May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0716-1: moderate: Security update for gcc9
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for gcc9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0716-1 Rating: moderate References: #1114592 #1135254 #1141897 #1142649 #1142654 #1148517 #1149145 #1149995 #1152590 #1167898 Cross-References: CVE-2019-14250 CVE-2019-15847 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on: https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages. To use it, install "gcc9" or "gcc9-c++" or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it. Security issues fixed: - CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145) - CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649) Non-security issues fixed: - Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254) - Fixed miscompilation for vector shift on s390. (bsc#1141897) - Includes a fix for Internal compiler error when building HepMC (bsc#1167898) - Includes fix for binutils version parsing - Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10. - Add gcc9 autodetect -g at lto link (bsc#1149995) - Install go tool buildid for bootstrapping go Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-716=1 Package List: - openSUSE Leap 15.1 (noarch): gcc9-info-9.3.1+git1296-lp151.2.2 - openSUSE Leap 15.1 (x86_64): cpp9-9.3.1+git1296-lp151.2.2 cpp9-debuginfo-9.3.1+git1296-lp151.2.2 cross-nvptx-gcc9-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debuginfo-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debugsource-9.3.1+git1296-lp151.2.1 cross-nvptx-newlib9-devel-9.3.1+git1296-lp151.2.1 gcc9-32bit-9.3.1+git1296-lp151.2.2 gcc9-9.3.1+git1296-lp151.2.2 gcc9-ada-32bit-9.3.1+git1296-lp151.2.2 gcc9-ada-9.3.1+git1296-lp151.2.2 gcc9-ada-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-c++-32bit-9.3.1+git1296-lp151.2.2 gcc9-c++-9.3.1+git1296-lp151.2.2 gcc9-c++-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debugsource-9.3.1+git1296-lp151.2.2 gcc9-fortran-32bit-9.3.1+git1296-lp151.2.2 gcc9-fortran-9.3.1+git1296-lp151.2.2 gcc9-fortran-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-go-32bit-9.3.1+git1296-lp151.2.2 gcc9-go-9.3.1+git1296-lp151.2.2 gcc9-go-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-locale-9.3.1+git1296-lp151.2.2 libada9-32bit-9.3.1+git1296-lp151.2.2 libada9-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libada9-9.3.1+git1296-lp151.2.2 libada9-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-32bit-9.3.1+git1296-lp151.2.2 libasan5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-9.3.1+git1296-lp151.2.2 libasan5-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-32bit-9.3.1+git1296-lp151.2.2 libatomic1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-9.3.1+git1296-lp151.2.2 libatomic1-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-9.3.1+git1296-lp151.2.2 libgcc_s1-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-9.3.1+git1296-lp151.2.2 libgfortran5-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-32bit-9.3.1+git1296-lp151.2.2 libgo14-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-9.3.1+git1296-lp151.2.2 libgo14-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-32bit-9.3.1+git1296-lp151.2.2 libgomp1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-9.3.1+git1296-lp151.2.2 libgomp1-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-32bit-9.3.1+git1296-lp151.2.2 libitm1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-9.3.1+git1296-lp151.2.2 libitm1-debuginfo-9.3.1+git1296-lp151.2.2 liblsan0-9.3.1+git1296-lp151.2.2 liblsan0-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-9.3.1+git1296-lp151.2.2 libquadmath0-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-9.3.1+git1296-lp151.2.2 libstdc++6-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-9.3.1+git1296-lp151.2.2 libstdc++6-locale-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-9.3.1+git1296-lp151.2.2 libtsan0-9.3.1+git1296-lp151.2.2 libtsan0-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-32bit-9.3.1+git1296-lp151.2.2 libubsan1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-9.3.1+git1296-lp151.2.2 libubsan1-debuginfo-9.3.1+git1296-lp151.2.2 References: https://www.suse.com/security/cve/CVE-2019-14250.html https://www.suse.com/security/cve/CVE-2019-15847.html https://bugzilla.suse.com/1114592 https://bugzilla.suse.com/1135254 https://bugzilla.suse.com/1141897 https://bugzilla.suse.com/1142649 https://bugzilla.suse.com/1142654 https://bugzilla.suse.com/1148517 https://bugzilla.suse.com/1149145 https://bugzilla.suse.com/1149995 https://bugzilla.suse.com/1152590 https://bugzilla.suse.com/1167898 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0711-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 25 May '20

