openSUSE Security Update: Security update for apt-cacher-ng
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0146-1
Rating: important
References: #1157703 #1157706
Cross-References: CVE-2019-18899 CVE-2020-5202
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for apt-cacher-ng fixes the following issues:
- CVE-2019-18899: Fixed a symlink attack which could allow to overwrite
arbitrary data (boo#1157703).
- CVE-2020-5202: Fixed an information leak if a local user won a race
condition to listen to localhost:3142 (boo#1157706).
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-146=1
Package List:
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):
apt-cacher-ng-3.1-bp151.4.3.1
References:
https://www.suse.com/security/cve/CVE-2019-18899.htmlhttps://www.suse.com/security/cve/CVE-2020-5202.htmlhttps://bugzilla.suse.com/1157703https://bugzilla.suse.com/1157706
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for GraphicsMagick
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0145-1
Rating: moderate
References: #1159852 #1160321 #1160364
Cross-References: CVE-2019-19950 CVE-2019-19951 CVE-2019-19953
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for GraphicsMagick fixes the following issues:
- CVE-2019-19950: Fixed a use-after-free in ThrowException and
ThrowLoggedException of magick/error.c. (boo#1159852)
- CVE-2019-19951: Fixed a heap-based buffer overflow in ImportRLEPixels()
(boo#1160321).
- CVE-2019-19953: Fixed a heap-based buffer overflow in EncodeImage()
(boo#1160364).
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-145=1
Package List:
- openSUSE Backports SLE-15-SP1 (x86_64):
GraphicsMagick-1.3.29-bp151.5.9.1
GraphicsMagick-devel-1.3.29-bp151.5.9.1
libGraphicsMagick++-Q16-12-1.3.29-bp151.5.9.1
libGraphicsMagick++-devel-1.3.29-bp151.5.9.1
libGraphicsMagick-Q16-3-1.3.29-bp151.5.9.1
libGraphicsMagick3-config-1.3.29-bp151.5.9.1
libGraphicsMagickWand-Q16-2-1.3.29-bp151.5.9.1
perl-GraphicsMagick-1.3.29-bp151.5.9.1
References:
https://www.suse.com/security/cve/CVE-2019-19950.htmlhttps://www.suse.com/security/cve/CVE-2019-19951.htmlhttps://www.suse.com/security/cve/CVE-2019-19953.htmlhttps://bugzilla.suse.com/1159852https://bugzilla.suse.com/1160321https://bugzilla.suse.com/1160364
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for sarg
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0140-1
Rating: important
References: #1156643
Cross-References: CVE-2019-18932
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for sarg fixes the following issues:
- CVE-2019-18932: Fixed insecure usage of /tmp/sarg which potentially
allowed privilege escalation or denial of service (boo#1156643).
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-140=1
Package List:
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):
sarg-2.3.10-bp151.4.3.1
References:
https://www.suse.com/security/cve/CVE-2019-18932.htmlhttps://bugzilla.suse.com/1156643
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for rubygem-excon
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0139-1
Rating: moderate
References: #1159342
Cross-References: CVE-2019-16779
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for rubygem-excon fixes the following issues:
CVE-2019-16779 (boo#1159342): Fix a race condition around persistent
connections, where a connection, which was interrupted, would leave data
on the socket. Subsequent requests would then read this data, returning
content from the previous response.
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-139=1
Package List:
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):
ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1
ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1
ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1
References:
https://www.suse.com/security/cve/CVE-2019-16779.htmlhttps://bugzilla.suse.com/1159342
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for shadowsocks-libev
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0142-1
Rating: moderate
References: #1158251 #1158365
Cross-References: CVE-2019-5163 CVE-2019-5164
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for shadowsocks-libev fixes the following issues:
- Update version to 3.3.3
* Refine the handling of suspicious connections.
* Fix exploitable denial-of-service vulnerability exists in the UDPRelay
functionality (boo#1158251, CVE-2019-5163)
* Fix code execution vulnerability in the ss-manager binary
(boo#1158365, CVE-2019-5164)
* Refine the handling of fragment request.
* Fix a high CPU bug introduced in 3.3.0. (#2449)
* Enlarge the socket buffer size to 16KB.
* Fix the empty list bug in ss-manager.
* Fix the IPv6 address parser.
* Fix a bug of port parser.
* Fix a crash with MinGW.
* Refine SIP003 plugin interface.
* Remove connection timeout from all clients.
* Fix the alignment bug again.
* Fix a bug on 32-bit arch.
* Add TCP fast open support to ss-tunnel by @PantherJohn.
