January 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0095-1: moderate: Security update for libredwg
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for libredwg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0095-1 Rating: moderate References: #1129868 #1129869 #1129870 #1129873 #1129874 #1129875 #1129876 #1129878 #1129879 #1129881 #1154080 #1159824 #1159825 #1159826 #1159827 #1159828 #1159831 #1159832 Cross-References: CVE-2019-20009 CVE-2019-20010 CVE-2019-20011 CVE-2019-20012 CVE-2019-20013 CVE-2019-20014 CVE-2019-20015 CVE-2019-9770 CVE-2019-9771 CVE-2019-9772 CVE-2019-9773 CVE-2019-9774 CVE-2019-9775 CVE-2019-9776 CVE-2019-9777 CVE-2019-9778 CVE-2019-9779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has one errata is now available. Description: This update for libredwg fixes the following issues: libredwg was updated to release 0.9.3: * Added the -x,--extnames option to dwglayers for r13-r14 DWGs. * Fixed some leaks: SORTENTSTABLE, PROXY_ENTITY.ownerhandle for r13. * Add DICTIONARY.itemhandles[] for r13 and r14. * Fixed some dwglayers null pointer derefs, and flush its output for each layer. * Added several overflow checks from fuzzing [CVE-2019-20010, boo#1159825], [CVE-2019-20011, boo#1159826], [CVE-2019-20012, boo#1159827], [CVE-2019-20013, boo#1159828], [CVE-2019-20014, boo#1159831], [CVE-2019-20015, boo#1159832] * Disallow illegal SPLINE scenarios [CVE-2019-20009, boo#1159824] Update to release 0.9.1: * Fixed more null pointer dereferences, overflows, hangs and memory leaks for fuzzed (i.e. illegal) DWGs. Update to release 0.9 [boo#1154080]: * Added the DXF importer, using the new dynapi and the r2000 encoder. Only for r2000 DXFs. * Added utf8text conversion functions to the dynapi. * Added 3DSOLID encoder. * Added APIs to find handles for names, searching in tables and dicts. * API breaking changes - see NEWS file in package. * Fixed null pointer dereferences, and memory leaks (except DXF importer) [boo#1129868, CVE-2019-9779] [boo#1129869, CVE-2019-9778] [boo#1129870, CVE-2019-9777] [boo#1129873, CVE-2019-9776] [boo#1129874, CVE-2019-9773] [boo#1129875, CVE-2019-9772] [boo#1129876, CVE-2019-9771] [boo#1129878, CVE-2019-9775] [boo#1129879, CVE-2019-9774] [boo#1129881, CVE-2019-9770] Update to 0.8: * add a new dynamic API, read and write all header and object fields by name * API breaking changes * Fix many errors in DXF output * Fix JSON output * Many more bug fixes to handle specific object types This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-95=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libredwg-devel-0.9.3-bp151.2.3.1 libredwg-tools-0.9.3-bp151.2.3.1 libredwg0-0.9.3-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-20009.html https://www.suse.com/security/cve/CVE-2019-20010.html https://www.suse.com/security/cve/CVE-2019-20011.html https://www.suse.com/security/cve/CVE-2019-20012.html https://www.suse.com/security/cve/CVE-2019-20013.html https://www.suse.com/security/cve/CVE-2019-20014.html https://www.suse.com/security/cve/CVE-2019-20015.html https://www.suse.com/security/cve/CVE-2019-9770.html https://www.suse.com/security/cve/CVE-2019-9771.html https://www.suse.com/security/cve/CVE-2019-9772.html https://www.suse.com/security/cve/CVE-2019-9773.html https://www.suse.com/security/cve/CVE-2019-9774.html https://www.suse.com/security/cve/CVE-2019-9775.html https://www.suse.com/security/cve/CVE-2019-9776.html https://www.suse.com/security/cve/CVE-2019-9777.html https://www.suse.com/security/cve/CVE-2019-9778.html https://www.suse.com/security/cve/CVE-2019-9779.html https://bugzilla.suse.com/1129868 https://bugzilla.suse.com/1129869 https://bugzilla.suse.com/1129870 https://bugzilla.suse.com/1129873 https://bugzilla.suse.com/1129874 