August 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1231-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 18 Aug '20

18 Aug '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1231-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1231=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): hylafax+-7.0.3-bp151.6.4.1 hylafax+-client-7.0.3-bp151.6.4.1 libfaxutil7_0_3-7.0.3-bp151.6.4.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1230-1: moderate: Security update for balsa
by opensuse-security＠opensuse.org 18 Aug '20

18 Aug '20

openSUSE Security Update: Security update for balsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1230-1 Rating: moderate References: #1174711 Cross-References: CVE-2020-16118 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for balsa fixes the following issues: - CVE-2020-16118: Fixed a NULL pointer dereference (boo#1174711). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1230=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): balsa-2.5.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): balsa-lang-2.5.5-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-16118.html https://bugzilla.suse.com/1174711 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1228-1: moderate: Security update for postgresql, postgresql96, postgresql10, postgresql12
by opensuse-security＠opensuse.org 17 Aug '20

17 Aug '20

openSUSE Security Update: Security update for postgresql, postgresql96, postgresql10, postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1228-1 Rating: moderate References: #1148643 #1171924 #1175193 #1175194 Cross-References: CVE-2020-14349 CVE-2020-14350 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for postgresql, postgresql96, postgresql10, postgresql12 fixes the following issues: Postgresql12 was updated to 12.3 (bsc#1171924). - https://www.postgresql.org/about/news/2038/ - https://www.postgresql.org/docs/12/release-12-3.html - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. Also changed in the postgresql wrapper package: - Bump version to 12.0.1, so that the binary packages also have a cut-point to conflict with. - Conflict with versions of the binary packages prior to the May 2020 update, because we changed the package layout at that point and need a clean cutover. - Bump package version to 12, but leave default at 10 for SLE-15 and SLE-15-SP1. postgresql11 was updated to 11.9: * CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers * CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure. * https://www.postgresql.org/docs/11/release-11-9.html - Pack the /usr/lib/postgresql symlink only into the main package. postgresql11 was updated to 11.8 (bsc#1171924). * https://www.postgresql.org/about/news/2038/ * https://www.postgresql.org/docs/11/release-11-8.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the "libs" build flavour to a "mini" package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643). postgresql10 was updated to 10.13 (bsc#1171924). - https://www.postgresql.org/about/news/2038/ - https://www.postgresql.org/docs/10/release-10-13.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the "libs" build flavour to a "mini" package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643). postgresql96 was updated to 9.6.19: * CVE-2020-14350, boo#1175194: Make contrib modules' installation scripts more secure. * https://www.postgresql.org/docs/9.6/release-9-6-19.html - Pack the /usr/lib/postgresql symlink only into the main package. - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. - update to 9.6.18 (boo#1171924). https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/9.6/release-9-6-18.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the "libs" build flavour to a "mini" package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (boo#1148643). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1228=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libecpg6-12.3-lp152.3.4.1 libecpg6-debuginfo-12.3-lp152.3.4.1 libpq5-12.3-lp152.3.4.1 libpq5-debuginfo-12.3-lp152.3.4.1 postgresql10-10.13-lp152.2.3.1 postgresql10-contrib-10.13-lp152.2.3.1 postgresql10-contrib-debuginfo-10.13-lp152.2.3.1 postgresql10-debuginfo-10.13-lp152.2.3.1 postgresql10-debugsource-10.13-lp152.2.3.1 postgresql10-devel-10.13-lp152.2.3.1 postgresql10-devel-debuginfo-10.13-lp152.2.3.1 postgresql10-plperl-10.13-lp152.2.3.1 postgresql10-plperl-debuginfo-10.13-lp152.2.3.1 postgresql10-plpython-10.13-lp152.2.3.1 postgresql10-plpython-debuginfo-10.13-lp152.2.3.1 postgresql10-pltcl-10.13-lp152.2.3.1 postgresql10-pltcl-debuginfo-10.13-lp152.2.3.1 postgresql10-server-10.13-lp152.2.3.1 postgresql10-server-debuginfo-10.13-lp152.2.3.1 postgresql10-test-10.13-lp152.2.3.1 postgresql12-12.3-lp152.3.4.1 postgresql12-contrib-12.3-lp152.3.4.1 postgresql12-contrib-debuginfo-12.3-lp152.3.4.1 postgresql12-debuginfo-12.3-lp152.3.4.1 postgresql12-debugsource-12.3-lp152.3.4.1 postgresql12-devel-12.3-lp152.3.4.1 postgresql12-devel-debuginfo-12.3-lp152.3.4.1 postgresql12-llvmjit-12.3-lp152.3.4.1 postgresql12-llvmjit-debuginfo-12.3-lp152.3.4.1 postgresql12-plperl-12.3-lp152.3.4.1 postgresql12-plperl-debuginfo-12.3-lp152.3.4.1 postgresql12-plpython-12.3-lp152.3.4.1 postgresql12-plpython-debuginfo-12.3-lp152.3.4.1 postgresql12-pltcl-12.3-lp152.3.4.1 postgresql12-pltcl-debuginfo-12.3-lp152.3.4.1 postgresql12-server-12.3-lp152.3.4.1 postgresql12-server-debuginfo-12.3-lp152.3.4.1 postgresql12-server-devel-12.3-lp152.3.4.1 postgresql12-server-devel-debuginfo-12.3-lp152.3.4.1 postgresql12-test-12.3-lp152.3.4.1 postgresql96-9.6.19-lp152.2.3.1 postgresql96-contrib-9.6.19-lp152.2.3.1 postgresql96-contrib-debuginfo-9.6.19-lp152.2.3.1 postgresql96-debuginfo-9.6.19-lp152.2.3.1 postgresql96-debugsource-9.6.19-lp152.2.3.1 postgresql96-devel-9.6.19-lp152.2.3.1 postgresql96-devel-debuginfo-9.6.19-lp152.2.3.1 postgresql96-plperl-9.6.19-lp152.2.3.1 postgresql96-plperl-debuginfo-9.6.19-lp152.2.3.1 postgresql96-plpython-9.6.19-lp152.2.3.1 postgresql96-plpython-debuginfo-9.6.19-lp152.2.3.1 postgresql96-pltcl-9.6.19-lp152.2.3.1 postgresql96-pltcl-debuginfo-9.6.19-lp152.2.3.1 postgresql96-server-9.6.19-lp152.2.3.1 postgresql96-server-debuginfo-9.6.19-lp152.2.3.1 postgresql96-test-9.6.19-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): postgresql-12.0.1-lp152.3.3.2 postgresql-contrib-12.0.1-lp152.3.3.2 postgresql-devel-12.0.1-lp152.3.3.2 postgresql-docs-12.0.1-lp152.3.3.2 postgresql-llvmjit-12.0.1-lp152.3.3.2 postgresql-plperl-12.0.1-lp152.3.3.2 postgresql-plpython-12.0.1-lp152.3.3.2 postgresql-pltcl-12.0.1-lp152.3.3.2 postgresql-server-12.0.1-lp152.3.3.2 postgresql-server-devel-12.0.1-lp152.3.3.2 postgresql-test-12.0.1-lp152.3.3.2 postgresql10-docs-10.13-lp152.2.3.1 postgresql11-docs-11.9-lp152.3.3.1 postgresql12-docs-12.3-lp152.3.4.1 postgresql96-docs-9.6.19-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libecpg6-32bit-12.3-lp152.3.4.1 libecpg6-32bit-debuginfo-12.3-lp152.3.4.1 libpq5-32bit-12.3-lp152.3.4.1 libpq5-32bit-debuginfo-12.3-lp152.3.4.1 postgresql11-11.9-lp152.3.3.1 postgresql11-contrib-11.9-lp152.3.3.1 postgresql11-contrib-debuginfo-11.9-lp152.3.3.1 postgresql11-debuginfo-11.9-lp152.3.3.1 postgresql11-debugsource-11.9-lp152.3.3.1 postgresql11-devel-11.9-lp152.3.3.1 postgresql11-devel-debuginfo-11.9-lp152.3.3.1 postgresql11-llvmjit-11.9-lp152.3.3.1 postgresql11-llvmjit-debuginfo-11.9-lp152.3.3.1 postgresql11-plperl-11.9-lp152.3.3.1 postgresql11-plperl-debuginfo-11.9-lp152.3.3.1 postgresql11-plpython-11.9-lp152.3.3.1 postgresql11-plpython-debuginfo-11.9-lp152.3.3.1 postgresql11-pltcl-11.9-lp152.3.3.1 postgresql11-pltcl-debuginfo-11.9-lp152.3.3.1 postgresql11-server-11.9-lp152.3.3.1 postgresql11-server-debuginfo-11.9-lp152.3.3.1 postgresql11-server-devel-11.9-lp152.3.3.1 postgresql11-server-devel-debuginfo-11.9-lp152.3.3.1 postgresql11-test-11.9-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-14349.html https://www.suse.com/security/cve/CVE-2020-14350.html https://bugzilla.suse.com/1148643 https://bugzilla.suse.com/1171924 https://bugzilla.suse.com/1175193 https://bugzilla.suse.com/1175194 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1227-1: moderate: Security update for postgresql96, postgresql10 and postgresql12
by opensuse-security＠opensuse.org 17 Aug '20

17 Aug '20

