July 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0960-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 14 Jul '20

14 Jul '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0960-1 Rating: important References: #1173477 Cross-References: CVE-2017-18922 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for LibVNCServer fixes the following issues: - CVE-2017-18922: Fixed an issue which could have allowed to an attacker to pre-auth overwrite a function pointer which subsequently used leading to potential remote code execution (bsc#1173477). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-960=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp151.7.6.1 LibVNCServer-devel-0.9.10-lp151.7.6.1 libvncclient0-0.9.10-lp151.7.6.1 libvncclient0-debuginfo-0.9.10-lp151.7.6.1 libvncserver0-0.9.10-lp151.7.6.1 libvncserver0-debuginfo-0.9.10-lp151.7.6.1 References: https://www.suse.com/security/cve/CVE-2017-18922.html https://bugzilla.suse.com/1173477 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0956-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 14 Jul '20

14 Jul '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0956-1 Rating: important References: #1172698 #1172704 Cross-References: CVE-2020-8023 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openldap2 fixes the following issues: - CVE-2020-8023: Fixed a potential local privilege escalation from ldap to root when OPENLDAP_CONFIG_BACKEND="ldap" was used (bsc#1172698). - Changed DB_CONFIG to root:ldap permissions (bsc#1172704). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-956=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libldap-2_4-2-2.4.46-lp151.10.12.1 libldap-2_4-2-debuginfo-2.4.46-lp151.10.12.1 openldap2-2.4.46-lp151.10.12.1 openldap2-back-meta-2.4.46-lp151.10.12.1 openldap2-back-meta-debuginfo-2.4.46-lp151.10.12.1 openldap2-back-perl-2.4.46-lp151.10.12.1 openldap2-back-perl-debuginfo-2.4.46-lp151.10.12.1 openldap2-back-sock-2.4.46-lp151.10.12.1 openldap2-back-sock-debuginfo-2.4.46-lp151.10.12.1 openldap2-back-sql-2.4.46-lp151.10.12.1 openldap2-back-sql-debuginfo-2.4.46-lp151.10.12.1 openldap2-client-2.4.46-lp151.10.12.1 openldap2-client-debuginfo-2.4.46-lp151.10.12.1 openldap2-contrib-2.4.46-lp151.10.12.1 openldap2-contrib-debuginfo-2.4.46-lp151.10.12.1 openldap2-debuginfo-2.4.46-lp151.10.12.1 openldap2-debugsource-2.4.46-lp151.10.12.1 openldap2-devel-2.4.46-lp151.10.12.1 openldap2-devel-static-2.4.46-lp151.10.12.1 openldap2-ppolicy-check-password-1.2-lp151.10.12.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp151.10.12.1 - openSUSE Leap 15.1 (noarch): libldap-data-2.4.46-lp151.10.12.1 openldap2-doc-2.4.46-lp151.10.12.1 - openSUSE Leap 15.1 (x86_64): libldap-2_4-2-32bit-2.4.46-lp151.10.12.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp151.10.12.1 openldap2-devel-32bit-2.4.46-lp151.10.12.1 References: https://www.suse.com/security/cve/CVE-2020-8023.html https://bugzilla.suse.com/1172698 https://bugzilla.suse.com/1172704 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0955-1: moderate: Security update for mozilla-nss
by opensuse-security＠opensuse.org 13 Jul '20

