December 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:2357-1: important: Security update for gimp
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2357-1 Rating: important References: #1073628 #1178726 Cross-References: CVE-2017-17787 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gimp fixes the following issues: Security issue fixed: - CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628). Non-security issue fixed: - Fixed a software crash while importing a _PostScript_ file (bsc#1178726). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2357=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gimp-2.8.22-lp151.5.6.1 gimp-debuginfo-2.8.22-lp151.5.6.1 gimp-debugsource-2.8.22-lp151.5.6.1 gimp-devel-2.8.22-lp151.5.6.1 gimp-devel-debuginfo-2.8.22-lp151.5.6.1 gimp-plugin-aa-2.8.22-lp151.5.6.1 gimp-plugin-aa-debuginfo-2.8.22-lp151.5.6.1 gimp-plugins-python-2.8.22-lp151.5.6.1 gimp-plugins-python-debuginfo-2.8.22-lp151.5.6.1 libgimp-2_0-0-2.8.22-lp151.5.6.1 libgimp-2_0-0-debuginfo-2.8.22-lp151.5.6.1 libgimpui-2_0-0-2.8.22-lp151.5.6.1 libgimpui-2_0-0-debuginfo-2.8.22-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): gimp-lang-2.8.22-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libgimp-2_0-0-32bit-2.8.22-lp151.5.6.1 libgimp-2_0-0-32bit-debuginfo-2.8.22-lp151.5.6.1 libgimpui-2_0-0-32bit-2.8.22-lp151.5.6.1 libgimpui-2_0-0-32bit-debuginfo-2.8.22-lp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2017-17787.html https://bugzilla.suse.com/1073628 https://bugzilla.suse.com/1178726

1 0

openSUSE-RU-2020:2356-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2356-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.8.5: * Bugfixes: + Fix return type of SmartPlaylistQueryWizardPlugin::type(). + Fix comparison between QChar and integer to use QChar::unicode(). + Fix return type of qHash with Qt 6 to use size_t instead of uint. + Fix tag edit dialog save process sometimes stuck. + Fix repeat and shuffle buttons greyed out when a dynamic playlist is open. + Fix CUE parser handling of values with empty quotes. + Fix broken year and disc collection groupings with CUE songs. + Fix HTML escaping showing up in OSD notifications when using custom text. * Enhancements: + Add Swedish translation. + Made Qt X11Extras and WinExtras modules optional. + Save and restore geometry in edit tag dialog. + Add command line option to play a playlist based on name. + Change double-click behaviour in cover manager to open fullsize cover. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2356=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): strawberry-0.8.5-bp152.2.16.1 References:

1 0

openSUSE-RU-2020:2355-1: moderate: Recommended update for kmail
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for kmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2355-1 Rating: moderate References: #1176666 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmail fixes the following issues: - Fixed a possible crash of the archivemail agent after changing its settings (boo#1176666, kde#426596, kde#425786, kde#424232) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2355=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): kmail-20.04.2-bp152.2.4.1 kmail-application-icons-20.04.2-bp152.2.4.1 ktnef-20.04.2-bp152.2.4.1 - openSUSE Backports SLE-15-SP2 (noarch): kmail-lang-20.04.2-bp152.2.4.1 References: https://bugzilla.suse.com/1176666

1 0

openSUSE-RU-2020:2354-1: moderate: Recommended update for polkit-default-privs
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for polkit-default-privs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2354-1 Rating: moderate References: #1179126 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for polkit-default-privs fixes the following issues: * libvirt: allow the active session to create read-only connections (bsc#1179126) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2354=1 Package List: - openSUSE Leap 15.2 (noarch): polkit-default-privs-13.2+20201209.bd89a77-lp152.2.3.1 polkit-whitelisting-13.2+20201209.bd89a77-lp152.2.3.1 References: https://bugzilla.suse.com/1179126

