February 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0213-1: important: Security update for pcp
by opensuse-security＠opensuse.org 12 Feb '20

12 Feb '20

openSUSE Security Update: Security update for pcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0213-1 Rating: important References: #1129991 #1152763 #1153921 Cross-References: CVE-2019-3695 CVE-2019-3696 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for pcp fixes the following issues: Security issue fixed: - CVE-2019-3695: Fixed a local privilege escalation of the pcp user during package update (bsc#1152763). Non-security issue fixed: - Fixed an dependency issue with pcp2csv (bsc#1129991). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-213=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpcp-devel-4.3.1-lp151.2.3.1 libpcp3-4.3.1-lp151.2.3.1 libpcp3-debuginfo-4.3.1-lp151.2.3.1 libpcp_gui2-4.3.1-lp151.2.3.1 libpcp_gui2-debuginfo-4.3.1-lp151.2.3.1 libpcp_import1-4.3.1-lp151.2.3.1 libpcp_import1-debuginfo-4.3.1-lp151.2.3.1 libpcp_mmv1-4.3.1-lp151.2.3.1 libpcp_mmv1-debuginfo-4.3.1-lp151.2.3.1 libpcp_trace2-4.3.1-lp151.2.3.1 libpcp_trace2-debuginfo-4.3.1-lp151.2.3.1 libpcp_web1-4.3.1-lp151.2.3.1 libpcp_web1-debuginfo-4.3.1-lp151.2.3.1 pcp-4.3.1-lp151.2.3.1 pcp-conf-4.3.1-lp151.2.3.1 pcp-debuginfo-4.3.1-lp151.2.3.1 pcp-debugsource-4.3.1-lp151.2.3.1 pcp-devel-4.3.1-lp151.2.3.1 pcp-devel-debuginfo-4.3.1-lp151.2.3.1 pcp-export-pcp2elasticsearch-4.3.1-lp151.2.3.1 pcp-export-pcp2graphite-4.3.1-lp151.2.3.1 pcp-export-pcp2influxdb-4.3.1-lp151.2.3.1 pcp-export-pcp2json-4.3.1-lp151.2.3.1 pcp-export-pcp2spark-4.3.1-lp151.2.3.1 pcp-export-pcp2xml-4.3.1-lp151.2.3.1 pcp-export-pcp2zabbix-4.3.1-lp151.2.3.1 pcp-export-zabbix-agent-4.3.1-lp151.2.3.1 pcp-export-zabbix-agent-debuginfo-4.3.1-lp151.2.3.1 pcp-gui-4.3.1-lp151.2.3.1 pcp-gui-debuginfo-4.3.1-lp151.2.3.1 pcp-import-collectl2pcp-4.3.1-lp151.2.3.1 pcp-import-collectl2pcp-debuginfo-4.3.1-lp151.2.3.1 pcp-import-ganglia2pcp-4.3.1-lp151.2.3.1 pcp-import-iostat2pcp-4.3.1-lp151.2.3.1 pcp-import-mrtg2pcp-4.3.1-lp151.2.3.1 pcp-import-sar2pcp-4.3.1-lp151.2.3.1 pcp-manager-4.3.1-lp151.2.3.1 pcp-manager-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-activemq-4.3.1-lp151.2.3.1 pcp-pmda-apache-4.3.1-lp151.2.3.1 pcp-pmda-apache-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-bash-4.3.1-lp151.2.3.1 pcp-pmda-bash-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-bind2-4.3.1-lp151.2.3.1 pcp-pmda-bonding-4.3.1-lp151.2.3.1 pcp-pmda-cifs-4.3.1-lp151.2.3.1 pcp-pmda-cifs-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-cisco-4.3.1-lp151.2.3.1 pcp-pmda-cisco-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-dbping-4.3.1-lp151.2.3.1 pcp-pmda-dm-4.3.1-lp151.2.3.1 pcp-pmda-dm-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-docker-4.3.1-lp151.2.3.1 pcp-pmda-docker-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-ds389-4.3.1-lp151.2.3.1 pcp-pmda-ds389log-4.3.1-lp151.2.3.1 pcp-pmda-elasticsearch-4.3.1-lp151.2.3.1 pcp-pmda-gfs2-4.3.1-lp151.2.3.1 pcp-pmda-gfs2-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-gluster-4.3.1-lp151.2.3.1 pcp-pmda-gpfs-4.3.1-lp151.2.3.1 pcp-pmda-gpsd-4.3.1-lp151.2.3.1 pcp-pmda-haproxy-4.3.1-lp151.2.3.1 pcp-pmda-infiniband-4.3.1-lp151.2.3.1 pcp-pmda-infiniband-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-json-4.3.1-lp151.2.3.1 