13 Jul '20

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0955-1 Rating: moderate References: #1168669 #1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032) - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-955=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libfreebl3-3.53.1-lp152.2.4.1 libfreebl3-debuginfo-3.53.1-lp152.2.4.1 libfreebl3-hmac-3.53.1-lp152.2.4.1 libsoftokn3-3.53.1-lp152.2.4.1 libsoftokn3-debuginfo-3.53.1-lp152.2.4.1 libsoftokn3-hmac-3.53.1-lp152.2.4.1 mozilla-nss-3.53.1-lp152.2.4.1 mozilla-nss-certs-3.53.1-lp152.2.4.1 mozilla-nss-certs-debuginfo-3.53.1-lp152.2.4.1 mozilla-nss-debuginfo-3.53.1-lp152.2.4.1 mozilla-nss-debugsource-3.53.1-lp152.2.4.1 mozilla-nss-devel-3.53.1-lp152.2.4.1 mozilla-nss-sysinit-3.53.1-lp152.2.4.1 mozilla-nss-sysinit-debuginfo-3.53.1-lp152.2.4.1 mozilla-nss-tools-3.53.1-lp152.2.4.1 mozilla-nss-tools-debuginfo-3.53.1-lp152.2.4.1 - openSUSE Leap 15.2 (x86_64): libfreebl3-32bit-3.53.1-lp152.2.4.1 libfreebl3-32bit-debuginfo-3.53.1-lp152.2.4.1 libfreebl3-hmac-32bit-3.53.1-lp152.2.4.1 libsoftokn3-32bit-3.53.1-lp152.2.4.1 libsoftokn3-32bit-debuginfo-3.53.1-lp152.2.4.1 libsoftokn3-hmac-32bit-3.53.1-lp152.2.4.1 mozilla-nss-32bit-3.53.1-lp152.2.4.1 mozilla-nss-32bit-debuginfo-3.53.1-lp152.2.4.1 mozilla-nss-certs-32bit-3.53.1-lp152.2.4.1 mozilla-nss-certs-32bit-debuginfo-3.53.1-lp152.2.4.1 mozilla-nss-sysinit-32bit-3.53.1-lp152.2.4.1 mozilla-nss-sysinit-32bit-debuginfo-3.53.1-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-12402.html https://bugzilla.suse.com/1168669 https://bugzilla.suse.com/1173032 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0952-1: moderate: Security update for nasm
by opensuse-security＠opensuse.org 13 Jul '20

13 Jul '20

openSUSE Security Update: Security update for nasm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0952-1 Rating: moderate References: #1084631 #1086186 #1086227 #1086228 #1090519 #1090840 #1106878 #1107592 #1107594 #1108404 #1115758 #1115774 #1115795 #1173538 Cross-References: CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254 CVE-2018-10316 CVE-2018-16382 CVE-2018-16517 CVE-2018-16999 CVE-2018-19214 CVE-2018-19215 CVE-2018-19216 CVE-2018-8881 CVE-2018-8882 CVE-2018-8883 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-952=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nasm-2.14.02-lp151.3.3.1 nasm-debuginfo-2.14.02-lp151.3.3.1 nasm-debugsource-2.14.02-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000667.html https://www.suse.com/security/cve/CVE-2018-10016.html https://www.suse.com/security/cve/CVE-2018-10254.html https://www.suse.com/security/cve/CVE-2018-10316.html https://www.suse.com/security/cve/CVE-2018-16382.html https://www.suse.com/security/cve/CVE-2018-16517.html https://www.suse.com/security/cve/CVE-2018-16999.html https://www.suse.com/security/cve/CVE-2018-19214.html https://www.suse.com/security/cve/CVE-2018-19215.html https://www.suse.com/security/cve/CVE-2018-19216.html https://www.suse.com/security/cve/CVE-2018-8881.html https://www.suse.com/security/cve/CVE-2018-8882.html https://www.suse.com/security/cve/CVE-2018-8883.html https://bugzilla.suse.com/1084631 https://bugzilla.suse.com/1086186 https://bugzilla.suse.com/1086227 https://bugzilla.suse.com/1086228 https://bugzilla.suse.com/1090519 https://bugzilla.suse.com/1090840 https://bugzilla.suse.com/1106878 https://bugzilla.suse.com/1107592 https://bugzilla.suse.com/1107594 https://bugzilla.suse.com/1108404 https://bugzilla.suse.com/1115758 https://bugzilla.suse.com/1115774 https://bugzilla.suse.com/1115795 https://bugzilla.suse.com/1173538 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0953-1: moderate: Security update for mozilla-nss
by opensuse-security＠opensuse.org 13 Jul '20