openSUSE Security Update: Security update for postgresql96, postgresql10 and postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1227-1 Rating: moderate References: #1091610 #1104199 #1104202 #1134689 #1145092 #1148643 #1163985 #1171924 #1175194 Cross-References: CVE-2018-10915 CVE-2018-10925 CVE-2018-1115 CVE-2019-10130 CVE-2019-10208 CVE-2020-14350 CVE-2020-1720 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for postgresql96, postgresql10 and postgresql12 fixes the following issues: postgresql10 was updated to 10.13 (bsc#1171924). https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/10/release-10-13.html postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985) - https://www.postgresql.org/about/news/2011/ - https://www.postgresql.org/docs/10/release-10-12.html postgresql10 was updated to 10.11: - https://www.postgresql.org/about/news/1994/ - https://www.postgresql.org/docs/10/release-10-11.html postgresql12 was updated to 12.3 (bsc#1171924). Bug Fixes and Improvements: - Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input. - Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes. - Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects. - Allow for a partition to be detached when it has inherited ROW triggers. - Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails. - Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression. - Fix performance regression in floating point overflow/underflow detection. - Several fixes for full text search, particularly with phrase searching. - Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause. - Several reporting fixes for the output of VACUUM VERBOSE. - Allow input of type circle to accept the format (x,y),r, which is specified in the documentation. - Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB. - Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived. - Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines. - Several fixes for logical replication and replication slots. - Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting. - Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption. - Ensure that members of the pg_read_all_stats role can read all statistics views. - Fix performance regression in information_schema.triggers view. - Fix memory leak in libpq when using sslmode=verify-full. - Fix crash in psql when attempting to re-establish a failed connection. - Allow tab-completion of the filename argument to \gx command in psql. - Add pg_dump support for ALTER ... DEPENDS ON EXTENSION. - Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end. - Ensure pg_basebackup generates valid tar files. - pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version - Several Windows compatibility fixes This update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions. For more details, check out: - https://www.postgresql.org/docs/12/release-12-3.html Other fixes: - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. postgresql96 was updated to 9.6.19: * CVE-2020-14350, boo#1175194: Make contrib modules' installation scripts more secure. * https://www.postgresql.org/docs/9.6/release-9-6-19.html - Pack the /usr/lib/postgresql symlink only into the main package. - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. - update to 9.6.18 (boo#1171924). https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/9.6/release-9-6-18.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the "libs" build flavour to a "mini" package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (boo#1148643). - update to 9.6.17 (CVE-2020-1720, boo#1163985) https://www.postgresql.org/about/news/2011/ https://www.postgresql.org/docs/9.6/release-9-6-17.html - use and package the sha256 checksum for for source - update to 9.6.16: https://www.postgresql.org/about/news/1994/ https://www.postgresql.org/docs/9.6/release-9-6-16.html - add requires to the devel package for the libs that are returned by pg_config --libs - Update to 9.6.15: * https://www.postgresql.org/about/news/1960/ * https://www.postgresql.org/docs/9.6/release-9-6-15.html * CVE-2019-10208, boo#1145092: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution. - Use FAT LTO objects in order to