pcp-pmda-lmsensors-4.3.1-lp151.2.3.1 pcp-pmda-logger-4.3.1-lp151.2.3.1 pcp-pmda-logger-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-lustre-4.3.1-lp151.2.3.1 pcp-pmda-lustrecomm-4.3.1-lp151.2.3.1 pcp-pmda-lustrecomm-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-mailq-4.3.1-lp151.2.3.1 pcp-pmda-mailq-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-memcache-4.3.1-lp151.2.3.1 pcp-pmda-mic-4.3.1-lp151.2.3.1 pcp-pmda-mounts-4.3.1-lp151.2.3.1 pcp-pmda-mounts-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-mysql-4.3.1-lp151.2.3.1 pcp-pmda-named-4.3.1-lp151.2.3.1 pcp-pmda-netfilter-4.3.1-lp151.2.3.1 pcp-pmda-news-4.3.1-lp151.2.3.1 pcp-pmda-nfsclient-4.3.1-lp151.2.3.1 pcp-pmda-nginx-4.3.1-lp151.2.3.1 pcp-pmda-nutcracker-4.3.1-lp151.2.3.1 pcp-pmda-nvidia-gpu-4.3.1-lp151.2.3.1 pcp-pmda-nvidia-gpu-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-oracle-4.3.1-lp151.2.3.1 pcp-pmda-papi-4.3.1-lp151.2.3.1 pcp-pmda-papi-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-pdns-4.3.1-lp151.2.3.1 pcp-pmda-perfevent-4.3.1-lp151.2.3.1 pcp-pmda-perfevent-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-postfix-4.3.1-lp151.2.3.1 pcp-pmda-prometheus-4.3.1-lp151.2.3.1 pcp-pmda-redis-4.3.1-lp151.2.3.1 pcp-pmda-roomtemp-4.3.1-lp151.2.3.1 pcp-pmda-roomtemp-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-rpm-4.3.1-lp151.2.3.1 pcp-pmda-rpm-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-rsyslog-4.3.1-lp151.2.3.1 pcp-pmda-samba-4.3.1-lp151.2.3.1 pcp-pmda-sendmail-4.3.1-lp151.2.3.1 pcp-pmda-sendmail-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-shping-4.3.1-lp151.2.3.1 pcp-pmda-shping-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-slurm-4.3.1-lp151.2.3.1 pcp-pmda-smart-4.3.1-lp151.2.3.1 pcp-pmda-smart-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-snmp-4.3.1-lp151.2.3.1 pcp-pmda-summary-4.3.1-lp151.2.3.1 pcp-pmda-summary-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-systemd-4.3.1-lp151.2.3.1 pcp-pmda-systemd-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-trace-4.3.1-lp151.2.3.1 pcp-pmda-trace-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-unbound-4.3.1-lp151.2.3.1 pcp-pmda-vmware-4.3.1-lp151.2.3.1 pcp-pmda-weblog-4.3.1-lp151.2.3.1 pcp-pmda-weblog-debuginfo-4.3.1-lp151.2.3.1 pcp-pmda-zimbra-4.3.1-lp151.2.3.1 pcp-pmda-zswap-4.3.1-lp151.2.3.1 pcp-system-tools-4.3.1-lp151.2.3.1 pcp-system-tools-debuginfo-4.3.1-lp151.2.3.1 pcp-testsuite-4.3.1-lp151.2.3.1 pcp-testsuite-debuginfo-4.3.1-lp151.2.3.1 pcp-webapi-4.3.1-lp151.2.3.1 pcp-webapi-debuginfo-4.3.1-lp151.2.3.1 pcp-zeroconf-4.3.1-lp151.2.3.1 perl-PCP-LogImport-4.3.1-lp151.2.3.1 perl-PCP-LogImport-debuginfo-4.3.1-lp151.2.3.1 perl-PCP-LogSummary-4.3.1-lp151.2.3.1 perl-PCP-MMV-4.3.1-lp151.2.3.1 perl-PCP-MMV-debuginfo-4.3.1-lp151.2.3.1 perl-PCP-PMDA-4.3.1-lp151.2.3.1 perl-PCP-PMDA-debuginfo-4.3.1-lp151.2.3.1 python3-pcp-4.3.1-lp151.2.3.1 python3-pcp-debuginfo-4.3.1-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): pcp-doc-4.3.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-3695.html https://www.suse.com/security/cve/CVE-2019-3696.html https://bugzilla.suse.com/1129991 https://bugzilla.suse.com/1152763 https://bugzilla.suse.com/1153921 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0214-1: moderate: Security update for rubygem-rack
by opensuse-security＠opensuse.org 12 Feb '20