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-142=1
Package List:
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):
libshadowsocks-libev2-3.3.3-bp151.5.3.1
shadowsocks-libev-3.3.3-bp151.5.3.1
shadowsocks-libev-devel-3.3.3-bp151.5.3.1
- openSUSE Backports SLE-15-SP1 (noarch):
shadowsocks-libev-doc-3.3.3-bp151.5.3.1
References:
https://www.suse.com/security/cve/CVE-2019-5163.htmlhttps://www.suse.com/security/cve/CVE-2019-5164.htmlhttps://bugzilla.suse.com/1158251https://bugzilla.suse.com/1158365
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for java-1_8_0-openjdk
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0147-1
Rating: important
References: #1160968
Cross-References: CVE-2020-2583 CVE-2020-2590 CVE-2020-2593
CVE-2020-2601 CVE-2020-2604 CVE-2020-2654
CVE-2020-2659
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that fixes 7 vulnerabilities is now available.
Description:
This update for java-1_8_0-openjdk fixes the following issues:
Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January
2020 CPU, bsc#1160968):
- CVE-2020-2583: Unlink Set of LinkedHashSets
- CVE-2020-2590: Improve Kerberos interop capabilities
- CVE-2020-2593: Normalize normalization for all
- CVE-2020-2601: Better Ticket Granting Services
- CVE-2020-2604: Better serial filter handling
- CVE-2020-2659: Enhance datagram socket support
- CVE-2020-2654: Improve Object Identifier Processing
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2020-147=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
java-1_8_0-openjdk-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-accessibility-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-debuginfo-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-debugsource-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-demo-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-demo-debuginfo-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-devel-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-devel-debuginfo-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-headless-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-headless-debuginfo-1.8.0.242-lp151.2.9.1
java-1_8_0-openjdk-src-1.8.0.242-lp151.2.9.1
- openSUSE Leap 15.1 (noarch):
java-1_8_0-openjdk-javadoc-1.8.0.242-lp151.2.9.1
References:
https://www.suse.com/security/cve/CVE-2020-2583.htmlhttps://www.suse.com/security/cve/CVE-2020-2590.htmlhttps://www.suse.com/security/cve/CVE-2020-2593.htmlhttps://www.suse.com/security/cve/CVE-2020-2601.htmlhttps://www.suse.com/security/cve/CVE-2020-2604.htmlhttps://www.suse.com/security/cve/CVE-2020-2654.htmlhttps://www.suse.com/security/cve/CVE-2020-2659.htmlhttps://bugzilla.suse.com/1160968
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for mailman
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0148-1
Rating: moderate
References: #1154328
Cross-References: CVE-2019-3693
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for mailman fixes the following issues:
- CVE-2019-3693: Fixed a privilege escalation during package install.
Could be exploited by a local users who is members of the the mailman
group. (boo#1154328)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2020-148=1
Package List:
- openSUSE Leap 15.1 (x86_64):
mailman-2.1.29-lp151.3.3.1
mailman-debuginfo-2.1.29-lp151.3.3.1
mailman-debugsource-2.1.29-lp151.3.3.1
References:
https://www.suse.com/security/cve/CVE-2019-3693.htmlhttps://bugzilla.suse.com/1154328
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for mumble
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0137-1
Rating: moderate
References: #1123334
Cross-References: CVE-2018-20743
Affected Products:
openSUSE Backports SLE-15-SP1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for mumble fixes the following issues:
CVE-2018-20743: murmur mishandled multiple concurrent requests that were
persisted in the database, which allowed remote attackers to cause a
denial of service (daemon hang or crash) via a message flood. (boo#1123334)
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP1:
zypper in -t patch openSUSE-2020-137=1
Package List:
- openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):
mumble-1.2.19-bp151.6.6.1
mumble-server-1.2.19-bp151.6.6.1
- openSUSE Backports SLE-15-SP1 (aarch64_ilp32):
mumble-64bit-1.2.19-bp151.6.6.1
References:
https://www.suse.com/security/cve/CVE-2018-20743.htmlhttps://bugzilla.suse.com/1123334
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for apt-cacher-ng
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0124-1
Rating: important
References: #1157703 #1157706
Cross-References: CVE-2019-18899 CVE-2020-5202
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for apt-cacher-ng fixes the following issues:
- CVE-2019-18899: Fixed a symlink attack which could allow to overwrite
arbitrary data (boo#1157703).
- CVE-2020-5202: Fixed an information leak if a local user won a race
condition to listen to localhost:3142 (boo#1157706).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2020-124=1
Package List:
- openSUSE Leap 15.1 (x86_64):
apt-cacher-ng-3.1-lp151.3.3.1
apt-cacher-ng-debuginfo-3.1-lp151.3.3.1
apt-cacher-ng-debugsource-3.1-lp151.3.3.1
References:
https://www.suse.com/security/cve/CVE-2019-18899.htmlhttps://www.suse.com/security/cve/CVE-2020-5202.htmlhttps://bugzilla.suse.com/1157703https://bugzilla.suse.com/1157706
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: Security update for git
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:0123-1
Rating: important
References: #1082023 #1149792 #1158785 #1158787 #1158788
#1158789 #1158790 #1158791 #1158792 #1158793
#1158795
Cross-References: CVE-2019-1348 CVE-2019-1349 CVE-2019-1350
CVE-2019-1351 CVE-2019-1352 CVE-2019-1353
CVE-2019-1354 CVE-2019-1387 CVE-2019-19604
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that solves 9 vulnerabilities and has two fixes
is now available.