provide proper static library. - Update to 9.6.14: https://www.postgresql.org/docs/9.6/release-9-6-14.html - Update to 9.6.13: * https://www.postgresql.org/docs/9.6/release-9-6-13.html * https://www.postgresql.org/about/news/1939/ * CVE-2019-10130, boo#1134689: Prevent row-level security policies from being bypassed via selectivity estimators. - Make the server-devel package exclusive across versions. - Update to 9.6.12: * https://www.postgresql.org/docs/9.6/release-9-6-12.html * https://www.postgresql.org/about/news/1920/ * By default, panic instead of retrying after fsync() failure, to avoid possible data corruption. * Numerous other bug fixes. - Overhaul README.SUSE - Update to 9.6.11: * Numerous bug fixes, see the release notes: https://www.postgresql.org/docs/9.6/release-9-6-11.html * Remove unneeded library dependencies from PGXS. - add provides for the new server-devel package that will be introduced in postgresql 11 - Update to 9.6.10: https://www.postgresql.org/docs/current/static/release-9-6-10.html * CVE-2018-10915, boo#1104199: Fix failure to reset libpq's state fully between connection attempts. * CVE-2018-10925, boo#1104202: Fix INSERT ... ON CONFLICT UPDATE through a view that isn't just SELECT * FROM ... - Update to 9.6.9: https://www.postgresql.org/about/news/1851/ https://www.postgresql.org/docs/current/static/release-9-6-9.html A dump/restore is not required for those running 9.6.X. However, if you use the adminpack extension, you should update it as per the first changelog entry below. Also, if the function marking mistakes mentioned in the second and third changelog entries below affect you, you will want to take steps to correct your database catalogs. * CVE-2018-1115, boo#1091610: Remove public execute privilege from contrib/adminpack's pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper for the core function pg_rotate_logfile(). When that function was changed to rely on SQL privileges for access control rather than a hard-coded superuser check, pg_logfile_rotate() should have been updated as well, but the need for this was missed. Hence, if adminpack is installed, any user could request a logfile rotation, creating a minor security issue. After installing this update, administrators should update adminpack by performing ALTER EXTENSION adminpack UPDATE in each database in which adminpack is installed. * Fix incorrect volatility markings on a few built-in functions * Fix incorrect parallel-safety markings on a few built-in functions. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1227=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): postgresql10-10.13-lp151.2.14.1 postgresql10-contrib-10.13-lp151.2.14.1 postgresql10-contrib-debuginfo-10.13-lp151.2.14.1 postgresql10-debuginfo-10.13-lp151.2.14.1 postgresql10-debugsource-10.13-lp151.2.14.1 postgresql10-devel-10.13-lp151.2.14.1 postgresql10-devel-debuginfo-10.13-lp151.2.14.1 postgresql10-plperl-10.13-lp151.2.14.1 postgresql10-plperl-debuginfo-10.13-lp151.2.14.1 postgresql10-plpython-10.13-lp151.2.14.1 postgresql10-plpython-debuginfo-10.13-lp151.2.14.1 postgresql10-pltcl-10.13-lp151.2.14.1 postgresql10-pltcl-debuginfo-10.13-lp151.2.14.1 postgresql10-server-10.13-lp151.2.14.1 postgresql10-server-debuginfo-10.13-lp151.2.14.1 postgresql10-test-10.13-lp151.2.14.1 postgresql96-9.6.19-lp151.3.3.1 postgresql96-contrib-9.6.19-lp151.3.3.1 postgresql96-contrib-debuginfo-9.6.19-lp151.3.3.1 postgresql96-debuginfo-9.6.19-lp151.3.3.1 postgresql96-debugsource-9.6.19-lp151.3.3.1 postgresql96-devel-9.6.19-lp151.3.3.1 postgresql96-devel-debuginfo-9.6.19-lp151.3.3.1 postgresql96-plperl-9.6.19-lp151.3.3.1 postgresql96-plperl-debuginfo-9.6.19-lp151.3.3.1 postgresql96-plpython-9.6.19-lp151.3.3.1 postgresql96-plpython-debuginfo-9.6.19-lp151.3.3.1 postgresql96-pltcl-9.6.19-lp151.3.3.1 postgresql96-pltcl-debuginfo-9.6.19-lp151.3.3.1 postgresql96-server-9.6.19-lp151.3.3.1 postgresql96-server-debuginfo-9.6.19-lp151.3.3.1 postgresql96-test-9.6.19-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libecpg6-12.3-lp151.2.1 libecpg6-debuginfo-12.3-lp151.2.1 libpq5-12.3-lp151.2.1 libpq5-debuginfo-12.3-lp151.2.1 postgresql12-12.3-lp151.2.1 