13 Jul '20

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0953-1 Rating: moderate References: #1168669 #1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032) - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-953=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.53.1-lp151.2.26.1 libfreebl3-debuginfo-3.53.1-lp151.2.26.1 libfreebl3-hmac-3.53.1-lp151.2.26.1 libsoftokn3-3.53.1-lp151.2.26.1 libsoftokn3-debuginfo-3.53.1-lp151.2.26.1 libsoftokn3-hmac-3.53.1-lp151.2.26.1 mozilla-nss-3.53.1-lp151.2.26.1 mozilla-nss-certs-3.53.1-lp151.2.26.1 mozilla-nss-certs-debuginfo-3.53.1-lp151.2.26.1 mozilla-nss-debuginfo-3.53.1-lp151.2.26.1 mozilla-nss-debugsource-3.53.1-lp151.2.26.1 mozilla-nss-devel-3.53.1-lp151.2.26.1 mozilla-nss-sysinit-3.53.1-lp151.2.26.1 mozilla-nss-sysinit-debuginfo-3.53.1-lp151.2.26.1 mozilla-nss-tools-3.53.1-lp151.2.26.1 mozilla-nss-tools-debuginfo-3.53.1-lp151.2.26.1 - openSUSE Leap 15.1 (x86_64): libfreebl3-32bit-3.53.1-lp151.2.26.1 libfreebl3-32bit-debuginfo-3.53.1-lp151.2.26.1 libfreebl3-hmac-32bit-3.53.1-lp151.2.26.1 libsoftokn3-32bit-3.53.1-lp151.2.26.1 libsoftokn3-32bit-debuginfo-3.53.1-lp151.2.26.1 libsoftokn3-hmac-32bit-3.53.1-lp151.2.26.1 mozilla-nss-32bit-3.53.1-lp151.2.26.1 mozilla-nss-32bit-debuginfo-3.53.1-lp151.2.26.1 mozilla-nss-certs-32bit-3.53.1-lp151.2.26.1 mozilla-nss-certs-32bit-debuginfo-3.53.1-lp151.2.26.1 mozilla-nss-sysinit-32bit-3.53.1-lp151.2.26.1 mozilla-nss-sysinit-32bit-debuginfo-3.53.1-lp151.2.26.1 References: https://www.suse.com/security/cve/CVE-2020-12402.html https://bugzilla.suse.com/1168669 https://bugzilla.suse.com/1173032 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0954-1: moderate: Security update for nasm
by opensuse-security＠opensuse.org 13 Jul '20

13 Jul '20

openSUSE Security Update: Security update for nasm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0954-1 Rating: moderate References: #1084631 #1086186 #1086227 #1086228 #1090519 #1090840 #1106878 #1107592 #1107594 #1108404 #1115758 #1115774 #1115795 #1173538 Cross-References: CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254 CVE-2018-10316 CVE-2018-16382 CVE-2018-16517 CVE-2018-16999 CVE-2018-19214 CVE-2018-19215 CVE-2018-19216 CVE-2018-8881 CVE-2018-8882 CVE-2018-8883 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-954=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nasm-2.14.02-lp152.4.3.1 nasm-debuginfo-2.14.02-lp152.4.3.1 nasm-debugsource-2.14.02-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000667.html https://www.suse.com/security/cve/CVE-2018-10016.html https://www.suse.com/security/cve/CVE-2018-10254.html https://www.suse.com/security/cve/CVE-2018-10316.html https://www.suse.com/security/cve/CVE-2018-16382.html https://www.suse.com/security/cve/CVE-2018-16517.html https://www.suse.com/security/cve/CVE-2018-16999.html https://www.suse.com/security/cve/CVE-2018-19214.html https://www.suse.com/security/cve/CVE-2018-19215.html https://www.suse.com/security/cve/CVE-2018-19216.html https://www.suse.com/security/cve/CVE-2018-8881.html https://www.suse.com/security/cve/CVE-2018-8882.html https://www.suse.com/security/cve/CVE-2018-8883.html https://bugzilla.suse.com/1084631 https://bugzilla.suse.com/1086186 https://bugzilla.suse.com/1086227 https://bugzilla.suse.com/1086228 https://bugzilla.suse.com/1090519 https://bugzilla.suse.com/1090840 https://bugzilla.suse.com/1106878 https://bugzilla.suse.com/1107592 https://bugzilla.suse.com/1107594 https://bugzilla.suse.com/1108404 https://bugzilla.suse.com/1115758 https://bugzilla.suse.com/1115774 https://bugzilla.suse.com/1115795 https://bugzilla.suse.com/1173538 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0950-1: important: Security update for opera
by opensuse-security＠opensuse.org 10 Jul '20

