March 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0379-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0379-1 Rating: moderate References: #1159003 #1166481 Cross-References: CVE-2019-18802 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 (bsc#1166481) - lib: Add nghttp2_check_authority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static and dynamic lib - build: Add new flag ENABLE_STATIC_CRT for Windows - build: cmake: Support building nghttpx with systemd - third-party: Update neverbleed to fix memory leak - nghttpx: Fix bug that mruby is incorrectly shared between backends - nghttpx: Reconnect h1 backend if it lost connection before sending headers - nghttpx: Returns 408 if backend timed out before sending headers - nghttpx: Fix request stal This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-379=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libnghttp2-14-1.40.0-lp151.3.6.1 libnghttp2-14-debuginfo-1.40.0-lp151.3.6.1 libnghttp2-devel-1.40.0-lp151.3.6.1 libnghttp2_asio-devel-1.40.0-lp151.3.6.1 libnghttp2_asio1-1.40.0-lp151.3.6.1 libnghttp2_asio1-debuginfo-1.40.0-lp151.3.6.1 nghttp2-1.40.0-lp151.3.6.1 nghttp2-debuginfo-1.40.0-lp151.3.6.1 nghttp2-debugsource-1.40.0-lp151.3.6.1 nghttp2-python-debugsource-1.40.0-lp151.3.6.1 python3-nghttp2-1.40.0-lp151.3.6.1 python3-nghttp2-debuginfo-1.40.0-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): libnghttp2-14-32bit-1.40.0-lp151.3.6.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp151.3.6.1 libnghttp2_asio1-32bit-1.40.0-lp151.3.6.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-18802.html https://bugzilla.suse.com/1159003 https://bugzilla.suse.com/1166481 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0381-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0381-1 Rating: moderate References: #1163184 #1164505 #1165784 Cross-References: CVE-2020-10029 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2020-10029: Fixed a potential overflow in on-stack buffer during range reduction (bsc#1165784). - Fixed an issue where pthread were not always locked correctly (bsc#1164505). - Document mprotect and introduce section on memory protection (bsc#1163184). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-381=1 Package List: - openSUSE Leap 15.1 (i586 i686 x86_64): glibc-2.26-lp151.19.3.1 glibc-debuginfo-2.26-lp151.19.3.1 glibc-debugsource-2.26-lp151.19.3.1 glibc-devel-2.26-lp151.19.3.1 glibc-devel-debuginfo-2.26-lp151.19.3.1 glibc-devel-static-2.26-lp151.19.3.1 glibc-locale-2.26-lp151.19.3.1 glibc-locale-base-2.26-lp151.19.3.1 glibc-locale-base-debuginfo-2.26-lp151.19.3.1 glibc-profile-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (i586 x86_64): glibc-extra-2.26-lp151.19.3.1 glibc-extra-debuginfo-2.26-lp151.19.3.1 glibc-utils-2.26-lp151.19.3.1 glibc-utils-debuginfo-2.26-lp151.19.3.1 glibc-utils-src-debugsource-2.26-lp151.19.3.1 nscd-2.26-lp151.19.3.1 nscd-debuginfo-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (noarch): glibc-html-2.26-lp151.19.3.1 glibc-i18ndata-2.26-lp151.19.3.1 glibc-info-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (x86_64): glibc-32bit-2.26-lp151.19.3.1 glibc-32bit-debuginfo-2.26-lp151.19.3.1 glibc-devel-32bit-2.26-lp151.19.3.1 glibc-devel-32bit-debuginfo-2.26-lp151.19.3.1 glibc-devel-static-32bit-2.26-lp151.19.3.1 glibc-locale-base-32bit-2.26-lp151.19.3.1 glibc-locale-base-32bit-debuginfo-2.26-lp151.19.3.1 glibc-profile-32bit-2.26-lp151.19.3.1 glibc-utils-32bit-2.26-lp151.19.3.1 glibc-utils-32bit-debuginfo-2.26-lp151.19.3.1 References: https://www.suse.com/security/cve/CVE-2020-10029.html https://bugzilla.suse.com/1163184 https://bugzilla.suse.com/1164505 https://bugzilla.suse.com/1165784 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0382-1: moderate: Security update for mcpp