12 Feb '20

openSUSE Security Update: Security update for rubygem-rack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0214-1 Rating: moderate References: #1114828 #1116600 #1159548 Cross-References: CVE-2018-16471 CVE-2019-16782 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for rubygem-rack to version 2.0.8 fixes the following issues: - CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600). - CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-214=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-rack-2.0.8-lp151.3.3.1 ruby2.5-rubygem-rack-doc-2.0.8-lp151.3.3.1 ruby2.5-rubygem-rack-testsuite-2.0.8-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-16471.html https://www.suse.com/security/cve/CVE-2019-16782.html https://bugzilla.suse.com/1114828 https://bugzilla.suse.com/1116600 https://bugzilla.suse.com/1159548 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0210-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Feb '20

12 Feb '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0210-1 Rating: important References: #1162833 Cross-References: CVE-2019-18197 CVE-2019-19880 CVE-2019-19923 CVE-2019-19925 CVE-2019-19926 CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-2020-6398 CVE-2020-6399 CVE-2020-6400 CVE-2020-6401 CVE-2020-6402 CVE-2020-6403 CVE-2020-6404 CVE-2020-6405 CVE-2020-6406 CVE-2020-6408 CVE-2020-6409 CVE-2020-6410 CVE-2020-6411 CVE-2020-6412 CVE-2020-6413 CVE-2020-6414 CVE-2020-6415 CVE-2020-6416 CVE-2020-6417 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 38 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to version 80.0.3987.87 (boo#1162833). Security issues fixed: - CVE-2020-6381: Integer overflow in JavaScript (boo#1162833). - CVE-2020-6382: Type Confusion in JavaScript (boo#1162833). - CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833). - CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833). - CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833). - CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833). - CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833). - CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6390: Out of bounds memory access in streams (boo#1162833). - CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833). - CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833). - CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833). - CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833). - CVE-2020-6397: Incorrect security UI in sharing (boo#1162833). - CVE-2020-6398: Uninitialized use in PDFium (boo#1162833). - CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833). - CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833). - CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833). - CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833). - CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6405: Out of bounds read in SQLite (boo#1162833). - CVE-2020-6406: Use after free in audio (boo#1162833). - CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833). - CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833). - CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833). - CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833). - CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833). - CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833). - CVE-2020-6416: Insufficient data validation in streams (boo#1162833). - CVE-2020-6417: Inappropriate implementation in installer (boo#1162833). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-210=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-80.0.3987.87-bp151.3.59.1 chromium-80.0.3987.87-bp151.3.59.1 References: https://www.suse.com/security/cve/CVE-2019-18197.html https://www.suse.com/security/cve/CVE-2019-19880.html https://www.suse.com/security/cve/CVE-2019-19923.html https://www.suse.com/security/cve/CVE-2019-19925.html https://www.suse.com/security/cve/CVE-2019-19926.html https://www.suse.com/security/cve/CVE-2020-6381.html https://www.suse.com/security/cve/CVE-2020-6382.html https://www.suse.com/security/cve/CVE-2020-6385.html https://www.suse.com/security/cve/CVE-2020-6387.html https://www.suse.com/security/cve/CVE-2020-6388.html https://www.suse.com/security/cve/CVE-2020-6389.html https://www.suse.com/security/cve/CVE-2020-6390.html https://www.suse.com/security/cve/CVE-2020-6391.html https://www.suse.com/security/cve/CVE-2020-6392.html https://www.suse.com/security/cve/CVE-2020-6393.html https://www.suse.com/security/cve/CVE-2020-6394.html https://www.suse.com/security/cve/CVE-2020-6395.html https://www.suse.com/security/cve/CVE-2020-6396.html https://www.suse.com/security/cve/CVE-2020-6397.html https://www.suse.com/security/cve/CVE-2020-6398.html https://www.suse.com/security/cve/CVE-2020-6399.html https://www.suse.com/security/cve/CVE-2020-6400.html https://www.suse.com/security/cve/CVE-2020-6401.html https://www.suse.com/security/cve/CVE-2020-6402.html https://www.suse.com/security/cve/CVE-2020-6403.html https://www.suse.com/security/cve/CVE-2020-6404.html https://www.suse.com/security/cve/CVE-2020-6405.html https://www.suse.com/security/cve/CVE-2020-6406.html https://www.suse.com/security/cve/CVE-2020-6408.html https://www.suse.com/security/cve/CVE-2020-6409.html https://www.suse.com/security/cve/CVE-2020-6410.html https://www.suse.com/security/cve/CVE-2020-6411.html https://www.suse.com/security/cve/CVE-2020-6412.html https://www.suse.com/security/cve/CVE-2020-6413.html https://www.suse.com/security/cve/CVE-2020-6414.html https://www.suse.com/security/cve/CVE-2020-6415.html https://www.suse.com/security/cve/CVE-2020-6416.html https://www.suse.com/security/cve/CVE-2020-6417.html https://bugzilla.suse.com/1162833 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0208-1: important: Security update for systemd
by opensuse-security＠opensuse.org 11 Feb '20

