January 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0146-1: important: Security update for apt-cacher-ng
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for apt-cacher-ng ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0146-1 Rating: important References: #1157703 #1157706 Cross-References: CVE-2019-18899 CVE-2020-5202 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apt-cacher-ng fixes the following issues: - CVE-2019-18899: Fixed a symlink attack which could allow to overwrite arbitrary data (boo#1157703). - CVE-2020-5202: Fixed an information leak if a local user won a race condition to listen to localhost:3142 (boo#1157706). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-146=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): apt-cacher-ng-3.1-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-18899.html https://www.suse.com/security/cve/CVE-2020-5202.html https://bugzilla.suse.com/1157703 https://bugzilla.suse.com/1157706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0145-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0145-1 Rating: moderate References: #1159852 #1160321 #1160364 Cross-References: CVE-2019-19950 CVE-2019-19951 CVE-2019-19953 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2019-19950: Fixed a use-after-free in ThrowException and ThrowLoggedException of magick/error.c. (boo#1159852) - CVE-2019-19951: Fixed a heap-based buffer overflow in ImportRLEPixels() (boo#1160321). - CVE-2019-19953: Fixed a heap-based buffer overflow in EncodeImage() (boo#1160364). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-145=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): GraphicsMagick-1.3.29-bp151.5.9.1 GraphicsMagick-devel-1.3.29-bp151.5.9.1 libGraphicsMagick++-Q16-12-1.3.29-bp151.5.9.1 libGraphicsMagick++-devel-1.3.29-bp151.5.9.1 libGraphicsMagick-Q16-3-1.3.29-bp151.5.9.1 libGraphicsMagick3-config-1.3.29-bp151.5.9.1 libGraphicsMagickWand-Q16-2-1.3.29-bp151.5.9.1 perl-GraphicsMagick-1.3.29-bp151.5.9.1 References: https://www.suse.com/security/cve/CVE-2019-19950.html https://www.suse.com/security/cve/CVE-2019-19951.html https://www.suse.com/security/cve/CVE-2019-19953.html https://bugzilla.suse.com/1159852 https://bugzilla.suse.com/1160321 https://bugzilla.suse.com/1160364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0140-1: important: Security update for sarg
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for sarg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0140-1 Rating: important References: #1156643 Cross-References: CVE-2019-18932 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sarg fixes the following issues: - CVE-2019-18932: Fixed insecure usage of /tmp/sarg which potentially allowed privilege escalation or denial of service (boo#1156643). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-140=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sarg-2.3.10-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-18932.html https://bugzilla.suse.com/1156643 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0139-1: moderate: Security update for rubygem-excon
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for rubygem-excon ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0139-1 Rating: moderate References: #1159342 Cross-References: CVE-2019-16779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-excon fixes the following issues: CVE-2019-16779 (boo#1159342): Fix a race condition around persistent connections, where a connection, which was interrupted, would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-139=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1 ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1 ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16779.html https://bugzilla.suse.com/1159342 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0142-1: moderate: Security update for shadowsocks-libev
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0142-1 Rating: moderate References: #1158251 #1158365 Cross-References: CVE-2019-5163 CVE-2019-5164 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for shadowsocks-libev fixes the following issues: - Update version to 3.3.3 * Refine the handling of suspicious connections. * Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163) * Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164) * Refine the handling of fragment request. * Fix a high CPU bug introduced in 3.3.0. (#2449) * Enlarge the socket buffer size to 16KB. * Fix the empty list bug in ss-manager. * Fix the IPv6 address parser. * Fix a bug of port parser. * Fix a crash with MinGW. * Refine SIP003 plugin interface. * Remove connection timeout from all clients. * Fix the alignment bug again. * Fix a bug on 32-bit arch. * Add TCP fast open support to ss-tunnel by @PantherJohn. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-142=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libshadowsocks-libev2-3.3.3-bp151.5.3.1 shadowsocks-libev-3.3.3-bp151.5.3.1 shadowsocks-libev-devel-3.3.3-bp151.5.3.1 - openSUSE Backports SLE-15-SP1 (noarch): shadowsocks-libev-doc-3.3.3-bp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-5163.html https://www.suse.com/security/cve/CVE-2019-5164.html https://bugzilla.suse.com/1158251 https://bugzilla.suse.com/1158365 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0147-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0147-1 Rating: important References: #1160968 Cross-References: CVE-2020-2583 CVE-2020-2590 CVE-2020-2593 CVE-2020-2601 CVE-2020-2604 CVE-2020-2654 CVE-2020-2659 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968): - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2020-2590: Improve Kerberos interop capabilities - CVE-2020-2593: Normalize normalization for all - CVE-2020-2601: Better Ticket Granting Services - CVE-2020-2604: Better serial filter handling - CVE-2020-2659: Enhance datagram socket support - CVE-2020-2654: Improve Object Identifier Processing This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-147=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-accessibility-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-debugsource-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-demo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-devel-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-headless-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-src-1.8.0.242-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.242-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-2583.html