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for mcpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0382-1 Rating: moderate References: #1143032 Cross-References: CVE-2019-14274 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mcpp fixes the following issues: - CVE-2019-14274: Fixed a heap-based buffer overflow in the do_msg() (boo#1143032) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-382=1 Package List: - openSUSE Leap 15.1 (x86_64): libmcpp0-2.7.2-lp151.3.3.1 libmcpp0-debuginfo-2.7.2-lp151.3.3.1 mcpp-2.7.2-lp151.3.3.1 mcpp-debuginfo-2.7.2-lp151.3.3.1 mcpp-debugsource-2.7.2-lp151.3.3.1 mcpp-devel-2.7.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14274.html https://bugzilla.suse.com/1143032 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0368-1: moderate: Security update for texlive-filesystem
by opensuse-security＠opensuse.org 23 Mar '20

23 Mar '20

openSUSE Security Update: Security update for texlive-filesystem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0368-1 Rating: moderate References: #1150556 #1155381 #1158910 #1159740 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for texlive-filesystem fixes the following issues: Security issues fixed: - Changed default user for ls-R files and font cache directories to user nobody (bsc#1159740) - Switched to rm instead of safe-rm or safe-rmdir to avoid race conditions (bsc#1158910) . - Made cron script more failsafe (bsc#1150556) Non-security issue fixed: - Refreshed font map files on update (bsc#1155381) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-368=1 Package List: - openSUSE Leap 15.1 (noarch): texlive-collection-basic-2017.135.svn41616-lp151.8.3.1 texlive-collection-bibtexextra-2017.135.svn44385-lp151.8.3.1 texlive-collection-binextra-2017.135.svn44515-lp151.8.3.1 texlive-collection-context-2017.135.svn42330-lp151.8.3.1 texlive-collection-fontsextra-2017.135.svn43356-lp151.8.3.1 texlive-collection-fontsrecommended-2017.135.svn35830-lp151.8.3.1 texlive-collection-fontutils-2017.135.svn37105-lp151.8.3.1 texlive-collection-formatsextra-2017.135.svn44177-lp151.8.3.1 texlive-collection-games-2017.135.svn42992-lp151.8.3.1 texlive-collection-humanities-2017.135.svn42268-lp151.8.3.1 texlive-collection-langarabic-2017.135.svn44496-lp151.8.3.1 texlive-collection-langchinese-2017.135.svn42675-lp151.8.3.1 texlive-collection-langcjk-2017.135.svn43009-lp151.8.3.1 texlive-collection-langcyrillic-2017.135.svn44401-lp151.8.3.1 texlive-collection-langczechslovak-2017.135.svn32550-lp151.8.3.1 texlive-collection-langenglish-2017.135.svn43650-lp151.8.3.1 texlive-collection-langeuropean-2017.135.svn44414-lp151.8.3.1 texlive-collection-langfrench-2017.135.svn40375-lp151.8.3.1 texlive-collection-langgerman-2017.135.svn42045-lp151.8.3.1 texlive-collection-langgreek-2017.135.svn44192-lp151.8.3.1 texlive-collection-langitalian-2017.135.svn30372-lp151.8.3.1 texlive-collection-langjapanese-2017.135.svn44554-lp151.8.3.1 texlive-collection-langkorean-2017.135.svn42106-lp151.8.3.1 texlive-collection-langother-2017.135.svn44414-lp151.8.3.1 texlive-collection-langpolish-2017.135.svn44371-lp151.8.3.1 texlive-collection-langportuguese-2017.135.svn30962-lp151.8.3.1 texlive-collection-langspanish-2017.135.svn40587-lp151.8.3.1 texlive-collection-latex-2017.135.svn41614-lp151.8.3.1 texlive-collection-latexextra-2017.135.svn44544-lp151.8.3.1 texlive-collection-latexrecommended-2017.135.svn44177-lp151.8.3.1 texlive-collection-luatex-2017.135.svn44500-lp151.8.3.1 