December 2020 - openSUSE Security Announce

openSUSE-SU-2020:2324-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2324-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2324=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-78.6.0-lp151.2.63.1 MozillaThunderbird-debuginfo-78.6.0-lp151.2.63.1 MozillaThunderbird-debugsource-78.6.0-lp151.2.63.1 MozillaThunderbird-translations-common-78.6.0-lp151.2.63.1 MozillaThunderbird-translations-other-78.6.0-lp151.2.63.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039

1 0

openSUSE-SU-2020:2317-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2317-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2317=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.0-lp152.2.23.1 MozillaThunderbird-debuginfo-78.6.0-lp152.2.23.1 MozillaThunderbird-debugsource-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-common-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-other-78.6.0-lp152.2.23.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039

1 0

openSUSE-SU-2020:2318-1: critical: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2318-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2318=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.6.0-lp152.2.34.1 MozillaFirefox-branding-upstream-78.6.0-lp152.2.34.1 MozillaFirefox-buildsymbols-78.6.0-lp152.2.34.1 MozillaFirefox-debuginfo-78.6.0-lp152.2.34.1 MozillaFirefox-debugsource-78.6.0-lp152.2.34.1 MozillaFirefox-devel-78.6.0-lp152.2.34.1 MozillaFirefox-translations-common-78.6.0-lp152.2.34.1 MozillaFirefox-translations-other-78.6.0-lp152.2.34.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039

1 0

openSUSE-SU-2020:2317-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2317-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2317=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.0-lp152.2.23.1 MozillaThunderbird-debuginfo-78.6.0-lp152.2.23.1 MozillaThunderbird-debugsource-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-common-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-other-78.6.0-lp152.2.23.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039

1 0

openSUSE-SU-2020:2315-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2315-1 Rating: important References: #1178824 Cross-References: CVE-2020-15999 CVE-2020-16012 CVE-2020-26951 CVE-2020-26953 CVE-2020-26956 CVE-2020-26958 CVE-2020-26959 CVE-2020-26960 CVE-2020-26961 CVE-2020-26965 CVE-2020-26966 CVE-2020-26968 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.5.0 ESR (bsc#1178824) * CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code * CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls * CVE-2020-26953: Fullscreen could be enabled without displaying the security UI * CVE-2020-26956: XSS through paste (manual and clipboard API) * CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions * CVE-2020-26959: Use-after-free in WebRequestService * CVE-2020-26960: Potential use-after-free in uses of nsTArray * CVE-2020-15999: Heap buffer overflow in freetype * CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses * CVE-2020-26965: Software keyboards may have remembered typed passwords * CVE-2020-26966: Single-word search queries were also broadcast to local network * CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2315=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.5.0-lp152.2.33.1 MozillaFirefox-branding-upstream-78.5.0-lp152.2.33.1 MozillaFirefox-buildsymbols-78.5.0-lp152.2.33.1 MozillaFirefox-debuginfo-78.5.0-lp152.2.33.1 MozillaFirefox-debugsource-78.5.0-lp152.2.33.1 MozillaFirefox-devel-78.5.0-lp152.2.33.1 MozillaFirefox-translations-common-78.5.0-lp152.2.33.1 MozillaFirefox-translations-other-78.5.0-lp152.2.33.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16012.html https://www.suse.com/security/cve/CVE-2020-26951.html https://www.suse.com/security/cve/CVE-2020-26953.html https://www.suse.com/security/cve/CVE-2020-26956.html https://www.suse.com/security/cve/CVE-2020-26958.html https://www.suse.com/security/cve/CVE-2020-26959.html https://www.suse.com/security/cve/CVE-2020-26960.html https://www.suse.com/security/cve/CVE-2020-26961.html https://www.suse.com/security/cve/CVE-2020-26965.html https://www.suse.com/security/cve/CVE-2020-26966.html https://www.suse.com/security/cve/CVE-2020-26968.html https://bugzilla.suse.com/1178824

1 0

openSUSE-SU-2020:2314-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2314-1 Rating: moderate References: #1177789 Cross-References: CVE-2019-14584 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: - CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2314=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ovmf-201911-lp152.6.8.1 ovmf-tools-201911-lp152.6.8.1 - openSUSE Leap 15.2 (noarch): qemu-ovmf-ia32-201911-lp152.6.8.1 qemu-ovmf-x86_64-201911-lp152.6.8.1 - openSUSE Leap 15.2 (x86_64): qemu-ovmf-x86_64-debug-201911-lp152.6.8.1 References: https://www.suse.com/security/cve/CVE-2019-14584.html https://bugzilla.suse.com/1177789