https://www.suse.com/security/cve/CVE-2020-2590.html https://www.suse.com/security/cve/CVE-2020-2593.html https://www.suse.com/security/cve/CVE-2020-2601.html https://www.suse.com/security/cve/CVE-2020-2604.html https://www.suse.com/security/cve/CVE-2020-2654.html https://www.suse.com/security/cve/CVE-2020-2659.html https://bugzilla.suse.com/1160968 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0148-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0148-1 Rating: moderate References: #1154328 Cross-References: CVE-2019-3693 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mailman fixes the following issues: - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. (boo#1154328) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-148=1 Package List: - openSUSE Leap 15.1 (x86_64): mailman-2.1.29-lp151.3.3.1 mailman-debuginfo-2.1.29-lp151.3.3.1 mailman-debugsource-2.1.29-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3693.html https://bugzilla.suse.com/1154328 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0137-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0137-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-137=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp151.6.6.1 mumble-server-1.2.19-bp151.6.6.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): mumble-64bit-1.2.19-bp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0124-1: important: Security update for apt-cacher-ng
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for apt-cacher-ng ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0124-1 Rating: important References: #1157703 #1157706 Cross-References: CVE-2019-18899 CVE-2020-5202 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apt-cacher-ng fixes the following issues: - CVE-2019-18899: Fixed a symlink attack which could allow to overwrite arbitrary data (boo#1157703). - CVE-2020-5202: Fixed an information leak if a local user won a race condition to listen to localhost:3142 (boo#1157706). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-124=1 Package List: - openSUSE Leap 15.1 (x86_64): apt-cacher-ng-3.1-lp151.3.3.1 apt-cacher-ng-debuginfo-3.1-lp151.3.3.1 apt-cacher-ng-debugsource-3.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-18899.html https://www.suse.com/security/cve/CVE-2020-5202.html https://bugzilla.suse.com/1157703 https://bugzilla.suse.com/1157706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0123-1: important: Security update for git
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0123-1 Rating: important References: #1082023 #1149792 #1158785 #1158787 #1158788 #1158789 #1158790 #1158791 #1158792 #1158793 #1158795 Cross-References: CVE-2019-1348 CVE-2019-1349 CVE-2019-1350 CVE-2019-1351 CVE-2019-1352 CVE-2019-1353 CVE-2019-1354 CVE-2019-1387 CVE-2019-19604 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for git fixes the following issues: Security issues fixed: - CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice (bsc#1158787). - CVE-2019-19604: Fixed a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that (bsc#1158795). - CVE-2019-1387: Fixed recursive clones that are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones (bsc#1158793). - CVE-2019-1354: Fixed issue on Windows that refuses to write tracked files with filenames that contain backslashes (bsc#1158792). - CVE-2019-1353: Fixed issue when run in the Windows Subsystem for Linux while accessing a working directory on a regular Windows drive, none of the NTFS protections were active (bsc#1158791). - CVE-2019-1352: Fixed issue on Windows was unaware of NTFS Alternate Data Streams (bsc#1158790). - CVE-2019-1351: Fixed issue on Windows mistakes drive letters outside of the US-English alphabet as relative paths (bsc#1158789). - CVE-2019-1350: Fixed incorrect quoting of command-line arguments allowed remote code execution during a recursive clone in conjunction with SSH URLs (bsc#1158788). - CVE-2019-1348: Fixed the --export-marks option of fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths (bsc#1158785). - Fixes an issue where git send-email failed to authenticate with SMTP server (bsc#1082023) Bug fixes: - Add zlib dependency, which used to be provided by openssl-devel, so that package can compile successfully after openssl upgrade to 1.1.1. (bsc#1149792). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-123=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): git-2.16.4-lp151.4.3.1 git-arch-2.16.4-lp151.4.3.1 git-core-2.16.4-lp151.4.3.1 git-core-debuginfo-2.16.4-lp151.4.3.1 git-credential-gnome-keyring-2.16.4-lp151.4.3.1 git-credential-gnome-keyring-debuginfo-2.16.4-lp151.4.3.1 git-credential-libsecret-2.16.4-lp151.4.3.1 git-credential-libsecret-debuginfo-2.16.4-lp151.4.3.1 git-cvs-2.16.4-lp151.4.3.1 git-daemon-2.16.4-lp151.4.3.1 git-daemon-debuginfo-2.16.4-lp151.4.3.1 git-debuginfo-2.16.4-lp151.4.3.1 git-debugsource-2.16.4-lp151.4.3.1 git-email-2.16.4-lp151.4.3.1 git-gui-2.16.4-lp151.4.3.1 git-p4-2.16.4-lp151.4.3.1 git-svn-2.16.4-lp151.4.3.1 git-svn-debuginfo-2.16.4-lp151.4.3.1 git-web-2.16.4-lp151.4.3.1 gitk-2.16.4-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): git-doc-2.16.4-lp151.4.3.1 perl-Authen-SASL-2.16-lp151.3.3.1 perl-Net-SMTP-SSL-1.04-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-1348.html https://www.suse.com/security/cve/CVE-2019-1349.html https://www.suse.com/security/cve/CVE-2019-1350.html https://www.suse.com/security/cve/CVE-2019-1351.html https://www.suse.com/security/cve/CVE-2019-1352.html https://www.suse.com/security/cve/CVE-2019-1353.html https://www.suse.com/security/cve/CVE-2019-1354.html https://www.suse.com/security/cve/CVE-2019-1387.html https://www.suse.com/security/cve/CVE-2019-19604.html https://bugzilla.suse.com/1082023 https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1158785 https://bugzilla.suse.com/1158787 https://bugzilla.suse.com/1158788 https://bugzilla.suse.com/1158789 https://bugzilla.suse.com/1158790 https://bugzilla.suse.com/1158791 https://bugzilla.suse.com/1158792 https://bugzilla.suse.com/1158793 https://bugzilla.suse.com/1158795 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0