10 Jul '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0950-1 Rating: important References: #1173251 Cross-References: CVE-2020-6509 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 (CVE-2020-6509) - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildView(views::View*, int) - DNA-86122 [Mac] Some popovers have incorrectly themed arrow - DNA-86833 Add hint to tell users that tab content is now searched - DNA-86906 [Search in tabs] No matching results in your open tabs label not displayed for some strings not found. - DNA-86983 Allow to search from the tile - DNA-87029 Search in tabs dropdown should disappear when resizing window - DNA-87051 No autocompletion in the address bar for Speed Dials - DNA-87091 Do not vertically center search-in-tabs dialog - DNA-87113 Crash at content::NavigationRequest::GetRenderFrameHost() - DNA-87114 Double scrollbar in bookmarks popup - DNA-87117 Hide “Provide additional details” button when crash is discarded by Socorro - DNA-87122 Hide provide more information button from infobar when crash is discarded - DNA-87153 The icons cover the inscription on the BABE picture title - DNA-87203 The scroll view changes visible area unexpectedly - DNA-87243 Provide missing translations - DNA-87245 Extend schema and report search events - DNA-87261 Allow to use search and modal at the same time - DNA-87273 Switch to dedicated subdomain - Complete Opera 69.0 changelog at: https://blogs.opera.com/desktop/changelog-for-69/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-950=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-69.0.3686.49-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-6509.html https://bugzilla.suse.com/1173251 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0949-1: important: Security update for opera
by opensuse-security＠opensuse.org 10 Jul '20

10 Jul '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0949-1 Rating: important References: #1173251 Cross-References: CVE-2020-6509 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: - Update to version 69.0.3686.49 - CHR-7971 Update chromium on desktop-stable-83-3686 to 83.0.4103.116 (CVE-2020-6509) - DNA-79195 Wrong date on history - DNA-86090 Crash at views::View::ReorderChildView(views::View*, int) - DNA-86122 [Mac] Some popovers have incorrectly themed arrow - DNA-86833 Add hint to tell users that tab content is now searched - DNA-86906 [Search in tabs] No matching results in your open tabs label not displayed for some strings not found. - DNA-86983 Allow to search from the tile - DNA-87029 Search in tabs dropdown should disappear when resizing window - DNA-87051 No autocompletion in the address bar for Speed Dials - DNA-87091 Do not vertically center search-in-tabs dialog - DNA-87113 Crash at content::NavigationRequest::GetRenderFrameHost() - DNA-87114 Double scrollbar in bookmarks popup - DNA-87117 Hide “Provide additional details” button when crash is discarded by Socorro - DNA-87122 Hide provide more information button from infobar when crash is discarded - DNA-87153 The icons cover the inscription on the BABE picture title - DNA-87203 The scroll view changes visible area unexpectedly - DNA-87243 Provide missing translations - DNA-87245 Extend schema and report search events - DNA-87261 Allow to use search and modal at the same time - DNA-87273 Switch to dedicated subdomain - Complete Opera 69.0 changelog at: https://blogs.opera.com/desktop/changelog-for-69/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-949=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-69.0.3686.49-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-6509.html https://bugzilla.suse.com/1173251 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0947-1: important: Security update for chocolate-doom
by opensuse-security＠opensuse.org 08 Jul '20

08 Jul '20

openSUSE Security Update: Security update for chocolate-doom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0947-1 Rating: important References: #1173595 Cross-References: CVE-2020-14983 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chocolate-doom to version 3.0.1 fixes the following issues: - CVE-2020-14983: Fixed a stack-based buffer overflow in the networking code (boo#1173595). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-947=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): chocolate-doom-3.0.1-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): chocolate-doom-bash-completion-3.0.1-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-14983.html https://bugzilla.suse.com/1173595 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0945-1: moderate: Security update for rust, rust-cbindgen
by opensuse-security＠opensuse.org 07 Jul '20