25 May '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0711-1 Rating: important References: #1171928 Cross-References: CVE-2020-9484 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt ) * CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a remote code execution via deserialization of the file under their control. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-711=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.35-lp151.3.18.1 tomcat-admin-webapps-9.0.35-lp151.3.18.1 tomcat-docs-webapp-9.0.35-lp151.3.18.1 tomcat-el-3_0-api-9.0.35-lp151.3.18.1 tomcat-embed-9.0.35-lp151.3.18.1 tomcat-javadoc-9.0.35-lp151.3.18.1 tomcat-jsp-2_3-api-9.0.35-lp151.3.18.1 tomcat-jsvc-9.0.35-lp151.3.18.1 tomcat-lib-9.0.35-lp151.3.18.1 tomcat-servlet-4_0-api-9.0.35-lp151.3.18.1 tomcat-webapps-9.0.35-lp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-9484.html https://bugzilla.suse.com/1171928 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0709-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 May '20

24 May '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0709-1 Rating: important References: Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 68.0.3618.104 - CHR-7909 Update chromium on desktop-stable-81-3618 to 81.0.4044.138 - CVE-2020-6831, CVE-2020-6464 - DNA-85609 [Mac] Tabs shrinking & disappearing - DNA-85629 Crash at opera::DownloadButtonPanel::ShouldShowCancelButton() - DNA-85669 Add mocking of AddressDropdownModel in AddressBarControllerTest - DNA-85678 Wrong badge icon on pages with mixed content on desktop-stable-81-3618 - DNA-85820 Flags are blue in default [D] state after restart - DNA-85822 Full screen snap on pkobp.pl - DNA-86077 Problem to upload .JPG file as an wallpaper - DNA-86165 Downloads list doesn’t returns to its original state after clearing search filter - DNA-86236 [Mac] Plus button click area too small - DNA-86241 X tab button is not visible - DNA-86217 Fix performance issue with Background Worker Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-709=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-68.0.3618.104-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0703-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0703-1 Rating: moderate References: #1100053 #1133997 #1134001 Cross-References: CVE-2018-10886 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053). Non-security issues fixed: - Add rhino to the ant-apache-bsf optional tasks (bsc#1134001). - Remove jakarta-commons-logging dependencies (bsc#1133997). - Use apache-commons-logging in optional tasks This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-703=1 Package List: - openSUSE Leap 15.1 (noarch): ant-1.9.10-lp151.4.3.1 ant-antlr-1.9.10-lp151.4.3.1 ant-apache-bcel-1.9.10-lp151.4.3.1 ant-apache-bsf-1.9.10-lp151.4.3.1 ant-apache-log4j-1.9.10-lp151.4.3.1 ant-apache-oro-1.9.10-lp151.4.3.1 ant-apache-regexp-1.9.10-lp151.4.3.1 ant-apache-resolver-1.9.10-lp151.4.3.1 ant-apache-xalan2-1.9.10-lp151.4.3.1 ant-commons-logging-1.9.10-lp151.4.3.1 ant-commons-net-1.9.10-lp151.4.3.1 ant-javamail-1.9.10-lp151.4.3.1 ant-jdepend-1.9.10-lp151.4.3.1 ant-jmf-1.9.10-lp151.4.3.1 ant-jsch-1.9.10-lp151.4.3.1 ant-junit-1.9.10-lp151.4.3.1 ant-manual-1.9.10-lp151.4.3.1 ant-scripts-1.9.10-lp151.4.3.1 ant-swing-1.9.10-lp151.4.3.1 ant-testutil-1.9.10-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10886.html https://bugzilla.suse.com/1100053 https://bugzilla.suse.com/1133997 https://bugzilla.suse.com/1134001 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0704-1: moderate: Security update for freetype2
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: #1079603 #1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for freetype2 to version 2.10.1 fixes the following issues: Security issue fixed: - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c (bsc#1079603). Non-security issues fixed: - Update to version 2.10.1 * The bytecode hinting of OpenType variation fonts was flawed, since the data in the `CVAR' table wasn't correctly applied. * Auto-hinter support for Mongolian. * The handling of the default character in PCF fonts as introduced in version 2.10.0 was partially broken, causing premature abortion of charmap iteration for many fonts. * If `FT_Set_Named_Instance' was called with the same arguments twice in a row, the function returned an incorrect error code the second time. * Direct rendering using FT_RASTER_FLAG_DIRECT crashed (bug introduced in version 2.10.0). * Increased precision while computing OpenType font variation instances. * The flattening algorithm of cubic Bezier curves was slightly changed to make it faster. This can cause very subtle rendering changes, which aren't noticeable by the eye, however. * The auto-hinter now disables hinting if there are blue zones defined for a `style' (i.e., a certain combination of a script and its related typographic features) but the font doesn't contain any characters needed to set up at least one blue zone. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * A bunch of new functions has been added to access and process COLR/CPAL data of OpenType fonts with color-layered glyphs. * As a GSoC 2018 project, Nikhil Ramakrishnan completely overhauled and modernized the API reference. * The logic for computing the global ascender, descender, and height of OpenType fonts has been slightly adjusted for consistency. * `TT_Set_MM_Blend' could fail if called repeatedly with the same arguments. * The precision of handling deltas in Variation Fonts has been increased.The problem did only show up with multidimensional designspaces. * New function `FT_Library_SetLcdGeometry' to set up the geometry of LCD subpixels. * FreeType now uses the `defaultChar' property of PCF fonts to set the glyph for the undefined character at glyph index 0 (as FreeType already does for all other supported font formats). As a consequence, the order of glyphs of a PCF font if accessed with FreeType can be different now compared to previous versions. This change doesn't affect PCF font access with cmaps. * `FT_Select_Charmap' has been changed to allow parameter value `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT formats to access built-in cmaps that don't have a predefined `FT_Encoding' value. * A previously reserved field in the `FT_GlyphSlotRec' structure now holds the glyph index. * The usual round of fuzzer bug fixes to better reject malformed fonts. * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have been removed.These two functions were public by oversight only and were never documented. * A new function `FT_Error_String' returns descriptions of error codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is defined. * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new functions limited to Adobe MultiMaster fonts to directly set and get the weight vector. - Enable subpixel rendering with infinality config: - Re-enable freetype-config, there is just too many fallouts. - Update to version 2.9.1 * Type 1 fonts containing flex features were not rendered correctly (bug introduced in version 2.9). * CVE-2018-6942: Older FreeType versions can crash with certain malformed variation fonts. * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage. * Emboldening of bitmaps didn't work correctly sometimes, showing various artifacts (bug introduced in version 2.8.1). * The auto-hinter script ranges have been updated for Unicode 11. No support for new scripts have been added, however, with the exception of Georgian Mtavruli. - freetype-config is now deprecated by upstream and not enabled by default. - Update to version 2.10.1 * The `ftmulti' demo program now supports multiple hidden axes with the same name tag. * `ftview', `ftstring', and `ftgrid' got a `-k' command line option to emulate a sequence of keystrokes at start-up. * `ftview', `ftstring', and `ftgrid' now support screen dumping to a PNG file. * The bytecode debugger, `ttdebug', now supports variation TrueType fonts; a variation font instance can be selected with the new `-d' command line option. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * The `ftdump' demo program has new options `-c' and `-C' to display charmaps in compact and detailed format, respectively. Option `-V' has been removed. * The `ftview', `ftstring', and `ftgrid' demo programs use a new command line option `-d' to specify the program window's width, height, and color depth. * The `ftview' demo program now displays red boxes for zero-width glyphs. * `ftglyph' has limited support to display fonts with color-layered glyphs.This will be improved later on. * `ftgrid' can now display bitmap fonts also. * The `ttdebug' demo program has a new option `-f' to select a member of a TrueType collection (TTC). * Other various improvements to the demo programs. - Remove "Supplements: fonts-config" to avoid accidentally pulling in Qt dependencies on some non-Qt based desktops.(bsc#1091109) fonts-config is fundamental but ft2demos seldom installs by end users. only fonts-config maintainers/debuggers may use ft2demos along to debug some issues. - Update to version 2.9.1 * No changelog upstream. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-704=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetype2-debugsource-2.10.1-lp151.4.3.1 freetype2-devel-2.10.1-lp151.4.3.1 libfreetype6-2.10.1-lp151.4.3.1 libfreetype6-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): freetype2-devel-32bit-2.10.1-lp151.4.3.1 ft2demos-2.10.1-lp151.4.3.1 ftbench-2.10.1-lp151.4.3.1 ftdiff-2.10.1-lp151.4.3.1 ftdump-2.10.1-lp151.4.3.1 ftgamma-2.10.1-lp151.4.3.1 ftgrid-2.10.1-lp151.4.3.1 ftinspect-2.10.1-lp151.4.3.1 ftlint-2.10.1-lp151.4.3.1 ftmulti-2.10.1-lp151.4.3.1 ftstring-2.10.1-lp151.4.3.1 ftvalid-2.10.1-lp151.4.3.1 ftview-2.10.1-lp151.4.3.1 libfreetype6-32bit-2.10.1-lp151.4.3.1 libfreetype6-32bit-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): freetype2-profile-tti35-2.10.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-6942.html https://bugzilla.suse.com/1079603 https://bugzilla.suse.com/1091109 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0698-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0698-1 Rating: moderate References: #1171553 Cross-References: CVE-2020-10030 CVE-2020-10995 CVE-2020-12244 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: - update to 4.1.16 * fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553) * fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553) * fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553) For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-698=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-698=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-698=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-recursor-4.1.12-lp151.3.3.1 pdns-recursor-debuginfo-4.1.12-lp151.3.3.1 pdns-recursor-debugsource-4.1.12-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.12-bp151.4.3.1 pdns-recursor-debuginfo-4.1.12-bp151.4.3.1 pdns-recursor-debugsource-4.1.12-bp151.4.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.16-19.1 References: https://www.suse.com/security/cve/CVE-2020-10030.html https://www.suse.com/security/cve/CVE-2020-10995.html https://www.suse.com/security/cve/CVE-2020-12244.html https://bugzilla.suse.com/1171553 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0698-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0698-1 Rating: moderate References: #1171553 Cross-References: CVE-2020-10030 CVE-2020-10995 CVE-2020-12244 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: - update to 4.1.16 * fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553) * fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553) * fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553) For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-698=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-698=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-recursor-4.1.12-lp151.3.3.1 pdns-recursor-debuginfo-4.1.12-lp151.3.3.1 pdns-recursor-debugsource-4.1.12-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.12-bp151.4.3.1 pdns-recursor-debuginfo-4.1.12-bp151.4.3.1 pdns-recursor-debugsource-4.1.12-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-10030.html https://www.suse.com/security/cve/CVE-2020-10995.html https://www.suse.com/security/cve/CVE-2020-12244.html https://bugzilla.suse.com/1171553 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0682-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0682-1 Rating: moderate References: #1146648 #1169549 #1169573 #1169574 #1169575 #1169576 #1169578 #1169580 Cross-References: CVE-2020-11758 CVE-2020-11760 CVE-2020-11761 CVE-2020-11762 CVE-2020-11763 CVE-2020-11764 CVE-2020-11765 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for openexr provides the following fix: Security issues fixed: - CVE-2020-11765: Fixed an off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier (bsc#1169575). - CVE-2020-11764: Fixed an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574). - CVE-2020-11763: Fixed an out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp (bsc#1169576). - CVE-2020-11762: Fixed an out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case (bsc#1169549). - CVE-2020-11761: Fixed an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp (bsc#1169578). - CVE-2020-11760: Fixed an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp (bsc#1169580). - CVE-2020-11758: Fixed an out-of-bounds read in ImfOptimizedPixelReading.h (bsc#1169573). Non-security issue fixed: - Enable tests when building the package on x86_64. (bsc#1146648) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-682=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.9.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.9.1 openexr-2.2.1-lp151.4.9.1 openexr-debuginfo-2.2.1-lp151.4.9.1 openexr-debugsource-2.2.1-lp151.4.9.1 openexr-devel-2.2.1-lp151.4.9.1 openexr-doc-2.2.1-lp151.4.9.