1 0

openSUSE-RU-2020:2352-1: moderate: Recommended update for cacti
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2352-1 Rating: moderate References: #1175314 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cacti fixes the following issues: - fix httpd startup errors due to mismatched configuration directives (boo#1175314) cacti 1.2.16: * When generating a report, the Cascade to Branches function does not as expected * When viewing graphs, automatic refresh so not always work as expected * Realtime graph pop up counter bug * Undefined variable errors may occur when creating a new datasource * The cli-based installer does not exit with a non-zero exit code when error occurs * When an export is complete, sometimes the progress bar remains * When enabling many devices, a threshold can be reached causing a slowdown in the process * When performing actions against Devices, replicated device information could sometimes be lost * When using API to rename a tree node, backtrace may be incorrectly shown * When searching, valid pages can sometimes be shown as empty by ddb4github * When exporting data from graphs, not all data was properly included * Graph Templates filter is not updated after new graph created by ddb4github * Username and password on the login page is not visible in Classic theme * Improve wording of concurrent process and thread settings * Location filter should remove blank entries by ddb4github * When syncing data collectors, a reindex event may be triggered unnecessarily * Automation Networks allows discovery of invalid IP addresses * When changing permissions of the current user, they don't take effect immediately * When reindexing a device, an incorrect page was sometimes displayed * When repairing database, audit_database.php does not add missing columns * Log page should not be empty if no log info exists * During upgrade, there are times when realms can be duplicated leading to SQL errors * When using ping.php, UDP response times are not interpreted properly by hypnotoad * Improve warning you get when attempting to view a log file you don't have access to * When replicating files, scripts are not marked as executable * When creating plugin tables, collation is not set properly * Update c3.js to version 0.7.20 * Update Chart.js to version 2.9.4 * Update phpseclib to version 2.0.29 * Update PHPMailer to version 6.1.8 * Use LSB shebang notation for cli scripts * Add support for cactid daemon based launcher * Add ability to hide the Graph Drilldown icons by datatecuk * Add hooks for plugins to show custom Graph Source and custom Template URL (List View) cacti 1.2.15, fixing the following bugs: * When editing Maximum OIDs Per Get Request, blank value can cause errors * Boost may run more often than it should * Recache Event Loop can cause Interface Graphs to show gaps * When searching Graph Tree's, non matching devices remain visible * Page validation errors may occur when opening real time graphs * External Links do not always open if they are still open from previous usage * Cultural changes to various word usage * Replicate deleted device status instead of poller sync * Description field allows more characters entered than is stored * When installing or upgrading, LDAP functions may not always be included properly * Unable to remove discovered device * When installing or upgrading, PHP recommendations may not always return a valid value * Graph Templates has duplicate SQL delete statement * When syncing to remote poller, missing function errors may occur * When removing devices from remote pollers, devices may reappear without details * When removing devices, array errors may sometimes be recorded * Variable injection does not always work as expected * Editing Data Queries with multiple data templates can give errors about Suggested values * Progress bar does not provide enough visual information during long page loads * Some themes do not allow for a way to see which user is currently signed in * When viewing tables, allow users to force all columns to be visible * Column sizing is being lost between pages refreshes * When viewing input methods table, no ID is shown to help identify which method is being viewed * Filters do not always respect using keyboard to initiate searching * When exporting a data query, an invalid column name error can sometimes be shown * When checking if a view is allowed, having no session can result in errors * When removing devices via the CLI, undefined variable errors may be seen * Real Time Graphs may cause invalid index errors * On newer versions of MySQL/MariaDB, 'system' keyword can cause issues * Plugin setup can generate errors when reading options via system function * Plugin version numbers can be unexpectedly truncated * When PHP Session is set to autostart, an error can be reported as Cacti attempts to start it * When removing multiple items, selection process does not always work * When exporting colors, the indicator is not always removed upon completion * Unable to pass tree and leaf ID to 'graph_button' hook * When performing maintenance, various errors may sometimes be seen * When Guest User setting is active, current user is not always properly set * When installing Cacti, minor errors in text can be seen * Numbers are not always formatted properly when there are no decimal places * When viewing Real Time Graphs, an undefined index error may be recorded * Minor memory leaks and refresh issues when zooming on graphs * Real Time Graphs may sometimes fail due to folder permissions * Navigation can sometimes occur unexpectedly due to background timers * Trees management screen not reporting correct number of trees * Tree sequences can sometimes skip numbers during resorting * Guest user selection should not allow setting the currently logged in user * Links in Table Headers do not show clearly when in modern theme * Under some cases tree logic leads to undefined index errors * Cacti Data Debug can show errors if the Data Source is damaged or has been removed * When importing a data query, an invalid column name error can sometimes be shown * When using shift functions on graphs, negative values are not allowed * Correct issue when file is unreadable reporting no file was specified * Orphaned Plugins have no option to be removed * Update MySQL recommendations for Character Set and Colation * Correct sorting of IP addresses to be numeric not alpha by JamesTilt * Saving a device should not always repopulate the poller cache Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2352=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2352=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-2352=1 Package List: - openSUSE Leap 15.2 (noarch): cacti-1.2.16-lp152.2.9.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.16-lp151.3.18.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.16-17.1 References: https://bugzilla.suse.com/1175314