texlive-collection-mathscience-2017.135.svn44396-lp151.8.3.1 texlive-collection-metapost-2017.135.svn44297-lp151.8.3.1 texlive-collection-music-2017.135.svn40561-lp151.8.3.1 texlive-collection-pictures-2017.135.svn44395-lp151.8.3.1 texlive-collection-plaingeneric-2017.135.svn44177-lp151.8.3.1 texlive-collection-pstricks-2017.135.svn44460-lp151.8.3.1 texlive-collection-publishers-2017.135.svn44485-lp151.8.3.1 texlive-collection-xetex-2017.135.svn43059-lp151.8.3.1 texlive-devel-2017.135-lp151.8.3.1 texlive-extratools-2017.135-lp151.8.3.1 texlive-filesystem-2017.135-lp151.8.3.1 texlive-scheme-basic-2017.135.svn25923-lp151.8.3.1 texlive-scheme-context-2017.135.svn35799-lp151.8.3.1 texlive-scheme-full-2017.135.svn44177-lp151.8.3.1 texlive-scheme-gust-2017.135.svn44177-lp151.8.3.1 texlive-scheme-infraonly-2017.135.svn41515-lp151.8.3.1 texlive-scheme-medium-2017.135.svn44177-lp151.8.3.1 texlive-scheme-minimal-2017.135.svn13822-lp151.8.3.1 texlive-scheme-small-2017.135.svn41825-lp151.8.3.1 texlive-scheme-tetex-2017.135.svn44187-lp151.8.3.1 References: https://bugzilla.suse.com/1150556 https://bugzilla.suse.com/1155381 https://bugzilla.suse.com/1158910 https://bugzilla.suse.com/1159740 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0366-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Mar '20

22 Mar '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0366-1 Rating: important References: #1166238 Cross-References: CVE-2019-20503 CVE-2020-6805 CVE-2020-6806 CVE-2020-6807 CVE-2020-6811 CVE-2020-6812 CVE-2020-6814 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: MozillaThunderbird was updated to 68.6.0 ESR (MFSA 2020-10 bsc#1166238) - CVE-2020-6805: Fixed a use-after-free when removing data about origins - CVE-2020-6806: Fixed improper protections against state confusion - CVE-2020-6807: Fixed a use-after-free in cubeb during stream destruction - CVE-2020-6811: Fixed an issue where copy as cURL' feature did not fully escape website-controlled data potentially leading to command injection - CVE-2019-20503: Fixed out of bounds reads in sctp_load_addresses_from_init - CVE-2020-6812: Fixed an issue where the names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission - CVE-2020-6814: Fixed multiple memory safety bugs This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-366=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.6.0-lp151.2.28.1 MozillaThunderbird-debuginfo-68.6.0-lp151.2.28.1 MozillaThunderbird-debugsource-68.6.0-lp151.2.28.1 MozillaThunderbird-translations-common-68.6.0-lp151.2.28.1 MozillaThunderbird-translations-other-68.6.0-lp151.2.28.1 References: https://www.suse.com/security/cve/CVE-2019-20503.html https://www.suse.com/security/cve/CVE-2020-6805.html https://www.suse.com/security/cve/CVE-2020-6806.html https://www.suse.com/security/cve/CVE-2020-6807.html https://www.suse.com/security/cve/CVE-2020-6811.html https://www.suse.com/security/cve/CVE-2020-6812.html https://www.suse.com/security/cve/CVE-2020-6814.html https://bugzilla.suse.com/1166238 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0365-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Mar '20

