December 2020 - openSUSE Security Announce

openSUSE-SU-2020:2301-1: moderate: Security update for gcc7
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2301-1 Rating: moderate References: #1150164 #1161913 #1167939 #1172798 #1178577 #1178614 #1178624 #1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue (bsc#1172798) - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel. - Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. [jsc#SLE-12209, bsc#1167939] - Fixed 32bit libgnat.so link. [bsc#1178675] - Fixed memcpy miscompilation on aarch64. [bsc#1178624, bsc#1178577] - Fixed debug line info for try/catch. [bsc#1178614] - Remove -mbranch-protection=standard (aarch64 flag) when gcc7 is used to build gcc7 (ie when ada is enabled) - Fixed corruption of pass private ->aux via DF. [gcc#94148] - Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888] - Fixed binutils release date detection issue. - Fixed register allocation issue with exception handling code on s390x. [bsc#1161913] - Fixed miscompilation of some atomic code on aarch64. [bsc#1150164] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2301=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cpp7-7.5.0+r278197-lp152.3.3.1 cpp7-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-7.5.0+r278197-lp152.3.3.1 gcc7-ada-7.5.0+r278197-lp152.3.3.1 gcc7-ada-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-c++-7.5.0+r278197-lp152.3.3.1 gcc7-c++-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-debugsource-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-go-7.5.0+r278197-lp152.3.3.1 gcc7-go-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-locale-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-objc-7.5.0+r278197-lp152.3.3.1 gcc7-objc-debuginfo-7.5.0+r278197-lp152.3.3.1 libada7-7.5.0+r278197-lp152.3.3.1 libada7-debuginfo-7.5.0+r278197-lp152.3.3.1 libasan4-7.5.0+r278197-lp152.3.3.1 libasan4-debuginfo-7.5.0+r278197-lp152.3.3.1 libcilkrts5-7.5.0+r278197-lp152.3.3.1 libcilkrts5-debuginfo-7.5.0+r278197-lp152.3.3.1 libgfortran4-7.5.0+r278197-lp152.3.3.1 libgfortran4-debuginfo-7.5.0+r278197-lp152.3.3.1 libgo11-7.5.0+r278197-lp152.3.3.1 libgo11-debuginfo-7.5.0+r278197-lp152.3.3.1 libstdc++6-devel-gcc7-7.5.0+r278197-lp152.3.3.1 libubsan0-7.5.0+r278197-lp152.3.3.1 libubsan0-debuginfo-7.5.0+r278197-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): gcc7-info-7.5.0+r278197-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): gcc7-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-ada-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-c++-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-go-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-objc-32bit-7.5.0+r278197-lp152.3.3.1 libada7-32bit-7.5.0+r278197-lp152.3.3.1 libada7-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libasan4-32bit-7.5.0+r278197-lp152.3.3.1 libasan4-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libcilkrts5-32bit-7.5.0+r278197-lp152.3.3.1 libcilkrts5-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libgfortran4-32bit-7.5.0+r278197-lp152.3.3.1 libgfortran4-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libgo11-32bit-7.5.0+r278197-lp152.3.3.1 libgo11-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libstdc++6-devel-gcc7-32bit-7.5.0+r278197-lp152.3.3.1 libubsan0-32bit-7.5.0+r278197-lp152.3.3.1 libubsan0-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13844.html https://bugzilla.suse.com/1150164 https://bugzilla.suse.com/1161913 https://bugzilla.suse.com/1167939 https://bugzilla.suse.com/1172798 https://bugzilla.suse.com/1178577 https://bugzilla.suse.com/1178614 https://bugzilla.suse.com/1178624 https://bugzilla.suse.com/1178675