07 Jul '20

openSUSE Security Update: Security update for rust, rust-cbindgen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0945-1 Rating: moderate References: #1115645 #1154817 #1173202 Cross-References: CVE-2020-1967 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for rust, rust-cbindgen fixes the following issues: rust was updated for use by Firefox 76ESR. - Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202) Update to version 1.43.1 - Updated openssl-src to 1.1.1g for CVE-2020-1967. - Fixed the stabilization of AVX-512 features. - Fixed `cargo package --list` not working with unpublished dependencies. Update to version 1.43.0 + Language: - Fixed using binary operations with `&{number}` (e.g. `&1.0`) not having the type inferred correctly. - Attributes such as `#[cfg()]` can now be used on `if` expressions. - Syntax only changes: * Allow `type Foo: Ord` syntactically. * Fuse associated and extern items up to defaultness. * Syntactically allow `self` in all `fn` contexts. * Merge `fn` syntax + cleanup item parsing. * `item` macro fragments can be interpolated into `trait`s, `impl`s, and `extern` blocks. For example, you may now write: ```rust macro_rules! mac_trait { ($i:item) => { trait T { $i } } } mac_trait! { fn foo() {} } ``` * These are still rejected *semantically*, so you will likely receive an error but these changes can be seen and parsed by macros and conditional compilation. + Compiler - You can now pass multiple lint flags to rustc to override the previous flags. For example; `rustc -D unused -A unused-variables` denies everything in the `unused` lint group except `unused-variables` which is explicitly allowed. However, passing `rustc -A unused-variables -D unused` denies everything in the `unused` lint group **including** `unused-variables` since the allow flag is specified before the deny flag (and therefore overridden). - rustc will now prefer your system MinGW libraries over its bundled libraries if they are available on `windows-gnu`. - rustc now buffers errors/warnings printed in JSON. Libraries: - `Arc<[T; N]>`, `Box<[T; N]>`, and `Rc<[T; N]>`, now implement `TryFrom<Arc<[T]>>`,`TryFrom<Box<[T]>>`, and `TryFrom<Rc<[T]>>` respectively. **Note** These conversions are only available when `N` is `0..=32`. - You can now use associated constants on floats and integers directly, rather than having to import the module. e.g. You can now write `u32::MAX` or `f32::NAN` with no imports. - `u8::is_ascii` is now `const`. - `String` now implements `AsMut<str>`. - Added the `primitive` module to `std` and `core`. This module reexports Rust's primitive types. This is mainly useful in macros where you want avoid these types being shadowed. - Relaxed some of the trait bounds on `HashMap` and `HashSet`. - `string::FromUtf8Error` now implements `Clone + Eq`. + Stabilized APIs - `Once::is_completed` - `f32::LOG10_2` - `f32::LOG2_10` - `f64::LOG10_2` - `f64::LOG2_10` - `iter::once_with` + Cargo - You can now set config `[profile]`s in your `.cargo/config`, or through your environment. - Cargo will now set `CARGO_BIN_EXE_<name>` pointing to a binary's executable path when running integration tests or benchmarks. `<name>` is the name of your binary as-is e.g. If you wanted the executable path for a binary named `my-program`you would use `env!("CARGO_BIN_EXE_my-program")`. + Misc - Certain checks in the `const_err` lint were deemed unrelated to const evaluation, and have been moved to the `unconditional_panic` and `arithmetic_overflow` lints. + Compatibility Notes - Having trailing syntax in the `assert!` macro is now a hard error. This has been a warning since 1.36.0. - Fixed `Self` not having the correctly inferred type. This incorrectly led to some instances being accepted, and now correctly emits a hard error. Update to version 1.42.0: + Language - You can now use the slice pattern syntax with subslices. - You can now use #[repr(transparent)] on univariant enums. Meaning that you can create an enum that has the exact layout and ABI of the type it contains. - There are some syntax-only changes: * default is syntactically allowed before items in trait definitions. * Items in impls (i.e. consts, types, and fns) may syntactically leave out their bodies in favor of ;. * Bounds on associated types in impls are now syntactically allowed (e.g. type Foo: Ord;). * ... (the C-variadic type) may occur syntactically directly as the type of any function parameter. These are still rejected semantically, so you will likely receive an error but these changes can be seen and parsed by procedural macros and conditional compilation. + Compiler - Added tier 2 support for armv7a-none-eabi. - Added tier 2 support for riscv64gc-unknown-linux-gnu. - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap, unwrap_err} now produce panic messages pointing to the location where they were called, rather than core's internals. Refer to Rust's platform support page for more information on Rust's tiered platform support. + Libraries - iter::Empty<T> now implements Send and Sync for any