22 Mar '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0365-1 Rating: important References: #1167090 Cross-References: CVE-2019-20503 CVE-2020-6422 CVE-2020-6424 CVE-2020-6425 CVE-2020-6426 CVE-2020-6427 CVE-2020-6428 CVE-2020-6429 CVE-2020-6449 Affected Products: openSUSE Leap 15.1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for chromium to version 80.0.3987.149 fixes the following issues: Chromium was update to 80.0.3987.149 (bsc#1167090): - CVE-2020-6422: Fixed a use after free in WebGL. - CVE-2020-6424: Fixed a use after free in media. - CVE-2020-6425: Fixed an insufficient policy enforcement in extensions. - CVE-2020-6426: Fixed an inappropriate implementation in V8. - CVE-2020-6427: Fixed a use after free in audio. - CVE-2020-6428: Fixed a use after free in audio. - CVE-2020-6429: Fixed a use after free in audio. - CVE-2019-20503: Fixed an out of bounds read in usersctplib. - CVE-2020-6449: Fixed a use after free in audio. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-365=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-365=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-80.0.3987.149-lp151.2.73.1 chromedriver-debuginfo-80.0.3987.149-lp151.2.73.1 chromium-80.0.3987.149-lp151.2.73.1 chromium-debuginfo-80.0.3987.149-lp151.2.73.1 chromium-debugsource-80.0.3987.149-lp151.2.73.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-80.0.3987.149-41.1 chromium-80.0.3987.149-41.1 References: https://www.suse.com/security/cve/CVE-2019-20503.html https://www.suse.com/security/cve/CVE-2020-6422.html https://www.suse.com/security/cve/CVE-2020-6424.html https://www.suse.com/security/cve/CVE-2020-6425.html https://www.suse.com/security/cve/CVE-2020-6426.html https://www.suse.com/security/cve/CVE-2020-6427.html https://www.suse.com/security/cve/CVE-2020-6428.html https://www.suse.com/security/cve/CVE-2020-6429.html https://www.suse.com/security/cve/CVE-2020-6449.html https://bugzilla.suse.com/1167090 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0365-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Mar '20

22 Mar '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0365-1 Rating: important References: #1167090 Cross-References: CVE-2019-20503 CVE-2020-6422 CVE-2020-6424 CVE-2020-6425 CVE-2020-6426 CVE-2020-6427 CVE-2020-6428 CVE-2020-6429 CVE-2020-6449 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for chromium to version 80.0.3987.149 fixes the following issues: Chromium was update to 80.0.3987.149 (bsc#1167090): - CVE-2020-6422: Fixed a use after free in WebGL. - CVE-2020-6424: Fixed a use after free in media. - CVE-2020-6425: Fixed an insufficient policy enforcement in extensions. - CVE-2020-6426: Fixed an inappropriate implementation in V8. - CVE-2020-6427: Fixed a use after free in audio. - CVE-2020-6428: Fixed a use after free in audio. - CVE-2020-6429: Fixed a use after free in audio. - CVE-2019-20503: Fixed an out of bounds read in usersctplib. - CVE-2020-6449: Fixed a use after free in audio. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-365=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-80.0.3987.149-41.1 chromium-80.0.3987.149-41.1 References: https://www.suse.com/security/cve/CVE-2019-20503.html https://www.suse.com/security/cve/CVE-2020-6422.html https://www.suse.com/security/cve/CVE-2020-6424.html https://www.suse.com/security/cve/CVE-2020-6425.html https://www.suse.com/security/cve/CVE-2020-6426.html https://www.suse.com/security/cve/CVE-2020-6427.html https://www.suse.com/security/cve/CVE-2020-6428.html https://www.suse.com/security/cve/CVE-2020-6429.html https://www.suse.com/security/cve/CVE-2020-6449.html https://bugzilla.suse.com/1167090 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0362-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 19 Mar '20

19 Mar '20

