February 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0180-1: moderate: Security update for upx
by opensuse-security＠opensuse.org 06 Feb '20

06 Feb '20

openSUSE Security Update: Security update for upx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0180-1 Rating: moderate References: #1094138 #1141777 #1143839 #1159833 #1159920 Cross-References: CVE-2018-11243 CVE-2019-1010048 CVE-2019-14296 CVE-2019-20021 CVE-2019-20053 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for upx to version 3.96 fixes the following issues: - CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777). - CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839). - CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833). - CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920). - CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138). - Update to version 3.96 * Bug fixes: [CVE-2019-1010048, boo#1141777] [CVE-2019-14296, boo#1143839] [CVE-2019-20021, boo#1159833] [CVE-2019-20053, boo#1159920] [CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138] - Update to version 3.95 * Flag --force-pie when ET_DYN main program is not marked as DF_1_PIE * Better compatibility with varying layout of address space on Linux * Support for 4 PT_LOAD layout in ELF generated by binutils-2.31 * bug fixes, particularly better diagnosis of malformed input * bug fixes - see https://github.com/upx/upx/milestone/4 This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-180=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): upx-3.96-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-11243.html https://www.suse.com/security/cve/CVE-2019-1010048.html https://www.suse.com/security/cve/CVE-2019-14296.html https://www.suse.com/security/cve/CVE-2019-20021.html https://www.suse.com/security/cve/CVE-2019-20053.html https://bugzilla.suse.com/1094138 https://bugzilla.suse.com/1141777 https://bugzilla.suse.com/1143839 https://bugzilla.suse.com/1159833 https://bugzilla.suse.com/1159920 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0170-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 05 Feb '20