11 Feb '20

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0208-1 Rating: important References: #1084671 #1092920 #1106383 #1133495 #1151377 #1154256 #1155207 #1155574 #1156213 #1156482 #1158485 #1159814 #1161436 #1162108 Cross-References: CVE-2019-20386 CVE-2020-1712 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 12 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2020-1712 (bsc#bsc#1162108) Fix a heap use-after-free vulnerability, when asynchronous Polkit queries were performed while handling Dbus messages. A local unprivileged attacker could have abused this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted Dbus messages. - Use suse.pool.ntp.org server pool on SLE distros (jsc#SLE-7683) - libblkid: open device in nonblock mode. (bsc#1084671) - udev/cdrom_id: Do not open CD-rom in exclusive mode. (bsc#1154256) - bus_open leak sd_event_source when udevadm trigger。 (bsc#1161436 CVE-2019-20386) - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (bsc#1133495 bsc#1159814) - fileio: initialize errno to zero before we do fread() - fileio: try to read one byte too much in read_full_stream() - logind: consider "greeter" sessions suitable as "display" sessions of a user (bsc#1158485) - logind: never elect a session that is stopping as display - journal: include kmsg lines from the systemd process which exec()d us (#8078) - udevd: don't use monitor after manager_exit() - udevd: capitalize log messages in on_sigchld() - udevd: merge conditions to decrease indentation - Revert "udevd: fix crash when workers time out after exit is signal caught" - core: fragments of masked units ought not be considered for NeedDaemonReload (#7060) (bsc#1156482) - udevd: fix crash when workers time out after exit is signal caught - udevd: wait for workers to finish when exiting (bsc#1106383) - Improve bash completion support (bsc#1155207) * shell-completion: systemctl: do not list template units in {re,}start * shell-completion: systemctl: pass current word to all list_unit* * bash-completion: systemctl: pass current partial unit to list-unit* (bsc#1155207) * bash-completion: systemctl: use systemctl --no-pager * bash-completion: also suggest template unit files * bash-completion: systemctl: add missing options and verbs * bash-completion: use the first argument instead of the global variable (#6457) - networkd: VXLan Make group and remote variable separate (bsc#1156213) - networkd: vxlan require Remote= to be a non multicast address (#8117) (bsc#1156213) - fs-util: let's avoid unnecessary strerror() - fs-util: introduce inotify_add_watch_and_warn() helper - ask-password: improve log message when inotify limit is reached (bsc#1155574) - shared/install: failing with -ELOOP can be due to the use of an alias in install_error() (bsc#1151377) - man: alias names can't be used with enable command (bsc#1151377) - Add boot option to not use swap at system start (jsc#SLE-7689) - Allow YaST to select Iranian (Persian, Farsi) keyboard layout (bsc#1092920) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-208=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libsystemd0-234-lp151.26.7.1 libsystemd0-debuginfo-234-lp151.26.7.1 libsystemd0-mini-234-lp151.26.7.1 libsystemd0-mini-debuginfo-234-lp151.26.7.1 libudev-devel-234-lp151.26.7.1 libudev-mini-devel-234-lp151.26.7.1 libudev-mini1-234-lp151.26.7.1 libudev-mini1-debuginfo-234-lp151.26.7.1 libudev1-234-lp151.26.7.1 libudev1-debuginfo-234-lp151.26.7.1 nss-myhostname-234-lp151.26.7.1 nss-myhostname-debuginfo-234-lp151.26.7.1 nss-mymachines-234-lp151.26.7.1 nss-mymachines-debuginfo-234-lp151.26.7.1 nss-systemd-234-lp151.26.7.1 nss-systemd-debuginfo-234-lp151.26.7.1 systemd-234-lp151.26.7.1 systemd-container-234-lp151.26.7.1 systemd-container-debuginfo-234-lp151.26.7.1 systemd-coredump-234-lp151.26.7.1 systemd-coredump-debuginfo-234-lp151.26.7.1 systemd-debuginfo-234-lp151.26.7.1 systemd-debugsource-234-lp151.26.7.1 systemd-devel-234-lp151.26.7.1 systemd-logger-234-lp151.26.7.1 systemd-mini-234-lp151.26.7.1 systemd-mini-container-mini-234-lp151.26.7.1 systemd-mini-container-mini-debuginfo-234-lp151.26.7.1 systemd-mini-coredump-mini-234-lp151.26.7.1 systemd-mini-coredump-mini-debuginfo-234-lp151.26.7.1 systemd-mini-debuginfo-234-lp151.26.7.1 systemd-mini-debugsource-234-lp151.26.7.1 systemd-mini-devel-234-lp151.26.7.1 systemd-mini-sysvinit-234-lp151.26.7.1 systemd-sysvinit-234-lp151.26.7.1 udev-234-lp151.26.7.1 udev-debuginfo-234-lp151.26.7.1 udev-mini-234-lp151.26.7.1 udev-mini-debuginfo-234-lp151.26.7.1 - openSUSE Leap 15.1 (noarch): systemd-bash-completion-234-lp151.26.7.1 systemd-mini-bash-completion-234-lp151.26.7.1 - openSUSE Leap 15.1 (x86_64): libsystemd0-32bit-234-lp151.26.7.1 libsystemd0-32bit-debuginfo-234-lp151.26.7.1 libudev-devel-32bit-234-lp151.26.7.1 libudev1-32bit-234-lp151.26.7.1 libudev1-32bit-debuginfo-234-lp151.26.7.1 nss-myhostname-32bit-234-lp151.26.7.1 nss-myhostname-32bit-debuginfo-234-lp151.26.7.1 nss-mymachines-32bit-234-lp151.26.7.1 nss-mymachines-32bit-debuginfo-234-lp151.26.7.1 systemd-32bit-234-lp151.26.7.1 systemd-32bit-debuginfo-234-lp151.26.7.1 References: https://www.suse.com/security/cve/CVE-2019-20386.html https://www.suse.com/security/cve/CVE-2020-1712.html https://bugzilla.suse.com/1084671 https://bugzilla.suse.com/1092920 https://bugzilla.suse.com/1106383 https://bugzilla.suse.com/1133495 https://bugzilla.suse.com/1151377 https://bugzilla.suse.com/1154256 https://bugzilla.suse.com/1155207 https://bugzilla.suse.com/1155574 https://bugzilla.suse.com/1156213 https://bugzilla.suse.com/1156482 https://bugzilla.suse.com/1158485 https://bugzilla.suse.com/1159814 https://bugzilla.suse.com/1161436 https://bugzilla.suse.com/1162108 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0204-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 11 Feb '20