Description:
This update for git fixes the following issues:
Security issues fixed:
- CVE-2019-1349: Fixed issue on Windows, when submodules are cloned
recursively, under certain circumstances Git could be fooled into using
the same Git directory twice (bsc#1158787).
- CVE-2019-19604: Fixed a recursive clone followed by a submodule update
could execute code contained within the repository without the user
explicitly having asked for that (bsc#1158795).
- CVE-2019-1387: Fixed recursive clones that are currently affected by a
vulnerability that is caused by too-lax validation of submodule names,
allowing very targeted attacks via remote code execution in recursive
clones (bsc#1158793).
- CVE-2019-1354: Fixed issue on Windows that refuses to write tracked
files with filenames that contain backslashes (bsc#1158792).
- CVE-2019-1353: Fixed issue when run in the Windows Subsystem for Linux
while accessing a working directory on a regular Windows drive, none of
the NTFS protections were active (bsc#1158791).
- CVE-2019-1352: Fixed issue on Windows was unaware of NTFS Alternate Data
Streams (bsc#1158790).
- CVE-2019-1351: Fixed issue on Windows mistakes drive letters outside of
the US-English alphabet as relative paths (bsc#1158789).
- CVE-2019-1350: Fixed incorrect quoting of command-line arguments allowed
remote code execution during a recursive clone in conjunction with SSH
URLs (bsc#1158788).
- CVE-2019-1348: Fixed the --export-marks option of fast-import is exposed
also via the in-stream command feature export-marks=... and it allows
overwriting arbitrary paths (bsc#1158785).
- Fixes an issue where git send-email failed to authenticate with SMTP
server (bsc#1082023)
Bug fixes:
- Add zlib dependency, which used to be provided by openssl-devel, so that
package can compile successfully after openssl upgrade to 1.1.1.
(bsc#1149792).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2020-123=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
git-2.16.4-lp151.4.3.1
git-arch-2.16.4-lp151.4.3.1
git-core-2.16.4-lp151.4.3.1
git-core-debuginfo-2.16.4-lp151.4.3.1
git-credential-gnome-keyring-2.16.4-lp151.4.3.1
git-credential-gnome-keyring-debuginfo-2.16.4-lp151.4.3.1
git-credential-libsecret-2.16.4-lp151.4.3.1
git-credential-libsecret-debuginfo-2.16.4-lp151.4.3.1
git-cvs-2.16.4-lp151.4.3.1
git-daemon-2.16.4-lp151.4.3.1
git-daemon-debuginfo-2.16.4-lp151.4.3.1
git-debuginfo-2.16.4-lp151.4.3.1
git-debugsource-2.16.4-lp151.4.3.1
git-email-2.16.4-lp151.4.3.1
git-gui-2.16.4-lp151.4.3.1
git-p4-2.16.4-lp151.4.3.1
git-svn-2.16.4-lp151.4.3.1
git-svn-debuginfo-2.16.4-lp151.4.3.1
git-web-2.16.4-lp151.4.3.1
gitk-2.16.4-lp151.4.3.1
- openSUSE Leap 15.1 (noarch):
git-doc-2.16.4-lp151.4.3.1
perl-Authen-SASL-2.16-lp151.3.3.1
perl-Net-SMTP-SSL-1.04-lp151.3.3.1
References:
https://www.suse.com/security/cve/CVE-2019-1348.htmlhttps://www.suse.com/security/cve/CVE-2019-1349.htmlhttps://www.suse.com/security/cve/CVE-2019-1350.htmlhttps://www.suse.com/security/cve/CVE-2019-1351.htmlhttps://www.suse.com/security/cve/CVE-2019-1352.htmlhttps://www.suse.com/security/cve/CVE-2019-1353.htmlhttps://www.suse.com/security/cve/CVE-2019-1354.htmlhttps://www.suse.com/security/cve/CVE-2019-1387.htmlhttps://www.suse.com/security/cve/CVE-2019-19604.htmlhttps://bugzilla.suse.com/1082023https://bugzilla.suse.com/1149792https://bugzilla.suse.com/1158785https://bugzilla.suse.com/1158787https://bugzilla.suse.com/1158788https://bugzilla.suse.com/1158789https://bugzilla.suse.com/1158790https://bugzilla.suse.com/1158791https://bugzilla.suse.com/1158792https://bugzilla.suse.com/1158793https://bugzilla.suse.com/1158795
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org