February 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0159-1: moderate: Recommended update for aaa_base
by maintenance＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0159-1 Rating: moderate References: #1157794 #1160970 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for aaa_base fixes the following issues: - Improves the way how the Java path is created to fix an issue with sapjvm. (bsc#1157794) - Drop 'dev.cdrom.autoclose' = 0 from sysctl config. (bsc#1160970) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-159=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp151.5.18.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp151.5.18.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp151.5.18.1 aaa_base-extras-84.87+git20180409.04c9dae-lp151.5.18.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp151.5.18.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp151.5.18.1 References: https://bugzilla.suse.com/1157794 https://bugzilla.suse.com/1160970

1 0

openSUSE-SU-2020:0160-1: important: Security update for python-reportlab
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for python-reportlab ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0160-1 Rating: important References: #1154370 Cross-References: CVE-2019-17626 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-reportlab fixes the following issues: - CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-160=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-reportlab-debuginfo-3.4.0-lp151.3.3.1 python-reportlab-debugsource-3.4.0-lp151.3.3.1 python2-reportlab-3.4.0-lp151.3.3.1 python2-reportlab-debuginfo-3.4.0-lp151.3.3.1 python3-reportlab-3.4.0-lp151.3.3.1 python3-reportlab-debuginfo-3.4.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-17626.html https://bugzilla.suse.com/1154370

1 0

openSUSE-SU-2020:0162-1: moderate: Security update for ucl
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for ucl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0162-1 Rating: moderate References: #1094138 Cross-References: CVE-2018-11243 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucl fixes the following issues: CVE-2018-11243: Fix remotely triggerable DoS via double free (boo#1094138) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-162=1 Package List: - openSUSE Leap 15.1 (x86_64): libucl1-1.03-lp151.3.3.1 libucl1-debuginfo-1.03-lp151.3.3.1 ucl-debugsource-1.03-lp151.3.3.1 ucl-devel-1.03-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11243.html https://bugzilla.suse.com/1094138

1 0

openSUSE-RU-2020:0157-1: moderate: Recommended update for gajim, python-nbxmpp
by maintenance＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Recommended Update: Recommended update for gajim, python-nbxmpp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0157-1 Rating: moderate References: #1116161 #1123247 #1159017 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gajim, python-nbxmpp fixes the following issues: gajim: - Always use the system certificates and remove the provided one, fix build with newer ca-certificates bundle (boo#1159017) - Require python3-nbxmpp greater than 0.6.9 (boo#1123247) - Add Requires for python3-precis-i18n (boo#1116161). - Update to 1.1.3: New: * Add a mobile phone indicator to the chat window * Rework HTTPUpload dialog * Add a "paste as quote" option to the message input Bug fixes: * #8822 Fix memory leak when using spell checker * #9514 Fix jingle filetransfers not working in some circumstances * #9573 Dont leak DNS query when connecting over proxy * #9578 Determine Windows version more reliably * #9622 Fix an error while quitting Gajim * #9633 Fix an error while sending a file * #9637 Restore window size correctly on wayland * #9660 GPG Agent setting is ignored * #9645 Make zeroconf IPV6 compatible * Improve dark theme colors * Fix access to GnuPG keys * Use UUID4 item ids for pubsub posts * Dont send invalid show values * Various smaller improvements - Update to 1.1.2: * #9518 Windows: Pressing "^" yields "^^" * #9522 Windows: Switching keyboard layouts leads to a crash * #9525 Windows/Mac: Links are not clickable in the About dialog * #9535 Jingle Audio: Update codecs * #9537 DiscoveryWindow: Fix bookmarking a group chat * DBus: Correctly raise NewMessage signal * Clicking on tray notifications does not open the chat - Update to 1.1.1: * 8362 DBus: Incorrect unread message count * 9427 Placeholder not cleared if pasting text into message input * 9444 Determine the delay timestamp correctly when using mam:1 * 9453 Fix opening links inside the group chat subject (MacOS/Windows) * 9465 Allow the full range of possible nicknames in group chats * 9067 Gajim crashes when receiving xhtml messages * 9096 Error when clicking on a subscription notification * 9446 Chatstate error in MUC conversation * 9471 Conversation Textview: Error on key press * 9472 Handle presences without from attr correctly * 9473 Error when creating a new group chat * 9491 Identify group chat subject changes correctly * 9496 Error on MUC roster selection change * Determine soundplayer correctly on unix systems * In some circumstances plugins could not be deleted * Show correct contact status on tabs * Dont answer group chat receipt requests * Fix receipts for private messages * Pressing the back button in the Accounts window leads to an error * Better handle not available keyring backends * Dont show incorrect contact on private messages * Join group chat menu is disabled when there are no bookmarks * Error on start chat menu action * Error when opening sign-in/out notification * Copying text does not work with different keyboard layouts - Update to 1.1.0: * Remove support for XEP-0091 * 8968 Windows: Gajim loads DLLs from wrong location * 9322 Error when adding contact * 9357 Acquire sleep inhibtor correctly after sleep * 9385 Ignore invalid bookmarks * 9386 Discovery: Browsing nodes without identity * 9393 Error when parsing invalid timestamps * 9398 Error on jingle file transfer - For complete ChangeLog from 1.0.99 and 1.0.99.1 please see installed ChaneLog file python-nbxmpp: - Update to 0.6.10: * Add support for domain based name in features for GSSAPI * Fix usage of BOSH * Fix Jingle hash namespace - Update to version 0.6.9 (boo#1123247): * Always bind after SM failed Fixes #64 * Dont try and guess system language - Update to version 0.6.8 (changes since 0.6.6): * Raise default TLS version to 1.2. * Remove DIGEST-MD5 from the default auth mechs. * Add STANZA RECEIVED Event (some servers send more than one stanza in one packet). * Add alternative locations to load TLS certs from. * Reset SM counter after receiving <enabled>. * Issue event when SM resume fails. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-157=1 Package List: - openSUSE Leap 15.1 (noarch): gajim-1.1.3-lp151.3.3.1 gajim-lang-1.1.3-lp151.3.3.1 python2-nbxmpp-0.6.10-lp151.2.4.1 python2-nbxmpp-doc-0.6.10-lp151.2.4.1 python3-nbxmpp-0.6.10-lp151.2.4.1 python3-nbxmpp-doc-0.6.10-lp151.2.4.1 References: https://bugzilla.suse.com/1116161 https://bugzilla.suse.com/1123247 https://bugzilla.suse.com/1159017

