December 2020 - openSUSE Security Announce

openSUSE-SU-2020:2367-1: moderate: Security update for groovy
by opensuse-security＠opensuse.org 31 Dec '20

31 Dec '20

openSUSE Security Update: Security update for groovy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2367-1 Rating: moderate References: #1179729 Cross-References: CVE-2020-17521 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for groovy fixes the following issues: - groovy was updated to 2.4.21 - CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2367=1 Package List: - openSUSE Leap 15.2 (noarch): groovy-2.4.21-lp152.2.3.2 groovy-ant-2.4.21-lp152.2.3.2 groovy-bsf-2.4.21-lp152.2.3.2 groovy-console-2.4.21-lp152.2.3.2 groovy-docgenerator-2.4.21-lp152.2.3.2 groovy-groovydoc-2.4.21-lp152.2.3.2 groovy-groovysh-2.4.21-lp152.2.3.2 groovy-jmx-2.4.21-lp152.2.3.2 groovy-json-2.4.21-lp152.2.3.2 groovy-jsr223-2.4.21-lp152.2.3.2 groovy-lib-2.4.21-lp152.2.3.2 groovy-nio-2.4.21-lp152.2.3.2 groovy-servlet-2.4.21-lp152.2.3.2 groovy-sql-2.4.21-lp152.2.3.2 groovy-swing-2.4.21-lp152.2.3.2 groovy-templates-2.4.21-lp152.2.3.2 groovy-test-2.4.21-lp152.2.3.2 groovy-testng-2.4.21-lp152.2.3.2 groovy-xml-2.4.21-lp152.2.3.2 References: https://www.suse.com/security/cve/CVE-2020-17521.html https://bugzilla.suse.com/1179729

1 0

openSUSE-SU-2020:2363-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 30 Dec '20

30 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2363-1 Rating: important References: #1177672 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde fixes the following issue: - Add fingerprinting for device verification (boo#1177672). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2363=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kdeconnect-kde-20.04.2-bp152.2.6.1 - openSUSE Backports SLE-15-SP2 (noarch): kdeconnect-kde-lang-20.04.2-bp152.2.6.1 kdeconnect-kde-zsh-completion-20.04.2-bp152.2.6.1 References: https://bugzilla.suse.com/1177672

1 0

openSUSE-SU-2020:2361-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2361-1 Rating: important References: #1177672 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde fixes the following issues: - Add fingerprinting for device verification (boo#1177672). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2361=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kdeconnect-kde-1.3.3-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): kdeconnect-kde-lang-1.3.3-bp151.4.6.1 References: https://bugzilla.suse.com/1177672

1 0

openSUSE-SU-2020:2359-1: important: Security update for opera
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2359-1 Rating: important References: Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 73.0.3856.284 - CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88 - DNA-88454 Background of snap area above visible scrolled viewport is not captured - DNA-89749 Implement client_capabilities support for Flow / Sync - DNA-89810 Opera no longer autoselects full url/address bar when clicked - DNA-89923 [Snap] Emojis look grayed out - DNA-90060 Make gesture events work with search-in-tabs feature - DNA-90168 Display SD suggestions titles - DNA-90176 Player doesn��t show music service to choose on Welcome page - DNA-90343 [Mac] Cmd+C doesn��t copy snapshot - DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - The update to chromium 87.0.4280.88 fixes following issues: CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042 - Update to version 73.0.3856.257 - DNA-89918 #enable-force-dark flag doesn��t work anymore - DNA-90061 Clicking on video��s progress bar breaks autopausing - DNA-90079 [BigSur] Blank pages - DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-2359=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-73.0.3856.284-lp151.2.39.1 References: https://www.suse.com/security/cve/CVE-2020-16037.html https://www.suse.com/security/cve/CVE-2020-16038.html https://www.suse.com/security/cve/CVE-2020-16039.html https://www.suse.com/security/cve/CVE-2020-16040.html https://www.suse.com/security/cve/CVE-2020-16041.html https://www.suse.com/security/cve/CVE-2020-16042.html

1 0

openSUSE-SU-2020:2360-1: important: Security update for opera
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2360-1 Rating: important References: Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 73.0.3856.284 - CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88 - DNA-88454 Background of snap area above visible scrolled viewport is not captured - DNA-89749 Implement client_capabilities support for Flow / Sync - DNA-89810 Opera no longer autoselects full url/address bar when clicked - DNA-89923 [Snap] Emojis look grayed out - DNA-90060 Make gesture events work with search-in-tabs feature - DNA-90168 Display SD suggestions titles - DNA-90176 Player doesn��t show music service to choose on Welcome page - DNA-90343 [Mac] Cmd+C doesn��t copy snapshot - DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - The update to chromium 87.0.4280.88 fixes following issues: CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042 - Update to version 73.0.3856.257 - DNA-89918 #enable-force-dark flag doesn��t work anymore - DNA-90061 Clicking on video��s progress bar breaks autopausing - DNA-90079 [BigSur] Blank pages - DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-2360=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-73.0.3856.284-lp152.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-16037.html https://www.suse.com/security/cve/CVE-2020-16038.html https://www.suse.com/security/cve/CVE-2020-16039.html https://www.suse.com/security/cve/CVE-2020-16040.html https://www.suse.com/security/cve/CVE-2020-16041.html https://www.suse.com/security/cve/CVE-2020-16042.html