11 Feb '20

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0204-1 Rating: moderate References: #1160682 Cross-References: CVE-2019-20372 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following issues: - CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-204=1 Package List: - openSUSE Leap 15.1 (noarch): nginx-source-1.14.2-lp151.4.6.1 vim-plugin-nginx-1.14.2-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): nginx-1.14.2-lp151.4.6.1 nginx-debuginfo-1.14.2-lp151.4.6.1 nginx-debugsource-1.14.2-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-20372.html https://bugzilla.suse.com/1160682 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0209-1: important: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 11 Feb '20

11 Feb '20

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0209-1 Rating: important References: #1158667 #1161167 Cross-References: CVE-2020-0569 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libqt5-qtbase fixes the following issues: Security issue fixed: - CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167). Other issue fixed: - Fixed comboboxes not showing in correct location (bsc#1158667). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-209=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libQt5Bootstrap-devel-static-5.9.7-lp151.4.3.1 libQt5Concurrent-devel-5.9.7-lp151.4.3.1 libQt5Concurrent5-5.9.7-lp151.4.3.1 libQt5Concurrent5-debuginfo-5.9.7-lp151.4.3.1 libQt5Core-devel-5.9.7-lp151.4.3.1 libQt5Core5-5.9.7-lp151.4.3.1 libQt5Core5-debuginfo-5.9.7-lp151.4.3.1 libQt5DBus-devel-5.9.7-lp151.4.3.1 libQt5DBus-devel-debuginfo-5.9.7-lp151.4.3.1 libQt5DBus5-5.9.7-lp151.4.3.1 libQt5DBus5-debuginfo-5.9.7-lp151.4.3.1 libQt5Gui-devel-5.9.7-lp151.4.3.1 libQt5Gui5-5.9.7-lp151.4.3.1 libQt5Gui5-debuginfo-5.9.7-lp151.4.3.1 libQt5KmsSupport-devel-static-5.9.7-lp151.4.3.1 libQt5Network-devel-5.9.7-lp151.4.3.1 libQt5Network5-5.9.7-lp151.4.3.1 libQt5Network5-debuginfo-5.9.7-lp151.4.3.1 libQt5OpenGL-devel-5.9.7-lp151.4.3.1 libQt5OpenGL5-5.9.7-lp151.4.3.1 libQt5OpenGL5-debuginfo-5.9.7-lp151.4.3.1 libQt5OpenGLExtensions-devel-static-5.9.7-lp151.4.3.1 libQt5PlatformHeaders-devel-5.9.7-lp151.4.3.1 libQt5PlatformSupport-devel-static-5.9.7-lp151.4.3.1 libQt5PrintSupport-devel-5.9.7-lp151.4.3.1 libQt5PrintSupport5-5.9.7-lp151.4.3.1 libQt5PrintSupport5-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql-devel-5.9.7-lp151.4.3.1 libQt5Sql5-5.9.7-lp151.4.3.1 libQt5Sql5-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-mysql-5.9.7-lp151.4.3.1 libQt5Sql5-mysql-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-postgresql-5.9.7-lp151.4.3.1 libQt5Sql5-postgresql-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-sqlite-5.9.7-lp151.4.3.1 libQt5Sql5-sqlite-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-unixODBC-5.9.7-lp151.4.3.1 libQt5Sql5-unixODBC-debuginfo-5.9.7-lp151.4.3.1 libQt5Test-devel-5.9.7-lp151.4.3.1 libQt5Test5-5.9.7-lp151.4.3.1 libQt5Test5-debuginfo-5.9.7-lp151.4.3.1 libQt5Widgets-devel-5.9.7-lp151.4.3.1 libQt5Widgets5-5.9.7-lp151.4.3.1 libQt5Widgets5-debuginfo-5.9.7-lp151.4.3.1 libQt5Xml-devel-5.9.7-lp151.4.3.1 libQt5Xml5-5.9.7-lp151.4.3.1 libQt5Xml5-debuginfo-5.9.7-lp151.4.3.1 libqt5-qtbase-common-devel-5.9.7-lp151.4.3.1 libqt5-qtbase-common-devel-debuginfo-5.9.7-lp151.4.3.1 libqt5-qtbase-debugsource-5.9.7-lp151.4.3.1 libqt5-qtbase-devel-5.9.7-lp151.4.3.1 libqt5-qtbase-examples-5.9.7-lp151.4.3.1 libqt5-qtbase-examples-debuginfo-5.9.7-lp151.4.3.1 libqt5-qtbase-platformtheme-gtk3-5.9.7-lp151.4.3.