1 0

openSUSE-SU-2020:2298-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2298-1 Rating: moderate References: #1115550 #1139398 #1142000 #1148566 #1173513 #1174162 Cross-References: CVE-2020-14145 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for openssh fixes the following issues: - CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513). - Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000) - Fixed an issue where oracle cluster with cluvfy using "scp" failing/missinterpreted (bsc#1148566). - Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162). - Added speculative hardening for key storage (bsc#1139398). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2298=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): openssh-7.9p1-lp151.4.18.1 openssh-cavs-7.9p1-lp151.4.18.1 openssh-cavs-debuginfo-7.9p1-lp151.4.18.1 openssh-debuginfo-7.9p1-lp151.4.18.1 openssh-debugsource-7.9p1-lp151.4.18.1 openssh-fips-7.9p1-lp151.4.18.1 openssh-helpers-7.9p1-lp151.4.18.1 openssh-helpers-debuginfo-7.9p1-lp151.4.18.1 - openSUSE Leap 15.1 (x86_64): openssh-askpass-gnome-7.9p1-lp151.4.18.1 openssh-askpass-gnome-debuginfo-7.9p1-lp151.4.18.1 openssh-askpass-gnome-debugsource-7.9p1-lp151.4.18.1 References: https://www.suse.com/security/cve/CVE-2020-14145.html https://bugzilla.suse.com/1115550 https://bugzilla.suse.com/1139398 https://bugzilla.suse.com/1142000 https://bugzilla.suse.com/1148566 https://bugzilla.suse.com/1173513 https://bugzilla.suse.com/1174162

1 0

openSUSE-SU-2020:2292-1: moderate: Security update for PackageKit
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2292-1 Rating: moderate References: #1169739 #1176930 Cross-References: CVE-2020-16121 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for PackageKit fixes the following issue: - CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930). - Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. (bsc#1169739) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2292=1 Package List: - openSUSE Leap 15.1 (x86_64): PackageKit-1.1.10-lp151.8.12.1 PackageKit-backend-zypp-1.1.10-lp151.8.12.1 PackageKit-backend-zypp-debuginfo-1.1.10-lp151.8.12.1 PackageKit-debuginfo-1.1.10-lp151.8.12.1 PackageKit-debugsource-1.1.10-lp151.8.12.1 PackageKit-devel-1.1.10-lp151.8.12.1 PackageKit-devel-debuginfo-1.1.10-lp151.8.12.1 PackageKit-gstreamer-plugin-1.1.10-lp151.8.12.1 PackageKit-gstreamer-plugin-debuginfo-1.1.10-lp151.8.12.1 PackageKit-gtk3-module-1.1.10-lp151.8.12.1 PackageKit-gtk3-module-debuginfo-1.1.10-lp151.8.12.1 libpackagekit-glib2-18-1.1.10-lp151.8.12.1 libpackagekit-glib2-18-debuginfo-1.1.10-lp151.8.12.1 libpackagekit-glib2-devel-1.1.10-lp151.8.12.1 typelib-1_0-PackageKitGlib-1_0-1.1.10-lp151.8.12.1 - openSUSE Leap 15.1 (noarch): PackageKit-branding-upstream-1.1.10-lp151.8.12.1 PackageKit-lang-1.1.10-lp151.8.12.1 References: https://www.suse.com/security/cve/CVE-2020-16121.html https://bugzilla.suse.com/1169739 https://bugzilla.suse.com/1176930

1 0

openSUSE-SU-2020:2286-1: important: Security update for slurm_18_08
by opensuse-security＠opensuse.org 19 Dec '20

19 Dec '20

openSUSE Security Update: Security update for slurm_18_08 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2286-1 Rating: important References: #1178890 #1178891 Cross-References: CVE-2020-27745 CVE-2020-27746 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for slurm_18_08 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem (bsc#1178890). - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command (bsc#1178891). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2286=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.9-lp151.6.1 libpmi0-debuginfo-18.08.9-lp151.6.1 libslurm33-18.08.9-lp151.6.1 libslurm33-debuginfo-18.08.9-lp151.6.1 perl-slurm-18.08.9-lp151.6.1 perl-slurm-debuginfo-18.08.9-lp151.6.1 slurm-18.08.9-lp151.6.1 slurm-auth-none-18.08.9-lp151.6.1 slurm-auth-none-debuginfo-18.08.9-lp151.6.1 slurm-config-18.08.9-lp151.6.1 slurm-config-man-18.08.9-lp151.6.1 slurm-cray-18.08.9-lp151.6.1 slurm-cray-debuginfo-18.08.9-lp151.6.1 slurm-debuginfo-18.08.9-lp151.6.1 slurm-debugsource-18.08.9-lp151.6.1 slurm-devel-18.08.9-lp151.6.1 slurm-doc-18.08.9-lp151.6.1 slurm-hdf5-18.08.9-lp151.6.1 slurm-hdf5-debuginfo-18.08.9-lp151.6.1 slurm-lua-18.08.9-lp151.6.1 slurm-lua-debuginfo-18.08.9-lp151.6.1 slurm-munge-18.08.9-lp151.6.1 slurm-munge-debuginfo-18.08.9-lp151.6.1 slurm-node-18.08.9-lp151.6.1 slurm-node-debuginfo-18.08.9-lp151.6.1 slurm-openlava-18.08.9-lp151.6.1 slurm-pam_slurm-18.08.9-lp151.6.1 slurm-pam_slurm-debuginfo-18.08.9-lp151.6.1 slurm-plugins-18.08.9-lp151.6.1 slurm-plugins-debuginfo-18.08.9-lp151.6.1 slurm-seff-18.08.9-lp151.6.1 slurm-sjstat-18.08.9-lp151.6.1 slurm-slurmdbd-18.08.9-lp151.6.1 slurm-slurmdbd-debuginfo-18.08.9-lp151.6.1 slurm-sql-18.08.9-lp151.6.1 slurm-sql-debuginfo-18.08.9-lp151.6.1 slurm-sview-18.08.9-lp151.6.1 slurm-sview-debuginfo-18.08.9-lp151.6.1 slurm-torque-18.08.9-lp151.6.1 slurm-torque-debuginfo-18.08.9-lp151.6.1 slurm-webdoc-18.08.9-lp151.6.1 References: https://www.suse.com/security/cve/CVE-2020-27745.html https://www.suse.com/security/cve/CVE-2020-27746.html https://bugzilla.suse.com/1178890 https://bugzilla.suse.com/1178891