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.9.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-11758.html https://www.suse.com/security/cve/CVE-2020-11760.html https://www.suse.com/security/cve/CVE-2020-11761.html https://www.suse.com/security/cve/CVE-2020-11762.html https://www.suse.com/security/cve/CVE-2020-11763.html https://www.suse.com/security/cve/CVE-2020-11764.html https://www.suse.com/security/cve/CVE-2020-11765.html https://bugzilla.suse.com/1146648 https://bugzilla.suse.com/1169549 https://bugzilla.suse.com/1169573 https://bugzilla.suse.com/1169574 https://bugzilla.suse.com/1169575 https://bugzilla.suse.com/1169576 https://bugzilla.suse.com/1169578 https://bugzilla.suse.com/1169580 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0676-1: moderate: Security update for autoyast2
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0676-1 Rating: moderate References: #1109310 #1133045 #1140711 #1164105 #1168123 #1168281 #1170082 Cross-References: CVE-2019-18905 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all "--gpg-auto-import-keys" options from zypper commands (bsc#1140711). Non-security issue fixed: - Fix desktop files updating some icons and groups (bsc#1168123). - Restored some missing icons (bsc#1168123, bsc#1109310 and bsc#1168281). - Service for init scripts: Try to start "network-online.target" before starting the autoyast init scripts in order to get a working network (bsc#1164105). - Always re-probe storage after pre-scripts (bsc#1170082, bsc#1133045). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-676=1 Package List: - openSUSE Leap 15.1 (noarch): autoyast2-4.1.15-lp151.2.12.1 autoyast2-installation-4.1.15-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-18905.html https://bugzilla.suse.com/1109310 https://bugzilla.suse.com/1133045 https://bugzilla.suse.com/1140711 https://bugzilla.suse.com/1164105 https://bugzilla.suse.com/1168123 https://bugzilla.suse.com/1168281 https://bugzilla.suse.com/1170082 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0678-1: important: Security update for gstreamer-plugins-base
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for gstreamer-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0678-1 Rating: important References: #1133375 Cross-References: CVE-2019-9928 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-plugins-base fixes the following issue: Security issue fixed: - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-678=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gstreamer-plugins-base-1.12.5-lp151.3.3.1 gstreamer-plugins-base-debuginfo-1.12.5-lp151.3.3.1 gstreamer-plugins-base-debugsource-1.12.5-lp151.3.3.1 gstreamer-plugins-base-devel-1.12.5-lp151.3.3.1 gstreamer-plugins-base-doc-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstapp-1_0-0-1.12.5-lp151.3.3.1 libgstapp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstfft-1_0-0-1.12.5-lp151.3.3.1 libgstfft-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstriff-1_0-0-1.12.5-lp151.3.3.1 libgstriff-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgsttag-1_0-0-1.12.5-lp151.3.3.1 libgsttag-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-debuginfo-1.12.5-lp151.3.3.1 typelib-1_0-GstAllocators-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstApp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstAudio-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstFft-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstPbutils-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstRtp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstRtsp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstSdp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstTag-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstVideo-1_0-1.12.5-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): gstreamer-plugins-base-lang-1.12.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): gstreamer-plugins-base-32bit-1.12.5-lp151.3.3.1 gstreamer-plugins-base-32bit-debuginfo-1.12.5-lp151.3.3.1 gstreamer-plugins-base-devel-32bit-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstapp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstapp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstfft-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstfft-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstriff-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstriff-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgsttag-1_0-0-32bit-1.12.5-lp151.3.3.1 libgsttag-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9928.html https://bugzilla.suse.com/1133375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0