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.9.7-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): libQt5Core-private-headers-devel-5.9.7-lp151.4.3.1 libQt5DBus-private-headers-devel-5.9.7-lp151.4.3.1 libQt5Gui-private-headers-devel-5.9.7-lp151.4.3.1 libQt5KmsSupport-private-headers-devel-5.9.7-lp151.4.3.1 libQt5Network-private-headers-devel-5.9.7-lp151.4.3.1 libQt5OpenGL-private-headers-devel-5.9.7-lp151.4.3.1 libQt5PlatformSupport-private-headers-devel-5.9.7-lp151.4.3.1 libQt5PrintSupport-private-headers-devel-5.9.7-lp151.4.3.1 libQt5Sql-private-headers-devel-5.9.7-lp151.4.3.1 libQt5Test-private-headers-devel-5.9.7-lp151.4.3.1 libQt5Widgets-private-headers-devel-5.9.7-lp151.4.3.1 libqt5-qtbase-private-headers-devel-5.9.7-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libQt5Bootstrap-devel-static-32bit-5.9.7-lp151.4.3.1 libQt5Concurrent-devel-32bit-5.9.7-lp151.4.3.1 libQt5Concurrent5-32bit-5.9.7-lp151.4.3.1 libQt5Concurrent5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Core-devel-32bit-5.9.7-lp151.4.3.1 libQt5Core5-32bit-5.9.7-lp151.4.3.1 libQt5Core5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5DBus-devel-32bit-5.9.7-lp151.4.3.1 libQt5DBus-devel-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5DBus5-32bit-5.9.7-lp151.4.3.1 libQt5DBus5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Gui-devel-32bit-5.9.7-lp151.4.3.1 libQt5Gui5-32bit-5.9.7-lp151.4.3.1 libQt5Gui5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Network-devel-32bit-5.9.7-lp151.4.3.1 libQt5Network5-32bit-5.9.7-lp151.4.3.1 libQt5Network5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5OpenGL-devel-32bit-5.9.7-lp151.4.3.1 libQt5OpenGL5-32bit-5.9.7-lp151.4.3.1 libQt5OpenGL5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5OpenGLExtensions-devel-static-32bit-5.9.7-lp151.4.3.1 libQt5PlatformSupport-devel-static-32bit-5.9.7-lp151.4.3.1 libQt5PrintSupport-devel-32bit-5.9.7-lp151.4.3.1 libQt5PrintSupport5-32bit-5.9.7-lp151.4.3.1 libQt5PrintSupport5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql-devel-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-mysql-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-mysql-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-postgresql-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-postgresql-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-sqlite-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-sqlite-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Sql5-unixODBC-32bit-5.9.7-lp151.4.3.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Test-devel-32bit-5.9.7-lp151.4.3.1 libQt5Test5-32bit-5.9.7-lp151.4.3.1 libQt5Test5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Widgets-devel-32bit-5.9.7-lp151.4.3.1 libQt5Widgets5-32bit-5.9.7-lp151.4.3.1 libQt5Widgets5-32bit-debuginfo-5.9.7-lp151.4.3.1 libQt5Xml-devel-32bit-5.9.7-lp151.4.3.1 libQt5Xml5-32bit-5.9.7-lp151.4.3.1 libQt5Xml5-32bit-debuginfo-5.9.7-lp151.4.3.1 libqt5-qtbase-examples-32bit-5.9.7-lp151.4.3.1 libqt5-qtbase-examples-32bit-debuginfo-5.9.7-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-0569.html https://bugzilla.suse.com/1158667 https://bugzilla.suse.com/1161167 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0207-1: important: Security update for wicked
by opensuse-security＠opensuse.org 11 Feb '20