1 0

openSUSE-SU-2020:2313-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2313-1 Rating: moderate References: #1027519 #1176782 #1179496 #1179498 #1179501 #1179502 #1179506 #1179514 #1179516 Cross-References: CVE-2020-29480 CVE-2020-29481 CVE-2020-29483 CVE-2020-29484 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for xen fixes the following issues: - CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115). - CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322). - CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325). - CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324). - CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348). - CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358). - CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359). - Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782). - Multiple other bugs (bsc#1027519) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2313=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.4_06-lp151.2.36.1 xen-devel-4.12.4_06-lp151.2.36.1 xen-libs-4.12.4_06-lp151.2.36.1 xen-libs-debuginfo-4.12.4_06-lp151.2.36.1 xen-tools-domU-4.12.4_06-lp151.2.36.1 xen-tools-domU-debuginfo-4.12.4_06-lp151.2.36.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.4_06-lp151.2.36.1 xen-doc-html-4.12.4_06-lp151.2.36.1 xen-libs-32bit-4.12.4_06-lp151.2.36.1 xen-libs-32bit-debuginfo-4.12.4_06-lp151.2.36.1 xen-tools-4.12.4_06-lp151.2.36.1 xen-tools-debuginfo-4.12.4_06-lp151.2.36.1 References: https://www.suse.com/security/cve/CVE-2020-29480.html https://www.suse.com/security/cve/CVE-2020-29481.html https://www.suse.com/security/cve/CVE-2020-29483.html https://www.suse.com/security/cve/CVE-2020-29484.html https://www.suse.com/security/cve/CVE-2020-29566.html https://www.suse.com/security/cve/CVE-2020-29570.html https://www.suse.com/security/cve/CVE-2020-29571.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176782 https://bugzilla.suse.com/1179496 https://bugzilla.suse.com/1179498 https://bugzilla.suse.com/1179501 https://bugzilla.suse.com/1179502 https://bugzilla.suse.com/1179506 https://bugzilla.suse.com/1179514 https://bugzilla.suse.com/1179516

1 0

openSUSE-SU-2020:2310-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 21 Dec '20

21 Dec '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2310-1 Rating: important References: #1171531 #1177087 #1179122 #1179451 Cross-References: CVE-2020-13543 CVE-2020-13584 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451): - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution. - CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution. - Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531). - Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2310=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3 libjavascriptcoregtk-4_0-18-debuginfo-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-debuginfo-2.30.3-lp152.2.7.3 typelib-1_0-JavaScriptCore-4_0-2.30.3-lp152.2.7.3 typelib-1_0-WebKit2-4_0-2.30.3-lp152.2.7.3 typelib-1_0-WebKit2WebExtension-4_0-2.30.3-lp152.2.7.3 webkit-jsc-4-2.30.3-lp152.2.7.3 webkit-jsc-4-debuginfo-2.30.3-lp152.2.7.3 webkit2gtk-4_0-injected-bundles-2.30.3-lp152.2.7.3 webkit2gtk-4_0-injected-bundles-debuginfo-2.30.3-lp152.2.7.3 webkit2gtk3-debugsource-2.30.3-lp152.2.7.3 webkit2gtk3-devel-2.30.3-lp152.2.7.3 webkit2gtk3-minibrowser-2.30.3-lp152.2.7.3 webkit2gtk3-minibrowser-debuginfo-2.30.3-lp152.2.7.3 - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-32bit-debuginfo-2.30.3-lp152.2.7.3 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.30.3-lp152.2.7.3 References: https://www.suse.com/security/cve/CVE-2020-13543.html https://www.suse.com/security/cve/CVE-2020-13584.html https://www.suse.com/security/cve/CVE-2020-9948.html https://www.suse.com/security/cve/CVE-2020-9951.html https://www.suse.com/security/cve/CVE-2020-9983.html https://bugzilla.suse.com/1171531 https://bugzilla.suse.com/1177087 https://bugzilla.suse.com/1179122 https://bugzilla.suse.com/1179451

1 0

openSUSE-SU-2020:2304-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 21 Dec '20