1 0

openSUSE-SU-2020:2282-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 18 Dec '20

18 Dec '20

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2282-1 Rating: moderate References: #1177120 Cross-References: CVE-2020-26137 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-urllib3 fixes the following issues: - CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bsc#1177120). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2282=1 Package List: - openSUSE Leap 15.1 (noarch): python2-urllib3-1.24-lp151.2.9.1 python2-urllib3-test-1.24-lp151.2.9.1 python3-urllib3-1.24-lp151.2.9.1 python3-urllib3-test-1.24-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-26137.html https://bugzilla.suse.com/1177120

1 0

openSUSE-SU-2020:2276-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 18 Dec '20

18 Dec '20

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2276-1 Rating: moderate References: #1104457 #1118459 #1130721 #1144504 #1149458 #1157763 Cross-References: CVE-2019-12625 CVE-2019-12900 CVE-2019-15961 CVE-2019-1785 CVE-2019-1786 CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 CVE-2019-1798 CVE-2020-3123 CVE-2020-3327 CVE-2020-3341 CVE-2020-3350 CVE-2020-3481 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for clamav fixes the following issues: clamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459) Note that libclamav was changed incompatible, if you have a 3rd party application that uses libclamav, it needs to be rebuilt. Update to 0.103.0 * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Fix clamav-milter.service (requires clamd.service to run) Update to 0.102.4 * CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue. * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. Update to 0.102.3 * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. * Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents. * Fix a couple of minor memory leaks. * Updated libclamunrar to UnRAR 5.9.2. Update to 0.102.2: * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. - The freshclam.service should not be started before the network is online (it checks for updates immediately upon service start) Update to 0.102.1: * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. Update to 0.102.0: * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 Update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504) Update to version 0.101.3: * bsc#1144504: ZIP bomb causes extreme CPU spikes Update to version 0.101.2 (bsc#1130721) * CVE-2019-1787: An out-of-bounds heap read condition may occur when scanning PDF documents. The defect is a failure to correctly keep track of the number of bytes remaining in a buffer when indexing file data. * CVE-2019-1789: An out-of-bounds heap read condition may occur when scanning PE files (i.e. Windows EXE and DLL files) that have been packed using Aspack as a result of inadequate bound-checking. * CVE-2019-1788: An out-of-bounds heap write condition may occur when scanning OLE2 files such as Microsoft Office 97-2003 documents. The invalid write happens when an invalid pointer is mistakenly used to initialize a 32bit integer to zero. This is likely to crash the application. * CVE-2019-1786: An out-of-bounds heap read condition may occur when scanning malformed PDF documents as a result of improper bounds-checking. * CVE-2019-1785: A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives. * CVE-2019-1798: A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2276=1 Package List: - openSUSE Leap 15.2 (x86_64): clamav-0.103.0-lp152.6.3.1 clamav-debuginfo-0.103.0-lp152.6.3.1 clamav-debugsource-0.103.0-lp152.6.3.1 clamav-devel-0.103.0-lp152.6.3.1 libclamav9-0.103.0-lp152.6.3.1 libclamav9-debuginfo-0.103.0-lp152.6.3.1 libfreshclam2-0.103.0-lp152.6.3.1 libfreshclam2-debuginfo-0.103.0-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://www.suse.com/security/cve/CVE-2019-15961.html https://www.suse.com/security/cve/CVE-2019-1785.html https://www.suse.com/security/cve/CVE-2019-1786.html https://www.suse.com/security/cve/CVE-2019-1787.html https://www.suse.com/security/cve/CVE-2019-1788.html https://www.suse.com/security/cve/CVE-2019-1789.html https://www.suse.com/security/cve/CVE-2019-1798.html https://www.suse.com/security/cve/CVE-2020-3123.html https://www.suse.com/security/cve/CVE-2020-3327.html https://www.suse.com/security/cve/CVE-2020-3341.html https://www.suse.com/security/cve/CVE-2020-3350.html https://www.suse.com/security/cve/CVE-2020-3481.html https://bugzilla.suse.com/1104457 https://bugzilla.suse.com/1118459 https://bugzilla.suse.com/1130721 https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1157763