11 Feb '20

openSUSE Security Update: Security update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0207-1 Rating: important References: #1160904 #1160906 Cross-References: CVE-2019-18903 CVE-2020-7217 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wicked fixes the following issues: - CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904). - CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-207=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): wicked-0.6.60-lp151.2.9.1 wicked-debuginfo-0.6.60-lp151.2.9.1 wicked-debugsource-0.6.60-lp151.2.9.1 wicked-service-0.6.60-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-18903.html https://www.suse.com/security/cve/CVE-2020-7217.html https://bugzilla.suse.com/1160904 https://bugzilla.suse.com/1160906 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0189-1: important: Security update for chromium
by opensuse-security＠opensuse.org 09 Feb '20

09 Feb '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0189-1 Rating: important References: #1162833 Cross-References: CVE-2019-18197 CVE-2019-19880 CVE-2019-19923 CVE-2019-19925 CVE-2019-19926 CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-2020-6398 CVE-2020-6399 CVE-2020-6400 CVE-2020-6401 CVE-2020-6402 CVE-2020-6403 CVE-2020-6404 CVE-2020-6405 CVE-2020-6406 CVE-2020-6408 CVE-2020-6409 CVE-2020-6410 CVE-2020-6411 CVE-2020-6412 CVE-2020-6413 CVE-2020-6414 CVE-2020-6415 CVE-2020-6416 CVE-2020-6417 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 38 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to version 80.0.3987.87 (boo#1162833). Security issues fixed: - CVE-2020-6381: Integer overflow in JavaScript (boo#1162833). - CVE-2020-6382: Type Confusion in JavaScript (boo#1162833). - CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833). - CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833). - CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833). - CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833). - CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833). - CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6390: Out of bounds memory access in streams (boo#1162833). - CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833). - CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833). - CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833). - CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833). - CVE-2020-6397: Incorrect security UI in sharing (boo#1162833). - CVE-2020-6398: Uninitialized use in PDFium (boo#1162833). - CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833). - CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833). - CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833). - CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833). - CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6405: Out of bounds read in SQLite (boo#1162833). - CVE-2020-6406: Use after free in audio (boo#1162833). - CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833). - CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833). - CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833). - CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833). - CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833). - CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833). - CVE-2020-6416: Insufficient data validation in streams (boo#1162833). - CVE-2020-6417: Inappropriate implementation in installer (boo#1162833). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-189=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-80.0.3987.87-lp151.2.63.1 chromedriver-debuginfo-80.0.3987.87-lp151.2.63.1 chromium-80.0.3987.87-lp151.2.63.1 chromium-debuginfo-80.0.3987.87-lp151.2.63.1 chromium-debugsource-80.0.3987.87-lp151.2.63.1 References: https://www.suse.com/security/cve/CVE-2019-18197.html https://www.suse.com/security/cve/CVE-2019-19880.html https://www.suse.com/security/cve/CVE-2019-19923.html https://www.suse.com/security/cve/CVE-2019-19925.html https://www.suse.com/security/cve/CVE-2019-19926.html https://www.suse.com/security/cve/CVE-2020-6381.html https://www.suse.com/security/cve/CVE-2020-6382.html https://www.suse.com/security/cve/CVE-2020-6385.html https://www.suse.com/security/cve/CVE-2020-6387.html https://www.suse.com/security/cve/CVE-2020-6388.html https://www.suse.com/security/cve/CVE-2020-6389.html https://www.suse.com/security/cve/CVE-2020-6390.html https://www.suse.com/security/cve/CVE-2020-6391.html https://www.suse.com/security/cve/CVE-2020-6392.html https://www.suse.com/security/cve/CVE-2020-6393.html https://www.suse.com/security/cve/CVE-2020-6394.html https://www.suse.com/security/cve/CVE-2020-6395.html https://www.suse.com/security/cve/CVE-2020-6396.html https://www.suse.com/security/cve/CVE-2020-6397.html https://www.suse.com/security/cve/CVE-2020-6398.html https://www.suse.com/security/cve/CVE-2020-6399.html https://www.suse.com/security/cve/CVE-2020-6400.html https://www.suse.com/security/cve/CVE-2020-6401.html https://www.suse.com/security/cve/CVE-2020-6402.html https://www.suse.com/security/cve/CVE-2020-6403.html https://www.suse.com/security/cve/CVE-2020-6404.html https://www.suse.com/security/cve/CVE-2020-6405.html https://www.suse.com/security/cve/CVE-2020-6406.html https://www.suse.com/security/cve/CVE-2020-6408.html https://www.suse.com/security/cve/CVE-2020-6409.html https://www.suse.com/security/cve/CVE-2020-6410.html https://www.suse.com/security/cve/CVE-2020-6411.html https://www.suse.com/security/cve/CVE-2020-6412.html https://www.suse.com/security/cve/CVE-2020-6413.html https://www.suse.com/security/cve/CVE-2020-6414.html https://www.suse.com/security/cve/CVE-2020-6415.html https://www.suse.com/security/cve/CVE-2020-6416.html https://www.suse.com/security/cve/CVE-2020-6417.html https://bugzilla.suse.com/1162833 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0187-1: moderate: Security update for ceph
by opensuse-security＠opensuse.org 08 Feb '20