postgresql12-contrib-12.3-lp151.2.1 postgresql12-contrib-debuginfo-12.3-lp151.2.1 postgresql12-debuginfo-12.3-lp151.2.1 postgresql12-debugsource-12.3-lp151.2.1 postgresql12-devel-12.3-lp151.2.1 postgresql12-devel-debuginfo-12.3-lp151.2.1 postgresql12-llvmjit-12.3-lp151.2.1 postgresql12-llvmjit-debuginfo-12.3-lp151.2.1 postgresql12-plperl-12.3-lp151.2.1 postgresql12-plperl-debuginfo-12.3-lp151.2.1 postgresql12-plpython-12.3-lp151.2.1 postgresql12-plpython-debuginfo-12.3-lp151.2.1 postgresql12-pltcl-12.3-lp151.2.1 postgresql12-pltcl-debuginfo-12.3-lp151.2.1 postgresql12-server-12.3-lp151.2.1 postgresql12-server-debuginfo-12.3-lp151.2.1 postgresql12-server-devel-12.3-lp151.2.1 postgresql12-server-devel-debuginfo-12.3-lp151.2.1 postgresql12-test-12.3-lp151.2.1 - openSUSE Leap 15.1 (noarch): postgresql-12.0.1-lp151.6.9.1 postgresql-contrib-12.0.1-lp151.6.9.1 postgresql-devel-12.0.1-lp151.6.9.1 postgresql-docs-12.0.1-lp151.6.9.1 postgresql-llvmjit-12.0.1-lp151.6.9.1 postgresql-plperl-12.0.1-lp151.6.9.1 postgresql-plpython-12.0.1-lp151.6.9.1 postgresql-pltcl-12.0.1-lp151.6.9.1 postgresql-server-12.0.1-lp151.6.9.1 postgresql-server-devel-12.0.1-lp151.6.9.1 postgresql-test-12.0.1-lp151.6.9.1 postgresql10-docs-10.13-lp151.2.14.1 postgresql12-docs-12.3-lp151.2.1 postgresql96-docs-9.6.19-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10915.html https://www.suse.com/security/cve/CVE-2018-10925.html https://www.suse.com/security/cve/CVE-2018-1115.html https://www.suse.com/security/cve/CVE-2019-10130.html https://www.suse.com/security/cve/CVE-2019-10208.html https://www.suse.com/security/cve/CVE-2020-14350.html https://www.suse.com/security/cve/CVE-2020-1720.html https://bugzilla.suse.com/1091610 https://bugzilla.suse.com/1104199 https://bugzilla.suse.com/1104202 https://bugzilla.suse.com/1134689 https://bugzilla.suse.com/1145092 https://bugzilla.suse.com/1148643 https://bugzilla.suse.com/1163985 https://bugzilla.suse.com/1171924 https://bugzilla.suse.com/1175194 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1222-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 16 Aug '20

16 Aug '20

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1222-1 Rating: moderate References: #1062631 #1146025 #1157627 #1165849 #1172053 #1172189 #1172795 #1172796 Cross-References: CVE-2020-12802 CVE-2020-12803 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: This update for libreoffice fixes the following issues: - Update to 6.4.5.2: * Various fixes all around - Remove mime-info and application-registry dirs bsc#1062631 - Fix bsc#1172053 - LO-L3: Image disappears during roundtrip 365->Impress->365 * bsc1172053.diff - Fix bsc#1172189 - LO-L3: Impress crashes midway opening a PPTX document * bsc1172189.diff - Fix bsc#1157627 - LO-L3: Some XML-created shapes simply lost upon PPTX import (= earth loses countries) * bsc1157627.diff - Fix bsc#1146025 - LO-L3: Colored textboxes in PPTX look very odd (SmartArt) - Fix bsc#1165849 - LO-L3: Shadow size for rectangle is only a fraction of Office 365 * bsc1165849-1.diff * bsc1165849-2.diff * bsc1165849-3.diff This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1222=1 Package List: - openSUSE Leap 15.1 (noarch): libreoffice-branding-upstream-6.4.5.2-lp151.3.18.1 libreoffice-gdb-pretty-printers-6.4.5.2-lp151.3.18.1 libreoffice-glade-6.4.5.2-lp151.3.18.1 libreoffice-icon-themes-6.4.5.2-lp151.3.18.1 libreoffice-l10n-af-6.4.5.2-lp151.3.18.1 libreoffice-l10n-am-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ar-6.4.5.2-lp151.3.18.1 libreoffice-l10n-as-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ast-6.4.5.2-lp151.3.18.1 libreoffice-l10n-be-6.4.5.2-lp151.3.18.1 libreoffice-l10n-bg-6.4.5.2-lp151.3.18.1 libreoffice-l10n-bn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-bn_IN-6.4.5.2-lp151.3.18.1 libreoffice-l10n-bo-6.4.5.2-lp151.3.18.1 libreoffice-l10n-br-6.4.5.2-lp151.3.18.1 libreoffice-l10n-brx-6.4.5.2-lp151.3.18.1 libreoffice-l10n-bs-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ca-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ca_valencia-6.4.5.2-lp151.3.18.1 libreoffice-l10n-cs-6.4.5.2-lp151.3.18.1 libreoffice-l10n-cy-6.4.5.2-lp151.3.18.1 