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0362-1 Rating: moderate References: #1093733 #1094301 #1101776 #1101777 #1101786 #1101788 #1101791 #1101794 #1101800 #1101802 #1101804 #1101810 #1106514 #1111647 #1117740 #1121231 #1121232 #1121233 #1121234 #1121235 #1127367 #1127369 #1127370 #1131941 #1131945 #1136021 #1141980 #1150690 #1156288 #1158505 #1161052 #1165241 #1165710 #957624 Cross-References: CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 CVE-2018-12086 CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14367 CVE-2018-14368 CVE-2018-14369 CVE-2018-14370 CVE-2018-16056 CVE-2018-16057 CVE-2018-16058 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 CVE-2019-10894 CVE-2019-10895 CVE-2019-10896 CVE-2019-10897 CVE-2019-10898 CVE-2019-10899 CVE-2019-10900 CVE-2019-10901 CVE-2019-10902 CVE-2019-10903 CVE-2019-13619 CVE-2019-16319 CVE-2019-19553 CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 CVE-2019-5721 CVE-2019-9208 CVE-2019-9209 CVE-2019-9214 CVE-2020-7044 CVE-2020-9428 CVE-2020-9429 CVE-2020-9430 CVE-2020-9431 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 59 vulnerabilities is now available. Description: This update for wireshark and libmaxminddb fixes the following issues: Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288). New features include: - Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC - Improved support for existing protocols, like HTTP/2 - Improved analytics and usability functionalities This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-362=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmaxminddb-debugsource-1.4.2-lp151.3.3.1 libmaxminddb-devel-1.4.2-lp151.3.3.1 libmaxminddb0-1.4.2-lp151.3.3.1 libmaxminddb0-debuginfo-1.4.2-lp151.3.3.1 libspandsp2-0.0.6-lp151.3.3.1 libspandsp2-debuginfo-0.0.6-lp151.3.3.1 libwireshark13-3.2.2-lp151.2.9.1 libwireshark13-debuginfo-3.2.2-lp151.2.9.1 libwiretap10-3.2.2-lp151.2.9.1 libwiretap10-debuginfo-3.2.2-lp151.2.9.1 libwsutil11-3.2.2-lp151.2.9.1 libwsutil11-debuginfo-3.2.2-lp151.2.9.1 mmdblookup-1.4.2-lp151.3.3.1 mmdblookup-debuginfo-1.4.2-lp151.3.3.1 spandsp-debugsource-0.0.6-lp151.3.3.1 spandsp-devel-0.0.6-lp151.3.3.1 wireshark-3.2.2-lp151.2.9.1 wireshark-debuginfo-3.2.2-lp151.2.9.1 wireshark-debugsource-3.2.2-lp151.2.9.1 wireshark-devel-3.2.2-lp151.2.9.1 wireshark-ui-qt-3.2.2-lp151.2.9.1 wireshark-ui-qt-debuginfo-3.2.2-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): spandsp-doc-0.0.6-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libmaxminddb0-32bit-1.4.2-lp151.3.3.1 libmaxminddb0-32bit-debuginfo-1.4.2-lp151.3.3.1 libspandsp2-32bit-0.0.6-lp151.3.3.1 libspandsp2-32bit-debuginfo-0.0.6-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11354.html https://www.suse.com/security/cve/CVE-2018-11355.html https://www.suse.com/security/cve/CVE-2018-11356.html https://www.suse.com/security/cve/CVE-2018-11357.html https://www.suse.com/security/cve/CVE-2018-11358.html https://www.suse.com/security/cve/CVE-2018-11359.html https://www.suse.com/security/cve/CVE-2018-11360.html https://www.suse.com/security/cve/CVE-2018-11361.html https://www.suse.com/security/cve/CVE-2018-11362.html https://www.suse.com/security/cve/CVE-2018-12086.html https://www.suse.com/security/cve/CVE-2018-14339.html https://www.suse.com/security/cve/CVE-2018-14340.html https://www.suse.com/security/cve/CVE-2018-14341.html https://www.suse.com/security/cve/CVE-2018-14342.html https://www.suse.com/security/cve/CVE-2018-14343.html https://www.suse.com/security/cve/CVE-2018-14344.html https://www.suse.com/security/cve/CVE-2018-14367.html https://www.suse.com/security/cve/CVE-2018-14368.html https://www.suse.com/security/cve/CVE-2018-14369.html https://www.suse.com/security/cve/CVE-2018-14370.html https://www.suse.com/security/cve/CVE-2018-16056.html https://www.suse.com/security/cve/CVE-2018-16057.html https://www.suse.com/security/cve/CVE-2018-16058.html https://www.suse.com/security/cve/CVE-2018-18225.html