1 0

openSUSE-SU-2020:2357-1: important: Security update for gimp
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2357-1 Rating: important References: #1073628 #1178726 Cross-References: CVE-2017-17787 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gimp fixes the following issues: Security issue fixed: - CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628). Non-security issue fixed: - Fixed a software crash while importing a _PostScript_ file (bsc#1178726). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2357=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gimp-2.8.22-lp151.5.6.1 gimp-debuginfo-2.8.22-lp151.5.6.1 gimp-debugsource-2.8.22-lp151.5.6.1 gimp-devel-2.8.22-lp151.5.6.1 gimp-devel-debuginfo-2.8.22-lp151.5.6.1 gimp-plugin-aa-2.8.22-lp151.5.6.1 gimp-plugin-aa-debuginfo-2.8.22-lp151.5.6.1 gimp-plugins-python-2.8.22-lp151.5.6.1 gimp-plugins-python-debuginfo-2.8.22-lp151.5.6.1 libgimp-2_0-0-2.8.22-lp151.5.6.1 libgimp-2_0-0-debuginfo-2.8.22-lp151.5.6.1 libgimpui-2_0-0-2.8.22-lp151.5.6.1 libgimpui-2_0-0-debuginfo-2.8.22-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): gimp-lang-2.8.22-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libgimp-2_0-0-32bit-2.8.22-lp151.5.6.1 libgimp-2_0-0-32bit-debuginfo-2.8.22-lp151.5.6.1 libgimpui-2_0-0-32bit-2.8.22-lp151.5.6.1 libgimpui-2_0-0-32bit-debuginfo-2.8.22-lp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2017-17787.html https://bugzilla.suse.com/1073628 https://bugzilla.suse.com/1178726

1 0

openSUSE-SU-2020:2350-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2350-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for flac fixes the following issues: - CVE-2020-0487: Fixed a memory leak (bsc#1180112). - CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2350=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): flac-1.3.2-lp152.5.3.1 flac-debuginfo-1.3.2-lp152.5.3.1 flac-debugsource-1.3.2-lp152.5.3.1 flac-devel-1.3.2-lp152.5.3.1 libFLAC++6-1.3.2-lp152.5.3.1 libFLAC++6-debuginfo-1.3.2-lp152.5.3.1 libFLAC8-1.3.2-lp152.5.3.1 libFLAC8-debuginfo-1.3.2-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): flac-devel-32bit-1.3.2-lp152.5.3.1 libFLAC++6-32bit-1.3.2-lp152.5.3.1 libFLAC++6-32bit-debuginfo-1.3.2-lp152.5.3.1 libFLAC8-32bit-1.3.2-lp152.5.3.1 libFLAC8-32bit-debuginfo-1.3.2-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): flac-doc-1.3.2-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-0487.html https://www.suse.com/security/cve/CVE-2020-0499.html https://bugzilla.suse.com/1180099 https://bugzilla.suse.com/1180112

1 0

openSUSE-SU-2020:2351-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2351-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879). - CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879). - CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2351=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.8.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.8.1 openexr-2.2.1-lp152.7.8.1 openexr-debuginfo-2.2.1-lp152.7.8.1 openexr-debugsource-2.2.1-lp152.7.8.1 openexr-devel-2.2.1-lp152.7.8.1 openexr-doc-2.2.1-lp152.7.8.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.8.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.8.1 References: https://www.suse.com/security/cve/CVE-2020-16587.html https://www.suse.com/security/cve/CVE-2020-16588.html https://www.suse.com/security/cve/CVE-2020-16589.html https://bugzilla.suse.com/1179879

1 0

openSUSE-SU-2020:2349-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2349-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879). - CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879). - CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2349=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.15.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.15.1 openexr-2.2.1-lp151.4.15.1 openexr-debuginfo-2.2.1-lp151.4.15.1 openexr-debugsource-2.2.1-lp151.4.15.1 openexr-devel-2.2.1-lp151.4.15.1 openexr-doc-2.2.1-lp151.4.15.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.15.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.15.1 References: https://www.suse.com/security/cve/CVE-2020-16587.html https://www.suse.com/security/cve/CVE-2020-16588.html https://www.suse.com/security/cve/CVE-2020-16589.html https://bugzilla.suse.com/1179879

1 0

openSUSE-SU-2020:2348-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2348-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for flac fixes the following issues: - CVE-2020-0487: Fixed a memory leak (bsc#1180112). - CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2348=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): flac-1.3.2-lp151.4.3.1 flac-debuginfo-1.3.2-lp151.4.3.1 flac-debugsource-1.3.2-lp151.4.3.1 flac-devel-1.3.2-lp151.4.3.1 libFLAC++6-1.3.2-lp151.4.3.1 libFLAC++6-debuginfo-1.3.2-lp151.4.3.1 libFLAC8-1.3.2-lp151.4.3.1 libFLAC8-debuginfo-1.3.2-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): flac-devel-32bit-1.3.2-lp151.4.3.1 libFLAC++6-32bit-1.3.2-lp151.4.3.1 libFLAC++6-32bit-debuginfo-1.3.2-lp151.4.3.1 libFLAC8-32bit-1.3.2-lp151.4.3.1 libFLAC8-32bit-debuginfo-1.3.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): flac-doc-1.3.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-0487.html https://www.suse.com/security/cve/CVE-2020-0499.html https://bugzilla.suse.com/1180099 https://bugzilla.suse.com/1180112

1 0