libreoffice-l10n-da-6.4.5.2-lp151.3.18.1 libreoffice-l10n-de-6.4.5.2-lp151.3.18.1 libreoffice-l10n-dgo-6.4.5.2-lp151.3.18.1 libreoffice-l10n-dsb-6.4.5.2-lp151.3.18.1 libreoffice-l10n-dz-6.4.5.2-lp151.3.18.1 libreoffice-l10n-el-6.4.5.2-lp151.3.18.1 libreoffice-l10n-en-6.4.5.2-lp151.3.18.1 libreoffice-l10n-en_GB-6.4.5.2-lp151.3.18.1 libreoffice-l10n-en_ZA-6.4.5.2-lp151.3.18.1 libreoffice-l10n-eo-6.4.5.2-lp151.3.18.1 libreoffice-l10n-es-6.4.5.2-lp151.3.18.1 libreoffice-l10n-et-6.4.5.2-lp151.3.18.1 libreoffice-l10n-eu-6.4.5.2-lp151.3.18.1 libreoffice-l10n-fa-6.4.5.2-lp151.3.18.1 libreoffice-l10n-fi-6.4.5.2-lp151.3.18.1 libreoffice-l10n-fr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-fy-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ga-6.4.5.2-lp151.3.18.1 libreoffice-l10n-gd-6.4.5.2-lp151.3.18.1 libreoffice-l10n-gl-6.4.5.2-lp151.3.18.1 libreoffice-l10n-gu-6.4.5.2-lp151.3.18.1 libreoffice-l10n-gug-6.4.5.2-lp151.3.18.1 libreoffice-l10n-he-6.4.5.2-lp151.3.18.1 libreoffice-l10n-hi-6.4.5.2-lp151.3.18.1 libreoffice-l10n-hr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-hsb-6.4.5.2-lp151.3.18.1 libreoffice-l10n-hu-6.4.5.2-lp151.3.18.1 libreoffice-l10n-id-6.4.5.2-lp151.3.18.1 libreoffice-l10n-is-6.4.5.2-lp151.3.18.1 libreoffice-l10n-it-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ja-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ka-6.4.5.2-lp151.3.18.1 libreoffice-l10n-kab-6.4.5.2-lp151.3.18.1 libreoffice-l10n-kk-6.4.5.2-lp151.3.18.1 libreoffice-l10n-km-6.4.5.2-lp151.3.18.1 libreoffice-l10n-kmr_Latn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-kn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ko-6.4.5.2-lp151.3.18.1 libreoffice-l10n-kok-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ks-6.4.5.2-lp151.3.18.1 libreoffice-l10n-lb-6.4.5.2-lp151.3.18.1 libreoffice-l10n-lo-6.4.5.2-lp151.3.18.1 libreoffice-l10n-lt-6.4.5.2-lp151.3.18.1 libreoffice-l10n-lv-6.4.5.2-lp151.3.18.1 libreoffice-l10n-mai-6.4.5.2-lp151.3.18.1 libreoffice-l10n-mk-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ml-6.4.5.2-lp151.3.18.1 libreoffice-l10n-mn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-mni-6.4.5.2-lp151.3.18.1 libreoffice-l10n-mr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-my-6.4.5.2-lp151.3.18.1 libreoffice-l10n-nb-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ne-6.4.5.2-lp151.3.18.1 libreoffice-l10n-nl-6.4.5.2-lp151.3.18.1 libreoffice-l10n-nn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-nr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-nso-6.4.5.2-lp151.3.18.1 libreoffice-l10n-oc-6.4.5.2-lp151.3.18.1 libreoffice-l10n-om-6.4.5.2-lp151.3.18.1 libreoffice-l10n-or-6.4.5.2-lp151.3.18.1 libreoffice-l10n-pa-6.4.5.2-lp151.3.18.1 libreoffice-l10n-pl-6.4.5.2-lp151.3.18.1 libreoffice-l10n-pt_BR-6.4.5.2-lp151.3.18.1 libreoffice-l10n-pt_PT-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ro-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ru-6.4.5.2-lp151.3.18.1 libreoffice-l10n-rw-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sa_IN-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sat-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sd-6.4.5.2-lp151.3.18.1 libreoffice-l10n-si-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sid-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sk-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sl-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sq-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ss-6.4.5.2-lp151.3.18.1 libreoffice-l10n-st-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sv-6.4.5.2-lp151.3.18.1 libreoffice-l10n-sw_TZ-6.4.5.2-lp151.3.18.1 libreoffice-l10n-szl-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ta-6.4.5.2-lp151.3.18.1 libreoffice-l10n-te-6.4.5.2-lp151.3.18.1 libreoffice-l10n-tg-6.4.5.2-lp151.3.18.1 libreoffice-l10n-th-6.4.5.2-lp151.3.18.1 libreoffice-l10n-tn-6.4.5.2-lp151.3.18.1 libreoffice-l10n-tr-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ts-6.4.5.2-lp151.3.18.1 libreoffice-l10n-tt-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ug-6.4.5.2-lp151.3.18.1 libreoffice-l10n-uk-6.4.5.2-lp151.3.18.1 