https://www.suse.com/security/cve/CVE-2018-18226.html https://www.suse.com/security/cve/CVE-2018-18227.html https://www.suse.com/security/cve/CVE-2018-19622.html https://www.suse.com/security/cve/CVE-2018-19623.html https://www.suse.com/security/cve/CVE-2018-19624.html https://www.suse.com/security/cve/CVE-2018-19625.html https://www.suse.com/security/cve/CVE-2018-19626.html https://www.suse.com/security/cve/CVE-2018-19627.html https://www.suse.com/security/cve/CVE-2018-19628.html https://www.suse.com/security/cve/CVE-2019-10894.html https://www.suse.com/security/cve/CVE-2019-10895.html https://www.suse.com/security/cve/CVE-2019-10896.html https://www.suse.com/security/cve/CVE-2019-10897.html https://www.suse.com/security/cve/CVE-2019-10898.html https://www.suse.com/security/cve/CVE-2019-10899.html https://www.suse.com/security/cve/CVE-2019-10900.html https://www.suse.com/security/cve/CVE-2019-10901.html https://www.suse.com/security/cve/CVE-2019-10902.html https://www.suse.com/security/cve/CVE-2019-10903.html https://www.suse.com/security/cve/CVE-2019-13619.html https://www.suse.com/security/cve/CVE-2019-16319.html https://www.suse.com/security/cve/CVE-2019-19553.html https://www.suse.com/security/cve/CVE-2019-5716.html https://www.suse.com/security/cve/CVE-2019-5717.html https://www.suse.com/security/cve/CVE-2019-5718.html https://www.suse.com/security/cve/CVE-2019-5719.html https://www.suse.com/security/cve/CVE-2019-5721.html https://www.suse.com/security/cve/CVE-2019-9208.html https://www.suse.com/security/cve/CVE-2019-9209.html https://www.suse.com/security/cve/CVE-2019-9214.html https://www.suse.com/security/cve/CVE-2020-7044.html https://www.suse.com/security/cve/CVE-2020-9428.html https://www.suse.com/security/cve/CVE-2020-9429.html https://www.suse.com/security/cve/CVE-2020-9430.html https://www.suse.com/security/cve/CVE-2020-9431.html https://bugzilla.suse.com/1093733 https://bugzilla.suse.com/1094301 https://bugzilla.suse.com/1101776 https://bugzilla.suse.com/1101777 https://bugzilla.suse.com/1101786 https://bugzilla.suse.com/1101788 https://bugzilla.suse.com/1101791 https://bugzilla.suse.com/1101794 https://bugzilla.suse.com/1101800 https://bugzilla.suse.com/1101802 https://bugzilla.suse.com/1101804 https://bugzilla.suse.com/1101810 https://bugzilla.suse.com/1106514 https://bugzilla.suse.com/1111647 https://bugzilla.suse.com/1117740 https://bugzilla.suse.com/1121231 https://bugzilla.suse.com/1121232 https://bugzilla.suse.com/1121233 https://bugzilla.suse.com/1121234 https://bugzilla.suse.com/1121235 https://bugzilla.suse.com/1127367 https://bugzilla.suse.com/1127369 https://bugzilla.suse.com/1127370 https://bugzilla.suse.com/1131941 https://bugzilla.suse.com/1131945 https://bugzilla.suse.com/1136021 https://bugzilla.suse.com/1141980 https://bugzilla.suse.com/1150690 https://bugzilla.suse.com/1156288 https://bugzilla.suse.com/1158505 https://bugzilla.suse.com/1161052 https://bugzilla.suse.com/1165241 https://bugzilla.suse.com/1165710 https://bugzilla.suse.com/957624 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0357-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 18 Mar '20