T. - Pin::{map_unchecked, map_unchecked_mut} no longer require the return type to implement Sized. - io::Cursor now derives PartialEq and Eq. - Layout::new is now const. - Added Standard Library support for riscv64gc-unknown-linux-gnu. + Stabilized APIs - CondVar::wait_while - CondVar::wait_timeout_while - DebugMap::key - DebugMap::value - ManuallyDrop::take - matches! - ptr::slice_from_raw_parts_mut - ptr::slice_from_raw_parts + Cargo - You no longer need to include extern crate proc_macro; to be able to use proc_macro; in the 2018 edition. + Compatibility Notes - Error::description has been deprecated, and its use will now produce a warning. It's recommended to use Display/to_string instead. Update to version 1.41.1: - Always check types of static items - Always check lifetime bounds of `Copy` impls - Fix miscompilation in callers of `Layout::repeat` Update to version 1.41.0: + Language - You can now pass type parameters to foreign items when implementing traits. E.g. You can now write `impl<T> From<Foo> for Vec<T> {}`. - You can now arbitrarily nest receiver types in the `self` position. E.g. you can now write `fn foo(self: Box<Box<Self>>) {}`. Previously only `Self`, `&Self`, `&mut Self`, `Arc<Self>`, `Rc<Self>`, and `Box<Self>` were allowed. - You can now use any valid identifier in a `format_args` macro. Previously identifiers starting with an underscore were not allowed. - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and enum variants. These are still rejected semantically, but can be seen and parsed by procedural macros and conditional compilation. + Compiler - Rustc will now warn if you have unused loop `'label`s. - Removed support for the `i686-unknown-dragonfly` target. - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target. - You can now pass an arguments file passing the `@path` syntax to rustc. Note that the format differs somewhat from what is found in other tooling; please see the documentation for more information. - You can now provide `--extern` flag without a path, indicating that it is available from the search path or specified with an `-L` flag. Refer to Rust's [platform support page][forge-platform-support] for more information on Rust's tiered platform support. + Libraries - The `core::panic` module is now stable. It was already stable through `std`. - `NonZero*` numerics now implement `From<NonZero*>` if it's a smaller integer width. E.g. `NonZeroU16` now implements `From<NonZeroU8>`. - `MaybeUninit<T>` now implements `fmt::Debug`. + Stabilized APIs - `Result::map_or` - `Result::map_or_else` - `std::rc::Weak::weak_count` - `std::rc::Weak::strong_count` - `std::sync::Weak::weak_count` - `std::sync::Weak::strong_count` + Cargo - Cargo will now document all the private items for binary crates by default. - `cargo-install` will now reinstall the package if it detects that it is out of date. - Cargo.lock now uses a more git friendly format that should help to reduce merge conflicts. - You can now override specific dependencies's build settings. E.g. `[profile.dev.package.image] opt-level = 2` sets the `image` crate's optimisation level to `2` for debug builds. You can also use `[profile.<profile>.build-override]` to override build scripts and their dependencies. + Misc - You can now specify `edition` in documentation code blocks to compile the block for that edition. E.g. `edition2018` tells rustdoc that the code sample should be compiled the 2018 edition of Rust. - You can now provide custom themes to rustdoc with `--theme`, and check the current theme with `--check-theme`. - You can use `#[cfg(doc)]` to compile an item when building documentation. + Compatibility Notes - As previously announced 1.41.0 will be the last tier 1 release for 32-bit Apple targets. This means that the source code is still available to build, but the targets are no longer being tested and release binaries for those platforms will no longer be distributed by the Rust project. Please refer to the linked blog post for more information. - Bump version of libssh2 for SLE15; we now need a version with libssh2_userauth_publickey_frommemory(), which appeared in libssh2 1.6.0. Update to version 1.40.0 + Language - You can now use tuple `struct`s and tuple `enum` variant's constructors in `const` contexts. e.g. pub struct Point(i32, i32); const ORIGIN: Point = { let constructor = Point; constructor(0, 0) }; - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to indicate that there may be variants or fields added in the future. For example this requires adding a wild-card branch (`_ => {}`) to any match statements on a non-exhaustive `enum`. - You can now use function-like procedural macros in `extern` blocks and in type positions. e.g. `type Generated = macro!();` - Function-like and attribute procedural macros can now emit `macro_rules!