1 0

openSUSE-RU-2020:2353-1: moderate: Recommended update for kexec-tools
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for kexec-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2353-1 Rating: moderate References: #1174508 #1176606 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for kexec-tools fixes the following issues: - Xen 4.7 introduced _soft-reset_ for HVM domUs. (bsc#1176606, bsc#1174508) This host feature removes the requirement to _un-ballon_ the `domU` prior `kexec`. With Xen 4.13 _cpuid faulting_ became the default, which affects the approach used before to detect the _domU_ type. As a result, invoking kexec in _dom0_ failed. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2353=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kexec-tools-2.0.20-lp152.4.3.1 kexec-tools-debuginfo-2.0.20-lp152.4.3.1 kexec-tools-debugsource-2.0.20-lp152.4.3.1 References: https://bugzilla.suse.com/1174508 https://bugzilla.suse.com/1176606

1 0

openSUSE-RU-2020:2352-1: moderate: Recommended update for cacti
by maintenance＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Recommended Update: Recommended update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2352-1 Rating: moderate References: #1175314 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cacti fixes the following issues: - fix httpd startup errors due to mismatched configuration directives (boo#1175314) cacti 1.2.16: * When generating a report, the Cascade to Branches function does not as expected * When viewing graphs, automatic refresh so not always work as expected * Realtime graph pop up counter bug * Undefined variable errors may occur when creating a new datasource * The cli-based installer does not exit with a non-zero exit code when error occurs * When an export is complete, sometimes the progress bar remains * When enabling many devices, a threshold can be reached causing a slowdown in the process * When performing actions against Devices, replicated device information could sometimes be lost * When using API to rename a tree node, backtrace may be incorrectly shown * When searching, valid pages can sometimes be shown as empty by ddb4github * When exporting data from graphs, not all data was properly included * Graph Templates filter is not updated after new graph created by ddb4github * Username and password on the login page is not visible in Classic theme * Improve wording of concurrent process and thread settings * Location filter should remove blank entries by ddb4github * When syncing data collectors, a reindex event may be triggered unnecessarily * Automation Networks allows discovery of invalid IP addresses * When changing permissions of the current user, they don't take effect immediately * When reindexing a device, an incorrect page was sometimes displayed * When repairing database, audit_database.php does not add missing columns * Log page should not be empty if no log info exists * During upgrade, there are times when realms can be duplicated leading to SQL errors * When using ping.php, UDP response times are not interpreted properly by hypnotoad * Improve warning you get when attempting to view a log file you don't have access to * When replicating files, scripts are not marked as executable * When creating plugin tables, collation is not set properly * Update c3.js to version 0.7.20 * Update Chart.js to version 2.9.4 * Update phpseclib to version 2.0.29 * Update PHPMailer to version 6.1.8 * Use LSB shebang notation for cli scripts * Add support for cactid daemon based launcher * Add ability to hide the Graph Drilldown icons by datatecuk * Add hooks for plugins to show custom Graph Source and custom Template URL (List View) cacti 1.2.15, fixing the following bugs: * When editing Maximum OIDs Per Get Request, blank value can cause errors * Boost may run more often than it should * Recache Event Loop can cause Interface Graphs to show gaps * When searching Graph Tree's, non matching devices remain visible * Page validation errors may occur when opening real time graphs * External Links do not always open if they are still open from previous usage * Cultural changes to various word usage * Replicate deleted device status instead of poller sync * Description field allows more characters entered than is stored * When installing or upgrading, LDAP functions may not always be included properly * Unable to remove discovered device * When installing or upgrading, PHP recommendations may not always return a valid value * Graph Templates has duplicate SQL delete statement * When syncing to remote poller, missing function errors may occur * When removing devices from remote pollers, devices may reappear without details * When removing devices, array errors may sometimes be recorded * Variable injection does not always work as expected * Editing Data Queries with multiple data templates can give errors about Suggested values * Progress bar does not provide enough visual information during long page loads * Some themes do not allow for a way to see which user is currently signed in * When viewing tables, allow users to force all columns to be visible * Column sizing is being lost between pages refreshes * When viewing input methods table, no ID is shown to help identify which method is being viewed * Filters do not always respect using keyboard to initiate searching * When exporting a data query, an invalid column name error can sometimes be shown * When checking if a view is allowed, having no session can result in errors * When removing devices via the CLI, undefined variable errors may be seen * Real Time Graphs may cause invalid index errors * On newer versions of MySQL/MariaDB, 'system' keyword can cause issues * Plugin setup can generate errors when reading options via system function * Plugin version numbers can be unexpectedly truncated * When PHP Session is set to autostart, an error can be reported as Cacti attempts to start it * When removing multiple items, selection process does not always work * When exporting colors, the indicator is not always removed upon completion * Unable to pass tree and leaf ID to 'graph_button' hook * When performing maintenance, various errors may sometimes be seen * When Guest User setting is active, current user is not always properly set * When installing Cacti, minor errors in text can be seen * Numbers are not always formatted properly when there are no decimal places * When viewing Real Time Graphs, an undefined index error may be recorded * Minor memory leaks and refresh issues when zooming on graphs * Real Time Graphs may sometimes fail due to folder permissions * Navigation can sometimes occur unexpectedly due to background timers * Trees management screen not reporting correct number of trees * Tree sequences can sometimes skip numbers during resorting * Guest user selection should not allow setting the currently logged in user * Links in Table Headers do not show clearly when in modern theme * Under some cases tree logic leads to undefined index errors * Cacti Data Debug can show errors if the Data Source is damaged or has been removed * When importing a data query, an invalid column name error can sometimes be shown * When using shift functions on graphs, negative values are not allowed * Correct issue when file is unreadable reporting no file was specified * Orphaned Plugins have no option to be removed * Update MySQL recommendations for Character Set and Colation * Correct sorting of IP addresses to be numeric not alpha by JamesTilt * Saving a device should not always repopulate the poller cache Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2352=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2352=1 Package List: - openSUSE Leap 15.2 (noarch): cacti-1.2.16-lp152.2.9.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.16-lp151.3.18.1 References: https://bugzilla.suse.com/1175314