08 Feb '20

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0187-1 Rating: moderate References: #1161074 #1161312 Cross-References: CVE-2020-1699 CVE-2020-1700 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ceph fixes the following issues: - CVE-2020-1700: Fixed a denial of service against the RGW server via connection leakage (bsc#1161312). - CVE-2020-1699: Fixed a information disclosure by improper URL checking (bsc#1161074). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-187=1 Package List: - openSUSE Leap 15.1 (noarch): ceph-dashboard-e2e-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-grafana-dashboards-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-dashboard-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-diskprediction-cloud-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-diskprediction-local-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-k8sevents-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-rook-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-ssh-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-prometheus-alerts-14.2.5.382+g8881d33957-lp151.2.10.1 - openSUSE Leap 15.1 (x86_64): ceph-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-base-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-base-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-common-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-common-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-debugsource-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-fuse-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-fuse-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mds-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mds-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mgr-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mon-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-mon-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-osd-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-osd-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-radosgw-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-radosgw-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-resource-agents-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-test-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-test-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 ceph-test-debugsource-14.2.5.382+g8881d33957-lp151.2.10.1 cephfs-shell-14.2.5.382+g8881d33957-lp151.2.10.1 libcephfs-devel-14.2.5.382+g8881d33957-lp151.2.10.1 libcephfs2-14.2.5.382+g8881d33957-lp151.2.10.1 libcephfs2-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 librados-devel-14.2.5.382+g8881d33957-lp151.2.10.1 librados-devel-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 librados2-14.2.5.382+g8881d33957-lp151.2.10.1 librados2-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 libradospp-devel-14.2.5.382+g8881d33957-lp151.2.10.1 libradosstriper-devel-14.2.5.382+g8881d33957-lp151.2.10.1 libradosstriper1-14.2.5.382+g8881d33957-lp151.2.10.1 libradosstriper1-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 librbd-devel-14.2.5.382+g8881d33957-lp151.2.10.1 librbd1-14.2.5.382+g8881d33957-lp151.2.10.1 librbd1-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 librgw-devel-14.2.5.382+g8881d33957-lp151.2.10.1 librgw2-14.2.5.382+g8881d33957-lp151.2.10.1 librgw2-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 python3-ceph-argparse-14.2.5.382+g8881d33957-lp151.2.10.1 python3-cephfs-14.2.5.382+g8881d33957-lp151.2.10.1 python3-cephfs-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rados-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rados-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rbd-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rbd-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rgw-14.2.5.382+g8881d33957-lp151.2.10.1 python3-rgw-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 rados-objclass-devel-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-fuse-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-fuse-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-mirror-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-mirror-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-nbd-14.2.5.382+g8881d33957-lp151.2.10.1 rbd-nbd-debuginfo-14.2.5.382+g8881d33957-lp151.2.10.1 References: https://www.suse.com/security/cve/CVE-2020-1699.html https://www.suse.com/security/cve/CVE-2020-1700.html https://bugzilla.suse.com/1161074 https://bugzilla.suse.com/1161312 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0179-1: moderate: Security update for ucl
by opensuse-security＠opensuse.org 06 Feb '20

06 Feb '20

openSUSE Security Update: Security update for ucl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0179-1 Rating: moderate References: #1094138 Cross-References: CVE-2018-11243 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucl fixes the following issues: CVE-2018-11243: Fix remotely triggerable DoS via double free (boo#1094138) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-179=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libucl1-1.03-bp151.4.3.1 ucl-devel-1.03-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-11243.html https://bugzilla.suse.com/1094138 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0