https://bugzilla.suse.com/1129875 https://bugzilla.suse.com/1129876 https://bugzilla.suse.com/1129878 https://bugzilla.suse.com/1129879 https://bugzilla.suse.com/1129881 https://bugzilla.suse.com/1154080 https://bugzilla.suse.com/1159824 https://bugzilla.suse.com/1159825 https://bugzilla.suse.com/1159826 https://bugzilla.suse.com/1159827 https://bugzilla.suse.com/1159828 https://bugzilla.suse.com/1159831 https://bugzilla.suse.com/1159832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0093-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0093-1 Rating: important References: #1161252 Cross-References: CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 79.0.3945.130 (boo#1161252): - CVE-2020-6378, CVE-2020-6379: Fixed a use-after-free in speech recognizer - CVE-2020-6380: Fixed an extension message verification error - Various fixes from audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-93=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-93=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-93=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-79.0.3945.130-lp151.2.60.4 chromedriver-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-79.0.3945.130-lp151.2.60.4 chromium-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-debugsource-79.0.3945.130-lp151.2.60.4 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.130-bp151.3.56.3 chromedriver-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-79.0.3945.130-bp151.3.56.3 chromium-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-debugsource-79.0.3945.130-bp151.3.56.3 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-79.0.3945.130-28.1 chromium-79.0.3945.130-28.1 References: https://www.suse.com/security/cve/CVE-2020-6378.html https://www.suse.com/security/cve/CVE-2020-6379.html https://www.suse.com/security/cve/CVE-2020-6380.html https://bugzilla.suse.com/1161252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0094-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0094-1 Rating: important References: #1160305 #1160498 Cross-References: CVE-2019-17015 CVE-2019-17016 CVE-2019-17017 CVE-2019-17021 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.4.1 fixes the following issues: Security issues fixed: - CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement - CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017: Type Confusion in XPCVariant.cpp - CVE-2019-17022: CSS sanitization does not escape HTML tags - CVE-2019-17024: multiple Memory safety bugs fixed Non-security issues fixed: - Various improvements when setting up an account for a Microsoft Exchange server. For example better detection for Office 365 accounts. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-94=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.4.1-lp151.2.22.2 MozillaThunderbird-debuginfo-68.4.1-lp151.2.22.2 MozillaThunderbird-debugsource-68.4.1-lp151.2.22.2 MozillaThunderbird-translations-common-68.4.1-lp151.2.22.2 MozillaThunderbird-translations-other-68.4.1-lp151.2.22.2 References: https://www.suse.com/security/cve/CVE-2019-17015.html https://www.suse.com/security/cve/CVE-2019-17016.html https://www.suse.com/security/cve/CVE-2019-17017.html https://www.suse.com/security/cve/CVE-2019-17021.html https://www.suse.com/security/cve/CVE-2019-17022.html https://www.suse.com/security/cve/CVE-2019-17024.html https://www.suse.com/security/cve/CVE-2019-17026.html https://bugzilla.suse.com/1160305 https://bugzilla.suse.com/1160498 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0093-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0093-1 Rating: important References: #1161252 Cross-References: CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 79.0.3945.130 (boo#1161252): - CVE-2020-6378, CVE-2020-6379: Fixed a use-after-free in speech recognizer - CVE-2020-6380: Fixed an extension message verification error - Various fixes from audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-93=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-93=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-79.0.3945.130-lp151.2.60.4 chromedriver-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-79.0.3945.130-lp151.2.60.4 chromium-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-debugsource-79.0.3945.130-lp151.2.60.4 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.130-bp151.3.56.3 chromedriver-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-79.0.3945.130-bp151.3.56.3 chromium-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-debugsource-79.0.3945.130-bp151.3.56.3 References: https://www.suse.com/security/cve/CVE-2020-6378.html https://www.suse.com/security/cve/CVE-2020-6379.html https://www.suse.com/security/cve/CVE-2020-6380.html https://bugzilla.suse.com/1161252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0089-1: moderate: Security update for fontforge
by opensuse-security＠opensuse.org 21 Jan '20

21 Jan '20

openSUSE Security Update: Security update for fontforge ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0089-1 Rating: moderate References: #1160220 #1160236 Cross-References: CVE-2020-5395 CVE-2020-5496 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for fontforge fixes the following issues: - CVE-2020-5395: Fixed a use-after-free in SFD_GetFontMetaData() (bsc#1160220). - CVE-2020-5496: Fixed a heap-based buffer overflow in Type2NotDefSplines() (bsc#1160236). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-89=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): fontforge-20170731-lp151.4.3.1 fontforge-debuginfo-20170731-lp151.4.3.1 fontforge-debugsource-20170731-lp151.4.3.1 fontforge-devel-20170731-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): fontforge-doc-20170731-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-5395.html https://www.suse.com/security/cve/CVE-2020-5496.html https://bugzilla.suse.com/1160220 https://bugzilla.suse.com/1160236 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0086-1: important: Security update for python3
by opensuse-security＠opensuse.org 21 Jan '20

21 Jan '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0086-1 Rating: important References: #1027282 #1029377 #1029902 #1040164 #1042670 #1070853 #1079761 #1081750 #1083507 #1086001 #1088004 #1088009 #1088573 #1094814 #1107030 #1109663 #1109847 #1120644 #1122191 #1129346 #1130840 #1133452 #1137942 #1138459 #1141853 #1149121 #1149792 #1149955 #1151490 #1153238 #1159035 #1159622 #637176 #658604 #673071 #709442 #743787 #747125 #751718 #754447 #754677 #787526 #809831 #831629 #834601 #871152 #885662 #885882 #917607 #942751 #951166 #983582 #984751 #985177 #985348 #989523 Cross-References: CVE-2011-3389 CVE-2011-4944 CVE-2012-0845 CVE-2012-1150 CVE-2013-1752 CVE-2013-4238 CVE-2014-2667 CVE-2014-4650 CVE-2016-0772 CVE-2016-1000110 CVE-2016-5636 CVE-2016-5699 CVE-2017-18207 CVE-2018-1000802 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-20406 CVE-2018-20852 CVE-2019-10160 CVE-2019-15903 CVE-2019-16056 CVE-2019-16935 CVE-2019-5010 CVE-2019-9636 CVE-2019-9947 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 26 vulnerabilities and has 30 fixes is now available. Description: This update for python3 to version 3.6.10 fixes the following issues: - CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). - CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955). - CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-86=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython3_6m1_0-3.6.10-lp151.6.7.1 libpython3_6m1_0-debuginfo-3.6.10-lp151.6.7.1 