1 0

openSUSE-SU-2020:2350-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2350-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for flac fixes the following issues: - CVE-2020-0487: Fixed a memory leak (bsc#1180112). - CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2350=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): flac-1.3.2-lp152.5.3.1 flac-debuginfo-1.3.2-lp152.5.3.1 flac-debugsource-1.3.2-lp152.5.3.1 flac-devel-1.3.2-lp152.5.3.1 libFLAC++6-1.3.2-lp152.5.3.1 libFLAC++6-debuginfo-1.3.2-lp152.5.3.1 libFLAC8-1.3.2-lp152.5.3.1 libFLAC8-debuginfo-1.3.2-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): flac-devel-32bit-1.3.2-lp152.5.3.1 libFLAC++6-32bit-1.3.2-lp152.5.3.1 libFLAC++6-32bit-debuginfo-1.3.2-lp152.5.3.1 libFLAC8-32bit-1.3.2-lp152.5.3.1 libFLAC8-32bit-debuginfo-1.3.2-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): flac-doc-1.3.2-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-0487.html https://www.suse.com/security/cve/CVE-2020-0499.html https://bugzilla.suse.com/1180099 https://bugzilla.suse.com/1180112

1 0

openSUSE-SU-2020:2351-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2351-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879). - CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879). - CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2351=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.8.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.8.1 openexr-2.2.1-lp152.7.8.1 openexr-debuginfo-2.2.1-lp152.7.8.1 openexr-debugsource-2.2.1-lp152.7.8.1 openexr-devel-2.2.1-lp152.7.8.1 openexr-doc-2.2.1-lp152.7.8.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.8.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.8.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.8.1 References: https://www.suse.com/security/cve/CVE-2020-16587.html https://www.suse.com/security/cve/CVE-2020-16588.html https://www.suse.com/security/cve/CVE-2020-16589.html https://bugzilla.suse.com/1179879

1 0

openSUSE-SU-2020:2349-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2349-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879). - CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879). - CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2349=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.15.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.15.1 openexr-2.2.1-lp151.4.15.1 openexr-debuginfo-2.2.1-lp151.4.15.1 openexr-debugsource-2.2.1-lp151.4.15.1 openexr-devel-2.2.1-lp151.4.15.1 openexr-doc-2.2.1-lp151.4.15.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.15.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.15.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.15.1 References: https://www.suse.com/security/cve/CVE-2020-16587.html https://www.suse.com/security/cve/CVE-2020-16588.html https://www.suse.com/security/cve/CVE-2020-16589.html https://bugzilla.suse.com/1179879

1 0