1 0

openSUSE-SU-2020:2269-1: important: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 17 Dec '20

17 Dec '20

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2269-1 Rating: important References: #1155346 #1176029 #1177479 #1177575 #1177673 #1177793 #1179491 Cross-References: CVE-2020-1971 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2020-1971: Fixed a null pointer dereference in EDIPARTYNAME (bsc#1179491). - Initialized dh->nid to NID_undef in DH_new_method() (bsc#1177673). - Fixed a test failure in apache_ssl in fips mode (bsc#1177793). - Renamed BN_get_rfc3526_prime_* functions back to get_rfc3526_prime_* (bsc#1177575). - Restored private key check in EC_KEY_check_key (bsc#1177479). - Added shared secret KAT to FIPS DH selftest (bsc#1176029). - Included ECDH/DH Requirements from SP800-56Arev3 (bsc#1176029). - Used SHA-2 in the RSA pairwise consistency check (bsc#1155346) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2269=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp151.5.20.1 libopenssl10-1.0.2p-lp151.5.20.1 libopenssl10-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-1.0.2p-lp151.5.20.1 libopenssl1_0_0-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-hmac-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-1.0.2p-lp151.5.20.1 openssl-1_0_0-cavs-1.0.2p-lp151.5.20.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-debugsource-1.0.2p-lp151.5.20.1 - openSUSE Leap 15.1 (noarch): openssl-1_0_0-doc-1.0.2p-lp151.5.20.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp151.5.20.1 References: https://www.suse.com/security/cve/CVE-2020-1971.html https://bugzilla.suse.com/1155346 https://bugzilla.suse.com/1176029 https://bugzilla.suse.com/1177479 https://bugzilla.suse.com/1177575 https://bugzilla.suse.com/1177673 https://bugzilla.suse.com/1177793 https://bugzilla.suse.com/1179491

1 0

openSUSE-SU-2020:2268-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 17 Dec '20