18 Mar '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0357-1 Rating: moderate References: #1135656 #1153611 #1157465 #1158940 #1159118 #1160931 #1162327 #1162504 #1165425 Cross-References: CVE-2019-17361 CVE-2019-18897 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897) - Fix unit tests failures in test_batch_async tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327) - RHEL/CentOS 8 uses platform-python instead of python3 - New configuration option for selection of grains in the minion start event. - Fix 'os_family' grain for Astra Linux Common Edition - Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504) - Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931) - Support for Btrfs and XFS in parted and mkfs added - Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions - Various libvirt updates: * Add virt.pool_capabilities function * virt.pool_running improvements * Add virt.pool_deleted state * virt.network_define allow adding IP configuration - virt: adding kernel boot parameters to libvirt xml - Fix to scheduler when data['run'] does not exist (bsc#1159118) - Fix virt states to not fail on VMs already stopped - Fix applying of attributes for returner rawfile_json (bsc#1158940) - xfs: do not fail if type is not present (bsc#1153611) - Fix errors when running virt.get_hypervisor function - Align virt.full_info fixes with upstream Salt - Fix for log checking in x509 test - Read repo info without using interpolation (bsc#1135656) - Limiting M2Crypto to >= SLE15 - Replacing pycrypto with M2Crypto (bsc#1165425) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-357=1 Package List: - openSUSE Leap 15.1 (x86_64): python2-salt-2019.2.0-lp151.5.12.1 python3-salt-2019.2.0-lp151.5.12.1 salt-2019.2.0-lp151.5.12.1 salt-api-2019.2.0-lp151.5.12.1 salt-cloud-2019.2.0-lp151.5.12.1 salt-doc-2019.2.0-lp151.5.12.1 salt-master-2019.2.0-lp151.5.12.1 salt-minion-2019.2.0-lp151.5.12.1 salt-proxy-2019.2.0-lp151.5.12.1 salt-ssh-2019.2.0-lp151.5.12.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.12.1 salt-syndic-2019.2.0-lp151.5.12.1 - openSUSE Leap 15.1 (noarch): salt-bash-completion-2019.2.0-lp151.5.12.1 salt-fish-completion-2019.2.0-lp151.5.12.1 salt-zsh-completion-2019.2.0-lp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2019-17361.html https://www.suse.com/security/cve/CVE-2019-18897.html https://bugzilla.suse.com/1135656 https://bugzilla.suse.com/1153611 https://bugzilla.suse.com/1157465 https://bugzilla.suse.com/1158940 https://bugzilla.suse.com/1159118 https://bugzilla.suse.com/1160931 https://bugzilla.suse.com/1162327 https://bugzilla.suse.com/1162504 https://bugzilla.suse.com/1165425 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0345-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 15 Mar '20

15 Mar '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0345-1 Rating: important References: #1164692 #1164825 #1164860 Cross-References: CVE-2019-17569 CVE-2020-1935 CVE-2020-1938 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tomcat to version 9.0.31 fixes the following issues: Security issues fixed: - CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling (bsc#1164825). - CVE-2020-1935: Fixed an HTTP Request Smuggling issue (bsc#1164860). - CVE-2020-1938: Fixed a file contents disclosure vulnerability (bsc#1164692). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-345=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.31-lp151.3.12.1 tomcat-admin-webapps-9.0.31-lp151.3.12.1 tomcat-docs-webapp-9.0.31-lp151.3.12.1 tomcat-el-3_0-api-9.0.31-lp151.3.12.1 tomcat-embed-9.0.31-lp151.3.12.1 tomcat-javadoc-9.0.31-lp151.3.12.1 tomcat-jsp-2_3-api-9.0.31-lp151.3.12.1 tomcat-jsvc-9.0.31-lp151.3.12.1 tomcat-lib-9.0.31-lp151.3.12.1 tomcat-servlet-4_0-api-9.0.31-lp151.3.12.1 tomcat-webapps-9.0.31-lp151.3.12.1 References: https://www.suse.com/security/cve/CVE-2019-17569.html https://www.suse.com/security/cve/CVE-2020-1935.html https://www.suse.com/security/cve/CVE-2020-1938.html https://bugzilla.suse.com/1164692 https://bugzilla.suse.com/1164825 https://bugzilla.suse.com/1164860 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0