21 Dec '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2304-1 Rating: important References: #1171531 #1177087 #1179122 #1179451 Cross-References: CVE-2020-13543 CVE-2020-13584 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451): - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution. - CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution. - Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531). - Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2304=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.30.3-lp151.2.28.2 libjavascriptcoregtk-4_0-18-debuginfo-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-debuginfo-2.30.3-lp151.2.28.2 typelib-1_0-JavaScriptCore-4_0-2.30.3-lp151.2.28.2 typelib-1_0-WebKit2-4_0-2.30.3-lp151.2.28.2 typelib-1_0-WebKit2WebExtension-4_0-2.30.3-lp151.2.28.2 webkit-jsc-4-2.30.3-lp151.2.28.2 webkit-jsc-4-debuginfo-2.30.3-lp151.2.28.2 webkit2gtk-4_0-injected-bundles-2.30.3-lp151.2.28.2 webkit2gtk-4_0-injected-bundles-debuginfo-2.30.3-lp151.2.28.2 webkit2gtk3-debugsource-2.30.3-lp151.2.28.2 webkit2gtk3-devel-2.30.3-lp151.2.28.2 webkit2gtk3-minibrowser-2.30.3-lp151.2.28.2 webkit2gtk3-minibrowser-debuginfo-2.30.3-lp151.2.28.2 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp151.2.28.2 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-32bit-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-32bit-debuginfo-2.30.3-lp151.2.28.2 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.30.3-lp151.2.28.2 References: https://www.suse.com/security/cve/CVE-2020-13543.html https://www.suse.com/security/cve/CVE-2020-13584.html https://www.suse.com/security/cve/CVE-2020-9948.html https://www.suse.com/security/cve/CVE-2020-9951.html https://www.suse.com/security/cve/CVE-2020-9983.html https://bugzilla.suse.com/1171531 https://bugzilla.suse.com/1177087 https://bugzilla.suse.com/1179122 https://bugzilla.suse.com/1179451

1 0

openSUSE-SU-2020:2300-1: moderate: Security update for gcc7
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2300-1 Rating: moderate References: #1150164 #1161913 #1167939 #1172798 #1178577 #1178614 #1178624 #1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue (bsc#1172798) - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel. - Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. [jsc#SLE-12209, bsc#1167939] - Fixed 32bit libgnat.so link. [bsc#1178675] - Fixed memcpy miscompilation on aarch64. [bsc#1178624, bsc#1178577] - Fixed debug line info for try/catch. [bsc#1178614] - Remove -mbranch-protection=standard (aarch64 flag) when gcc7 is used to build gcc7 (ie when ada is enabled) - Fixed corruption of pass private ->aux via DF. [gcc#94148] - Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888] - Fixed binutils release date detection issue. - Fixed register allocation issue with exception handling code on s390x. [bsc#1161913] - Fixed miscompilation of some atomic code on aarch64. [bsc#1150164] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2300=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cpp7-7.5.0+r278197-lp151.2.15.1 cpp7-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-7.5.0+r278197-lp151.2.15.1 gcc7-ada-7.5.0+r278197-lp151.2.15.1 gcc7-ada-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-c++-7.5.0+r278197-lp151.2.15.1 gcc7-c++-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-debugsource-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-go-7.5.0+r278197-lp151.2.15.1 gcc7-go-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-locale-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-objc-7.5.0+r278197-lp151.2.15.1 gcc7-objc-debuginfo-7.5.0+r278197-lp151.2.15.1 libada7-7.5.0+r278197-lp151.2.15.1 libada7-debuginfo-7.5.0+r278197-lp151.2.15.1 libasan4-7.5.0+r278197-lp151.2.15.1 libasan4-debuginfo-7.5.0+r278197-lp151.2.15.1 libcilkrts5-7.5.0+r278197-lp151.2.15.1 libcilkrts5-debuginfo-7.5.0+r278197-lp151.2.15.1 libgfortran4-7.5.0+r278197-lp151.2.15.1 libgfortran4-debuginfo-7.5.0+r278197-lp151.2.15.1 libgo11-7.5.0+r278197-lp151.2.15.1 libgo11-debuginfo-7.5.0+r278197-lp151.2.15.1 libstdc++6-devel-gcc7-7.5.0+r278197-lp151.2.15.1 libubsan0-7.5.0+r278197-lp151.2.15.1 libubsan0-debuginfo-7.5.0+r278197-lp151.2.15.1 - openSUSE Leap 15.1 (noarch): gcc7-info-7.5.0+r278197-lp151.2.15.1 - openSUSE Leap 15.1 (x86_64): gcc7-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-ada-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-c++-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-go-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-objc-32bit-7.5.0+r278197-lp151.2.15.1 libada7-32bit-7.5.0+r278197-lp151.2.15.1 libada7-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libasan4-32bit-7.5.0+r278197-lp151.2.15.1 libasan4-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libcilkrts5-32bit-7.5.0+r278197-lp151.2.15.1 libcilkrts5-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libgfortran4-32bit-7.5.0+r278197-lp151.2.15.1 libgfortran4-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libgo11-32bit-7.5.0+r278197-lp151.2.15.1 libgo11-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libstdc++6-devel-gcc7-32bit-7.5.0+r278197-lp151.2.15.1 libubsan0-32bit-7.5.0+r278197-lp151.2.15.1 libubsan0-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-13844.html https://bugzilla.suse.com/1150164 https://bugzilla.suse.com/1161913 https://bugzilla.suse.com/1167939 https://bugzilla.suse.com/1172798 https://bugzilla.suse.com/1178577 https://bugzilla.suse.com/1178614 https://bugzilla.suse.com/1178624 https://bugzilla.suse.com/1178675

1 0