libreoffice-l10n-uz-6.4.5.2-lp151.3.18.1 libreoffice-l10n-ve-6.4.5.2-lp151.3.18.1 libreoffice-l10n-vec-6.4.5.2-lp151.3.18.1 libreoffice-l10n-vi-6.4.5.2-lp151.3.18.1 libreoffice-l10n-xh-6.4.5.2-lp151.3.18.1 libreoffice-l10n-zh_CN-6.4.5.2-lp151.3.18.1 libreoffice-l10n-zh_TW-6.4.5.2-lp151.3.18.1 libreoffice-l10n-zu-6.4.5.2-lp151.3.18.1 - openSUSE Leap 15.1 (x86_64): libreoffice-6.4.5.2-lp151.3.18.1 libreoffice-base-6.4.5.2-lp151.3.18.1 libreoffice-base-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-base-drivers-firebird-6.4.5.2-lp151.3.18.1 libreoffice-base-drivers-firebird-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-base-drivers-postgresql-6.4.5.2-lp151.3.18.1 libreoffice-base-drivers-postgresql-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-calc-6.4.5.2-lp151.3.18.1 libreoffice-calc-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-calc-extensions-6.4.5.2-lp151.3.18.1 libreoffice-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-debugsource-6.4.5.2-lp151.3.18.1 libreoffice-draw-6.4.5.2-lp151.3.18.1 libreoffice-draw-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-filters-optional-6.4.5.2-lp151.3.18.1 libreoffice-gnome-6.4.5.2-lp151.3.18.1 libreoffice-gnome-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-gtk3-6.4.5.2-lp151.3.18.1 libreoffice-gtk3-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-impress-6.4.5.2-lp151.3.18.1 libreoffice-impress-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-librelogo-6.4.5.2-lp151.3.18.1 libreoffice-mailmerge-6.4.5.2-lp151.3.18.1 libreoffice-math-6.4.5.2-lp151.3.18.1 libreoffice-math-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-officebean-6.4.5.2-lp151.3.18.1 libreoffice-officebean-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-pyuno-6.4.5.2-lp151.3.18.1 libreoffice-pyuno-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-qt5-6.4.5.2-lp151.3.18.1 libreoffice-qt5-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-sdk-6.4.5.2-lp151.3.18.1 libreoffice-sdk-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-sdk-doc-6.4.5.2-lp151.3.18.1 libreoffice-writer-6.4.5.2-lp151.3.18.1 libreoffice-writer-debuginfo-6.4.5.2-lp151.3.18.1 libreoffice-writer-extensions-6.4.5.2-lp151.3.18.1 libreofficekit-6.4.5.2-lp151.3.18.1 libreofficekit-devel-6.4.5.2-lp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-12802.html https://www.suse.com/security/cve/CVE-2020-12803.html https://bugzilla.suse.com/1062631 https://bugzilla.suse.com/1146025 https://bugzilla.suse.com/1157627 https://bugzilla.suse.com/1165849 https://bugzilla.suse.com/1172053 https://bugzilla.suse.com/1172189 https://bugzilla.suse.com/1172795 https://bugzilla.suse.com/1172796 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1214-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1214-1 Rating: important References: #1174497 #1175044 #1175085 Cross-References: CVE-2020-6542 CVE-2020-6543 CVE-2020-6544 CVE-2020-6545 CVE-2020-6546 CVE-2020-6547 CVE-2020-6548 CVE-2020-6549 CVE-2020-6550 CVE-2020-6551 CVE-2020-6552 CVE-2020-6553 CVE-2020-6554 CVE-2020-6555 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 (boo#1175085) * CVE-2020-6542: Use after free in ANGLE * CVE-2020-6543: Use after free in task scheduling * CVE-2020-6544: Use after free in media * CVE-2020-6545: Use after free in audio * CVE-2020-6546: Inappropriate implementation in installer * CVE-2020-6547: Incorrect security UI in media * CVE-2020-6548: Heap buffer overflow in Skia * CVE-2020-6549: Use after free in media * CVE-2020-6550: Use after free in IndexedDB * CVE-2020-6551: Use after free in WebXR * CVE-2020-6552: Use after free in Blink * CVE-2020-6553: Use after free in offline mode * CVE-2020-6554: Use after free in extensions * CVE-2020-6555: Out of bounds read in WebGL * Various fixes from internal audits, fuzzing and other initiatives - Disable wayland everywhere as it breaks headless and middle mouse copy everywhere: boo#1174497 boo#1175044 This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1214=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-84.0.4147.125-bp151.3.100.1 chromium-84.0.4147.125-bp151.3.100.1 References: https://www.suse.com/security/cve/CVE-2020-6542.html