` items, so you can now have your macros generate macros. - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`, `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`. + Compiler - Added tier 3 support\* for the `thumbv7neon-unknown-linux-musleabihf` target. - Added tier 3 support for the `aarch64-unknown-none-softfloat` target. - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and `mips64el-unknown-linux-muslabi64` targets. + Libraries - The `is_power_of_two` method on unsigned numeric types is now a `const` function. + Stabilized APIs - BTreeMap::get_key_value - HashMap::get_key_value - Option::as_deref_mut - Option::as_deref - Option::flatten - UdpSocket::peer_addr - f32::to_be_bytes - f32::to_le_bytes - f32::to_ne_bytes - f64::to_be_bytes - f64::to_le_bytes - f64::to_ne_bytes - f32::from_be_bytes - f32::from_le_bytes - f32::from_ne_bytes - f64::from_be_bytes - f64::from_le_bytes - f64::from_ne_bytes - mem::take - slice::repeat - todo! + Cargo - Cargo will now always display warnings, rather than only on fresh builds. - Feature flags (except `--all-features`) passed to a virtual workspace will now produce an error. Previously these flags were ignored. - You can now publish `dev-dependencies` without including a `version`. + Misc - You can now specify the `#[cfg(doctest)]` attribute to include an item only when running documentation tests with `rustdoc`. + Compatibility Notes - As previously announced, any previous NLL warnings in the 2015 edition are now hard errors. - The `include!` macro will now warn if it failed to include the entire file. The `include!` macro unintentionally only includes the first _expression_ in a file, and this can be unintuitive. This will become either a hard error in a future release, or the behavior may be fixed to include all expressions as expected. - Using `#[inline]` on function prototypes and consts now emits a warning under `unused_attribute` lint. Using `#[inline]` anywhere else inside traits or `extern` blocks now correctly emits a hard error. Update to version 1.39.0 + Language - You can now create async functions and blocks with async fn, async move {}, and async {} respectively, and you can now call .await on async expressions. - You can now use certain attributes on function, closure, and function pointer parameters. - You can now take shared references to bind-by-move patterns in the if guards of match arms. + Compiler - Added tier 3 support for the i686-unknown-uefi target. - Added tier 3 support for the sparc64-unknown-openbsd target. - rustc will now trim code snippets in diagnostics to fit in your terminal. - You can now pass --show-output argument to test binaries to print the output of successful tests. + For more details: https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019 -11-07 - Switch to bundled version of libgit2 for now. libgit2-sys seems to expect using the bundled variant, which just seems to point to a snapshot of the master branch and doesn't match any released libgit2 (bsc#1154817). See: https://github.com/rust-lang/rust/issues/63476 and https://github.com/rust-lang/git2-rs/issues/458 for details. Update to version 1.38.0 + Language - The `#[global_allocator]` attribute can now be used in submodules. - The `#[deprecated]` attribute can now be used on macros. + Compiler - Added pipelined compilation support to `rustc`. This will improve compilation times in some cases. + Libraries - `ascii::EscapeDefault` now implements `Clone` and `Display`. - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now available at the same path as the trait. (e.g. The `Clone` derive macro is available at `std::clone::Clone`). This also makes all built-in macros available in `std`/`core` root. e.g. `std::include_bytes!`. - `str::Chars` now implements `Debug`. - `slice::{concat, connect, join}` now accepts `&[T]` in addition to `&T`. - `*const T` and `*mut T` now implement `marker::Unpin`. - `Arc<[T]>` and `Rc<[T]>` now implement `FromIterator<T>`. - Added euclidean remainder and division operations (`div_euclid`, `rem_euclid`) to all numeric primitives. Additionally `checked`, `overflowing`, and `wrapping` versions are available for all integer primitives. - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and `PartialEq`. - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`. + Stabilized APIs - `<*const T>::cast` - `<*mut T>::cast` - `Duration::as_secs_f32` - `Duration::as_secs_f64` - `Duration::div_f32` - `Duration::div_f64` - `Duration::from_secs_f32` - `Duration::from_secs_f64` - `Duration::mul_f32` - `Duration::mul_f64` - `any::type_name` + Cargo - Added pipelined compilation support to `cargo`. - You can now pass the `--features` option multiple times to enable multiple features. + Misc - `rustc` will now warn about some incorrect uses of `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour. Update to version 1.37.0 + Language - #[must_use] will now warn if the type is contained in a tuple, Box, or an array and unused. - You can now use the `cfg` and `cfg_attr` attributes on generic parameters. - You can now use enum variants through type alias. e.g. You can write the following: ``` type MyOption = Option<u8>; fn increment_or_zero(x: MyOption) -> u8 { match x { MyOption::Some(y) => y + 1, MyOption::None => 0, } } ``` - You can now use `_` as an identifier for consts. e.g. You can write `const _: u32 = 5;`. - You can now use `#[repr(align(X)]` on enums. - The `?