17 Dec '20

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2268-1 Rating: moderate References: #1104457 #1118459 #1130721 #1144504 #1149458 #1157763 Cross-References: CVE-2019-12625 CVE-2019-12900 CVE-2019-15961 CVE-2019-1785 CVE-2019-1786 CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 CVE-2019-1798 CVE-2020-3123 CVE-2020-3327 CVE-2020-3341 CVE-2020-3350 CVE-2020-3481 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for clamav fixes the following issues: clamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459) Note that libclamav was changed incompatible, if you have a 3rd party application that uses libclamav, it needs to be rebuilt. Update to 0.103.0 * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Fix clamav-milter.service (requires clamd.service to run) Update to 0.102.4 * CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue. * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. Update to 0.102.3 * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. * Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents. * Fix a couple of minor memory leaks. * Updated libclamunrar to UnRAR 5.9.2. Update to 0.102.2: * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. - The freshclam.service should not be started before the network is online (it checks for updates immediately upon service start) Update to 0.102.1: * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. Update to 0.102.0: * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 Update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504) Update to version 0.101.3: * bsc#1144504: ZIP bomb causes extreme CPU spikes Update to version 0.101.2 (bsc#1130721) * CVE-2019-1787: An out-of-bounds heap read condition may occur when scanning PDF documents. The defect is a failure to correctly keep track of the number of bytes remaining in a buffer when indexing file data. * CVE-2019-1789: An out-of-bounds heap read condition may occur when scanning PE files (i.e. Windows EXE and DLL files) that have been packed using Aspack as a result of inadequate bound-checking. * CVE-2019-1788: An out-of-bounds heap write condition may occur when scanning OLE2 files such as Microsoft Office 97-2003 documents. The invalid write happens when an invalid pointer is mistakenly used to initialize a 32bit integer to zero. This is likely to crash the application. * CVE-2019-1786: An out-of-bounds heap read condition may occur when scanning malformed PDF documents as a result of improper bounds-checking. * CVE-2019-1785: A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives. * CVE-2019-1798: A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2268=1 Package List: - openSUSE Leap 15.1 (x86_64): clamav-0.103.0-lp151.2.12.1 clamav-debuginfo-0.103.0-lp151.2.12.1 clamav-debugsource-0.103.0-lp151.2.12.1 clamav-devel-0.103.0-lp151.2.12.1 libclamav9-0.103.0-lp151.2.12.1 libclamav9-debuginfo-0.103.0-lp151.2.12.1 libfreshclam2-0.103.0-lp151.2.12.1 libfreshclam2-debuginfo-0.103.0-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://www.suse.com/security/cve/CVE-2019-15961.html https://www.suse.com/security/cve/CVE-2019-1785.html https://www.suse.com/security/cve/CVE-2019-1786.html https://www.suse.com/security/cve/CVE-2019-1787.html https://www.suse.com/security/cve/CVE-2019-1788.html https://www.suse.com/security/cve/CVE-2019-1789.html https://www.suse.com/security/cve/CVE-2019-1798.html https://www.suse.com/security/cve/CVE-2020-3123.html https://www.suse.com/security/cve/CVE-2020-3327.html https://www.suse.com/security/cve/CVE-2020-3341.html https://www.suse.com/security/cve/CVE-2020-3350.html https://www.suse.com/security/cve/CVE-2020-3481.html https://bugzilla.suse.com/1104457 https://bugzilla.suse.com/1118459 https://bugzilla.suse.com/1130721 https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1157763

1 0

openSUSE-SU-2020:2261-1: moderate: Security update for audacity
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for audacity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2261-1 Rating: moderate References: #1179449 Cross-References: CVE-2020-11867 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for audacity fixes the following issues: - CVE-2020-11867: Avoid saving temporary files to /var/tmp/audacity-$USER by default, which permissions are set to 755. (bsc#1179449) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2261=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2261=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2261=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2261=1 Package List: - openSUSE Leap 15.2 (noarch): audacity-lang-2.2.2-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): audacity-2.2.2-lp152.4.3.1 audacity-debuginfo-2.2.2-lp152.4.3.1 audacity-debugsource-2.2.2-lp152.4.3.1 - openSUSE Leap 15.1 (noarch): audacity-lang-2.2.2-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): audacity-2.2.2-lp151.3.3.1 audacity-debuginfo-2.2.2-lp151.3.3.1 audacity-debugsource-2.2.2-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): audacity-2.2.2-bp152.4.3.1 audacity-debuginfo-2.2.2-bp152.4.3.1 audacity-debugsource-2.2.2-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): audacity-lang-2.2.2-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): audacity-2.2.2-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): audacity-lang-2.2.2-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-11867.html https://bugzilla.suse.com/1179449

1 0

openSUSE-SU-2020:2264-1: important: Security update for gdm
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2264-1 Rating: important References: #1178150 Cross-References: CVE-2020-16125 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdm fixes the following issues: - CVE-2020-16125: Fixed a privilege escalation (bsc#1178150). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2264=1 Package List: - openSUSE Leap 15.1 (x86_64): gdm-3.26.2.1-lp151.16.10.1 gdm-debuginfo-3.26.2.1-lp151.16.10.1 gdm-debugsource-3.26.2.1-lp151.16.10.1 gdm-devel-3.26.2.1-lp151.16.10.1 libgdm1-3.26.2.1-lp151.16.10.1 libgdm1-debuginfo-3.26.2.1-lp151.16.10.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp151.16.10.1 - openSUSE Leap 15.1 (noarch): gdm-branding-upstream-3.26.2.1-lp151.16.10.1 gdm-lang-3.26.2.1-lp151.16.10.1 gdmflexiserver-3.26.2.1-lp151.16.10.1 References: https://www.suse.com/security/cve/CVE-2020-16125.html https://bugzilla.suse.com/1178150

1 0