https://www.suse.com/security/cve/CVE-2020-6543.html https://www.suse.com/security/cve/CVE-2020-6544.html https://www.suse.com/security/cve/CVE-2020-6545.html https://www.suse.com/security/cve/CVE-2020-6546.html https://www.suse.com/security/cve/CVE-2020-6547.html https://www.suse.com/security/cve/CVE-2020-6548.html https://www.suse.com/security/cve/CVE-2020-6549.html https://www.suse.com/security/cve/CVE-2020-6550.html https://www.suse.com/security/cve/CVE-2020-6551.html https://www.suse.com/security/cve/CVE-2020-6552.html https://www.suse.com/security/cve/CVE-2020-6553.html https://www.suse.com/security/cve/CVE-2020-6554.html https://www.suse.com/security/cve/CVE-2020-6555.html https://bugzilla.suse.com/1174497 https://bugzilla.suse.com/1175044 https://bugzilla.suse.com/1175085 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1210-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1210-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1210=1 Package List: - openSUSE Leap 15.1 (x86_64): hylafax+-7.0.3-lp151.4.6.1 hylafax+-client-7.0.3-lp151.4.6.1 hylafax+-client-debuginfo-7.0.3-lp151.4.6.1 hylafax+-debuginfo-7.0.3-lp151.4.6.1 hylafax+-debugsource-7.0.3-lp151.4.6.1 libfaxutil7_0_3-7.0.3-lp151.4.6.1 libfaxutil7_0_3-debuginfo-7.0.3-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1209-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1209-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1209=1 Package List: - openSUSE Leap 15.2 (x86_64): hylafax+-7.0.3-lp152.3.6.1 hylafax+-client-7.0.3-lp152.3.6.1 hylafax+-client-debuginfo-7.0.3-lp152.3.6.1 hylafax+-debuginfo-7.0.3-lp152.3.6.1 hylafax+-debugsource-7.0.3-lp152.3.6.1 libfaxutil7_0_3-7.0.3-lp152.3.6.1 libfaxutil7_0_3-debuginfo-7.0.3-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1199-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1199-1 Rating: moderate References: #1169063 #1171899 #1173606 Cross-References: CVE-2020-11647 CVE-2020-13164 CVE-2020-15466 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Wireshark to 3.2.5: * CVE-2020-15466: GVCP dissector infinite loop (bsc#1173606) * CVE-2020-13164: NFS dissector crash (bsc#1171899) * CVE-2020-11647: The BACapp dissector could crash (bsc#1169063) - Further features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-3.2.5.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1199=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark13-3.2.5-lp152.2.3.1 libwireshark13-debuginfo-3.2.5-lp152.2.3.1 libwiretap10-3.2.5-lp152.2.3.1 libwiretap10-debuginfo-3.2.5-lp152.2.3.1 libwsutil11-3.2.5-lp152.2.3.1 libwsutil11-debuginfo-3.2.5-lp152.2.3.1 wireshark-3.2.5-lp152.2.3.1 wireshark-debuginfo-3.2.5-lp152.2.3.1 wireshark-debugsource-3.2.5-lp152.2.3.1 wireshark-devel-3.2.5-lp152.2.3.1 wireshark-ui-qt-3.2.5-lp152.2.3.1 wireshark-ui-qt-debuginfo-3.2.5-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11647.html https://www.suse.com/security/cve/CVE-2020-13164.html https://www.suse.com/security/cve/CVE-2020-15466.html https://bugzilla.suse.com/1169063 https://bugzilla.suse.com/1171899 https://bugzilla.suse.com/1173606 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1200-1: important: Security update for xrdp
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for xrdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1200-1 Rating: important References: #1173580 Cross-References: CVE-2020-4044 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xrdp fixes the following issues: - Update to version 0.9.13.1 + This is a security fix release that includes fixes for the following local buffer overflow vulnerability (bsc#1173580): CVE-2020-4044 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1200=1 Package List: - openSUSE Leap 15.2 (x86_64): libpainter0-0.9.13.1-lp152.3.3.1 libpainter0-debuginfo-0.9.13.1-lp152.3.3.1 librfxencode0-0.9.13.1-lp152.3.3.1 librfxencode0-debuginfo-0.9.13.1-lp152.3.3.1 xrdp-0.9.13.1-lp152.3.3.1 xrdp-debuginfo-0.9.13.1-lp152.3.3.1 xrdp-debugsource-0.9.13.1-lp152.3.3.1 xrdp-devel-0.9.13.1-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-4044.html https://bugzilla.suse.com/1173580 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0