` Kleene macro operator is now available in the 2015 edition. + Compiler - You can now enable Profile-Guided Optimization with the `-C profile-generate` and `-C profile-use` flags. For more information on how to use profile guided optimization, please refer to the rustc book. - The `rust-lldb` wrapper script should now work again. + Libraries - `mem::MaybeUninit<T>` is now ABI-compatible with `T`. + Stabilized APIs - BufReader::buffer - BufWriter::buffer - Cell::from_mut - Cell<[T]>::as_slice_of_cells - Cell<slice>::as_slice_of_cells - DoubleEndedIterator::nth_back - Option::xor - Wrapping::reverse_bits - i128::reverse_bits - i16::reverse_bits - i32::reverse_bits - i64::reverse_bits - i8::reverse_bits - isize::reverse_bits - slice::copy_within - u128::reverse_bits - u16::reverse_bits - u32::reverse_bits - u64::reverse_bits - u8::reverse_bits - usize::reverse_bits + Cargo - Cargo.lock files are now included by default when publishing executable crates with executables. - You can now specify `default-run="foo"` in `[package]` to specify the default executable to use for `cargo run`. - cargo-vendor is now provided as a sub-command of cargo + Compatibility Notes - Using `...` for inclusive range patterns will now warn by default. Please transition your code to using the `..=` syntax for inclusive ranges instead. - Using a trait object without the `dyn` will now warn by default. Please transition your code to use `dyn Trait` for trait objects instead. Crab(String), Lobster(String), Person(String), let state = Creature::Crab("Ferris"); if let Creature::Crab(name) | Creature::Person(name) = state { println!("This creature's name is: {}", name); } unsafe { foo() } pub fn new(x: i32, y: i32) -> Self { Self(x, y) } pub fn is_origin(&self) -> bool { match self { Self(0, 0) => true, _ => false, } } Self: PartialOrd<Self> // can write `Self` instead of `List<T>` Nil, Cons(T, Box<Self>) // likewise here fn test(&self) { println!("one"); } //~ ERROR duplicate definitions with name `test` fn test(&self) { println!("two"); } * Basic procedural macros allowing custom `#[derive]`, aka "macros 1.1", are stable. This allows popular code-generating crates like Serde and Diesel to work ergonomically. [RFC 1681]. * [Tuple structs may be empty. Unary and empty tuple structs may be instantiated with curly braces][36868]. Part of [RFC 1506]. * [A number of minor changes to name resolution have been activated][37127]. They add up to more consistent semantics, allowing for future evolution of Rust macros. Specified in [RFC 1560], see its section on ["changes"] for details of what is different. The breaking changes here have been transitioned through the [`legacy_imports`] lint since 1.14, with no known regressions. * [In `macro_rules`, `path` fragments can now be parsed as type parameter bounds][38279] * [`?Sized` can be used in `where` clauses][37791] * [There is now a limit on the size of monomorphized types and it can be modified with the `#![type_size_limit]` crate attribute, similarly to the `#![recursion_limit]` attribute][37789] * [On Windows, the compiler will apply dllimport attributes when linking to extern functions][37973]. Additional attributes and flags can control which library kind is linked and its name. [RFC 1717]. * [Rust-ABI symbols are no longer exported from cdylibs][38117] * [The `--test` flag works with procedural macro crates][38107] * [Fix `extern "aapcs" fn` ABI][37814] * [The `-C no-stack-check` flag is deprecated][37636]. It does nothing. * [The `format!` expander recognizes incorrect `printf` and shell-style formatting directives and suggests the correct format][37613]. * [Only report one error for all unused imports in an import list][37456] * [Avoid unnecessary `mk_ty` calls in `Ty::super_fold_with`][37705] * [Avoid more unnecessary `mk_ty` calls in `Ty::super_fold_with`][37979] * [Don't clone in `UnificationTable::probe`][37848] * [Remove `scope_auxiliary` to cut RSS by 10%][37764] * [Use small vectors in type walker][37760] * [Macro expansion performance was improved][37701] * [Change `HirVec<P<T>>` to `HirVec<T>` in `hir::Expr`][37642] * [Replace FNV with a faster hash function][37229] https://raw.githubusercontent.com/rust-lang/rust/master/RELEASES.md rust-cbindgen is shipped in version 0.14.1. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-945=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cargo-1.43.1-lp152.3.5.1 clippy-1.43.1-lp152.3.5.1 rls-1.43.1-lp152.3.5.1 rust-1.43.1-lp152.3.5.1 rust-analysis-1.43.1-lp152.3.5.1 rust-doc-1.43.1-lp152.3.5.1 rust-gdb-1.43.1-lp152.3.5.1 rust-std-static-1.43.1-lp152.3.5.1 rustfmt-1.43.1-lp152.3.5.1 - openSUSE Leap 15.2 (noarch): cargo-doc-1.43.1-lp152.3.5.1 rust-src-1.43.1-lp152.3.5.1 - openSUSE Leap 15.2 (x86_64): rust-cbindgen-0.14.1-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-1967.html https://bugzilla.suse.com/1115645 https://bugzilla.suse.com/1154817 https://bugzilla.suse.com/1173202 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0