1 0

openSUSE-SU-2020:0156-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 04 Feb '20

04 Feb '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0156-1 Rating: moderate References: #1154328 Cross-References: CVE-2019-3693 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. (boo#1154328) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-156=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mailman-2.1.29-bp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-3693.html https://bugzilla.suse.com/1154328

1 0

openSUSE-RU-2020:0155-1: moderate: Recommended update for cloud-init
by maintenance＠opensuse.org 02 Feb '20

02 Feb '20

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0155-1 Rating: moderate References: #1155376 #1156139 #1157894 #1161132 #1161133 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for cloud-init fixes the following issues: - Fixed an issue where it was not possible to add SSH keys and thus it was not possible to log into the system (bsc#1161132, bsc#1161133) - Fixes an issue where the IPv6 interface variable was not correctly set in an ifcfg file (bsc#1156139) - The route's destination network will now be written in CIDR notation. This provides support for correctly recording IPv6 routes (bsc#1155376) - Many smaller fixes came with this package as well. For a full list of all changes, refer to the rpm's changes file. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-155=1 Package List: - openSUSE Leap 15.1 (x86_64): cloud-init-19.4-lp151.2.12.1 cloud-init-config-suse-19.4-lp151.2.12.1 cloud-init-doc-19.4-lp151.2.12.1 References: https://bugzilla.suse.com/1155376 https://bugzilla.suse.com/1156139 https://bugzilla.suse.com/1157894 https://bugzilla.suse.com/1161132 https://bugzilla.suse.com/1161133

1 0

openSUSE-RU-2020:0154-1: Recommended update for rpmlint-mini
by maintenance＠opensuse.org 02 Feb '20

02 Feb '20

openSUSE Recommended Update: Recommended update for rpmlint-mini ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0154-1 Rating: low References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rpmlint-mini provides a rebuild for rpmlint to include polkit-default-privs. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-154=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): rpmlint-mini-1.10-lp151.5.8.1 rpmlint-mini-debuginfo-1.10-lp151.5.8.1 rpmlint-mini-debugsource-1.10-lp151.5.8.1 References:

1 0

openSUSE-RU-2020:0153-1: moderate: Recommended update for dnf-plugins-core
by maintenance＠opensuse.org 01 Feb '20

01 Feb '20

openSUSE Recommended Update: Recommended update for dnf-plugins-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0153-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for dnf-plugins-core fixes the following issues: - Deconflict with zypper-needs-restarting on SLE to unblock PackageHub updates This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-153=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): dnf-plugins-core-4.0.7-bp151.4.4.5 dnf-plugins-core-lang-4.0.7-bp151.4.4.5 dnf-utils-4.0.7-bp151.4.4.5 python3-dnf-plugin-leaves-4.0.7-bp151.4.4.5 python3-dnf-plugin-local-4.0.7-bp151.4.4.5 python3-dnf-plugin-show-leaves-4.0.7-bp151.4.4.5 python3-dnf-plugin-versionlock-4.0.7-bp151.4.4.5 python3-dnf-plugins-core-4.0.7-bp151.4.4.5 References:

1 0

openSUSE-RU-2020:0152-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 01 Feb '20

01 Feb '20

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0152-1 Rating: moderate References: #1158946 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2 fixes the following issues: - Yast2::ServiceWidget: By default, propose to reload or restart the service when it is active (bsc#1158946). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-152=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): yast2-4.1.75-lp151.2.16.1 yast2-logs-4.1.75-lp151.2.16.1 References: https://bugzilla.suse.com/1158946

1 0