05 Feb '20

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0170-1 Rating: moderate References: #1159861 #1160369 #1161194 Cross-References: CVE-2019-19948 CVE-2019-19949 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issue fixed: - CVE-2019-19948: Fixed a heap-based buffer overflow in WriteSGIImage() (bsc#1159861). - CVE-2019-19949: Fixed a heap-based buffer over-read in WritePNGImage() (bsc#1160369). Non-security issue fixed: - Fixed an issue where converting tiff to png would lead to unviewable files (bsc#1161194). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-170=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ImageMagick-7.0.7.34-lp151.7.15.1 ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.15.1 ImageMagick-config-7-upstream-7.0.7.34-lp151.7.15.1 ImageMagick-debuginfo-7.0.7.34-lp151.7.15.1 ImageMagick-debugsource-7.0.7.34-lp151.7.15.1 ImageMagick-devel-7.0.7.34-lp151.7.15.1 ImageMagick-extra-7.0.7.34-lp151.7.15.1 ImageMagick-extra-debuginfo-7.0.7.34-lp151.7.15.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.15.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp151.7.15.1 libMagick++-devel-7.0.7.34-lp151.7.15.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.15.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.15.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.15.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.15.1 perl-PerlMagick-7.0.7.34-lp151.7.15.1 perl-PerlMagick-debuginfo-7.0.7.34-lp151.7.15.1 - openSUSE Leap 15.1 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp151.7.15.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.15.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp151.7.15.1 libMagick++-devel-32bit-7.0.7.34-lp151.7.15.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.15.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.15.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.15.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.15.1 - openSUSE Leap 15.1 (noarch): ImageMagick-doc-7.0.7.34-lp151.7.15.1 References: https://www.suse.com/security/cve/CVE-2019-19948.html https://www.suse.com/security/cve/CVE-2019-19949.html https://bugzilla.suse.com/1159861 https://bugzilla.suse.com/1160369 https://bugzilla.suse.com/1161194 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0165-1: important: Security update for wicked
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0165-1 Rating: important References: #1160903 #1160905 Cross-References: CVE-2019-18902 CVE-2020-7216 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wicked fixes the following issues: - CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903). - CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-165=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): wicked-0.6.60-lp151.2.6.1 wicked-debuginfo-0.6.60-lp151.2.6.1 wicked-debugsource-0.6.60-lp151.2.6.1 wicked-service-0.6.60-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-18902.html https://www.suse.com/security/cve/CVE-2020-7216.html https://bugzilla.suse.com/1160903 https://bugzilla.suse.com/1160905 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0166-1: moderate: Security update for e2fsprogs
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for e2fsprogs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0166-1 Rating: moderate References: #1160571 Cross-References: CVE-2019-5188 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for e2fsprogs fixes the following issues: - CVE-2019-5188: Fixed a code execution vulnerability in the directory rehashing functionality (bsc#1160571). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-166=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): e2fsprogs-1.43.8-lp151.5.12.1 e2fsprogs-debuginfo-1.43.8-lp151.5.12.1 e2fsprogs-debugsource-1.43.8-lp151.5.12.1 e2fsprogs-devel-1.43.8-lp151.5.12.1 libcom_err-devel-1.43.8-lp151.5.12.1 libcom_err-devel-static-1.43.8-lp151.5.12.1 libcom_err2-1.43.8-lp151.5.12.1 libcom_err2-debuginfo-1.43.8-lp151.5.12.1 libext2fs-devel-1.43.8-lp151.5.12.1 libext2fs-devel-static-1.43.8-lp151.5.12.1 libext2fs2-1.43.8-lp151.5.12.1 libext2fs2-debuginfo-1.43.8-lp151.5.12.1 - openSUSE Leap 15.1 (x86_64): e2fsprogs-32bit-debuginfo-1.43.8-lp151.5.12.1 libcom_err-devel-32bit-1.43.8-lp151.5.12.1 libcom_err2-32bit-1.43.8-lp151.5.12.1 libcom_err2-32bit-debuginfo-1.43.8-lp151.5.12.1 libext2fs-devel-32bit-1.43.8-lp151.5.12.1 libext2fs2-32bit-1.43.8-lp151.5.12.1 libext2fs2-32bit-debuginfo-1.43.8-lp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2019-5188.html https://bugzilla.suse.com/1160571 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0163-1: moderate: Security update for upx
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for upx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0163-1 Rating: moderate References: #1094138 #1141777 #1143839 #1159833 #1159920 Cross-References: CVE-2018-11243 CVE-2019-1010048 CVE-2019-14296 CVE-2019-20021 CVE-2019-20053 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for upx to version 3.96 fixes the following issues: - CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777). - CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839). - CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833). - CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920). - CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138). - Update to version 3.96 * Bug fixes: [CVE-2019-1010048, boo#1141777] [CVE-2019-14296, boo#1143839] [CVE-2019-20021, boo#1159833] [CVE-2019-20053, boo#1159920] [CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138] - Update to version 3.95 * Flag --force-pie when ET_DYN main program is not marked as DF_1_PIE * Better compatibility with varying layout of address space on Linux * Support for 4 PT_LOAD layout in ELF generated by binutils-2.31 * bug fixes, particularly better diagnosis of malformed input * bug fixes - see https://github.com/upx/upx/milestone/4 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-163=1 Package List: - openSUSE Leap 15.1 (x86_64): upx-3.96-lp151.3.3.1 upx-debuginfo-3.96-lp151.3.3.1 upx-debugsource-3.96-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11243.html https://www.suse.com/security/cve/CVE-2019-1010048.html https://www.suse.com/security/cve/CVE-2019-14296.html https://www.suse.com/security/cve/CVE-2019-20021.html https://www.suse.com/security/cve/CVE-2019-20053.html https://bugzilla.suse.com/1094138 https://bugzilla.suse.com/1141777 https://bugzilla.suse.com/1143839 https://bugzilla.suse.com/1159833 https://bugzilla.suse.com/1159920 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0160-1: important: Security update for python-reportlab
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for python-reportlab ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0160-1 Rating: important References: #1154370 Cross-References: CVE-2019-17626 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-reportlab fixes the following issues: - CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-160=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-reportlab-debuginfo-3.4.0-lp151.3.3.1 python-reportlab-debugsource-3.4.0-lp151.3.3.1 python2-reportlab-3.4.0-lp151.3.3.1 python2-reportlab-debuginfo-3.4.0-lp151.3.3.1 python3-reportlab-3.4.0-lp151.3.3.1 python3-reportlab-debuginfo-3.4.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-17626.html https://bugzilla.suse.com/1154370 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0162-1: moderate: Security update for ucl
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for ucl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0162-1 Rating: moderate References: #1094138 Cross-References: CVE-2018-11243 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucl fixes the following issues: CVE-2018-11243: Fix remotely triggerable DoS via double free (boo#1094138) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-162=1 Package List: - openSUSE Leap 15.1 (x86_64): libucl1-1.03-lp151.3.3.1 libucl1-debuginfo-1.03-lp151.3.3.1 ucl-debugsource-1.03-lp151.3.3.1 ucl-devel-1.03-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11243.html https://bugzilla.suse.com/1094138 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0156-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0156-1 Rating: moderate References: #1154328 Cross-References: CVE-2019-3693 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. (boo#1154328) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-156=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mailman-2.1.29-bp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-3693.html https://bugzilla.suse.com/1154328 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0