspell-tools-1.6.2-lp152.4.3.1 hunspell-tools-debuginfo-1.6.2-lp152.4.3.1 libhunspell-1_6-0-1.6.2-lp152.4.3.1 libhunspell-1_6-0-debuginfo-1.6.2-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): hunspell-devel-32bit-1.6.2-lp152.4.3.1 libhunspell-1_6-0-32bit-1.6.2-lp152.4.3.1 libhunspell-1_6-0-32bit-debuginfo-1.6.2-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16707.html https://bugzilla.suse.com/1151867 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0