python3-3.6.10-lp151.6.7.1 python3-base-3.6.10-lp151.6.7.1 python3-base-debuginfo-3.6.10-lp151.6.7.1 python3-base-debugsource-3.6.10-lp151.6.7.1 python3-curses-3.6.10-lp151.6.7.1 python3-curses-debuginfo-3.6.10-lp151.6.7.1 python3-dbm-3.6.10-lp151.6.7.1 python3-dbm-debuginfo-3.6.10-lp151.6.7.1 python3-debuginfo-3.6.10-lp151.6.7.1 python3-debugsource-3.6.10-lp151.6.7.1 python3-devel-3.6.10-lp151.6.7.1 python3-devel-debuginfo-3.6.10-lp151.6.7.1 python3-idle-3.6.10-lp151.6.7.1 python3-testsuite-3.6.10-lp151.6.7.1 python3-testsuite-debuginfo-3.6.10-lp151.6.7.1 python3-tk-3.6.10-lp151.6.7.1 python3-tk-debuginfo-3.6.10-lp151.6.7.1 python3-tools-3.6.10-lp151.6.7.1 - openSUSE Leap 15.1 (x86_64): libpython3_6m1_0-32bit-3.6.10-lp151.6.7.1 libpython3_6m1_0-32bit-debuginfo-3.6.10-lp151.6.7.1 python3-32bit-3.6.10-lp151.6.7.1 python3-32bit-debuginfo-3.6.10-lp151.6.7.1 python3-base-32bit-3.6.10-lp151.6.7.1 python3-base-32bit-debuginfo-3.6.10-lp151.6.7.1 References: https://www.suse.com/security/cve/CVE-2011-3389.html https://www.suse.com/security/cve/CVE-2011-4944.html https://www.suse.com/security/cve/CVE-2012-0845.html https://www.suse.com/security/cve/CVE-2012-1150.html https://www.suse.com/security/cve/CVE-2013-1752.html https://www.suse.com/security/cve/CVE-2013-4238.html https://www.suse.com/security/cve/CVE-2014-2667.html https://www.suse.com/security/cve/CVE-2014-4650.html https://www.suse.com/security/cve/CVE-2016-0772.html https://www.suse.com/security/cve/CVE-2016-1000110.html https://www.suse.com/security/cve/CVE-2016-5636.html https://www.suse.com/security/cve/CVE-2016-5699.html https://www.suse.com/security/cve/CVE-2017-18207.html https://www.suse.com/security/cve/CVE-2018-1000802.html https://www.suse.com/security/cve/CVE-2018-1060.html https://www.suse.com/security/cve/CVE-2018-1061.html https://www.suse.com/security/cve/CVE-2018-14647.html https://www.suse.com/security/cve/CVE-2018-20406.html https://www.suse.com/security/cve/CVE-2018-20852.html https://www.suse.com/security/cve/CVE-2019-10160.html https://www.suse.com/security/cve/CVE-2019-15903.html https://www.suse.com/security/cve/CVE-2019-16056.html https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-5010.html https://www.suse.com/security/cve/CVE-2019-9636.html https://www.suse.com/security/cve/CVE-2019-9947.html https://bugzilla.suse.com/1027282 https://bugzilla.suse.com/1029377 https://bugzilla.suse.com/1029902 https://bugzilla.suse.com/1040164 https://bugzilla.suse.com/1042670 https://bugzilla.suse.com/1070853 https://bugzilla.suse.com/1079761 https://bugzilla.suse.com/1081750 https://bugzilla.suse.com/1083507 https://bugzilla.suse.com/1086001 https://bugzilla.suse.com/1088004 https://bugzilla.suse.com/1088009 https://bugzilla.suse.com/1088573 https://bugzilla.suse.com/1094814 https://bugzilla.suse.com/1107030 https://bugzilla.suse.com/1109663 https://bugzilla.suse.com/1109847 https://bugzilla.suse.com/1120644 https://bugzilla.suse.com/1122191 https://bugzilla.suse.com/1129346 https://bugzilla.suse.com/1130840 https://bugzilla.suse.com/1133452 https://bugzilla.suse.com/1137942 https://bugzilla.suse.com/1138459 https://bugzilla.suse.com/1141853 https://bugzilla.suse.com/1149121 https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1149955 https://bugzilla.suse.com/1151490 https://bugzilla.suse.com/1153238 https://bugzilla.suse.com/1159035 https://bugzilla.suse.com/1159622 https://bugzilla.suse.com/637176 https://bugzilla.suse.com/658604 https://bugzilla.suse.com/673071 https://bugzilla.suse.com/709442 https://bugzilla.suse.com/743787 https://bugzilla.suse.com/747125 https://bugzilla.suse.com/751718 https://bugzilla.suse.com/754447 https://bugzilla.suse.com/754677 https://bugzilla.suse.com/787526 https://bugzilla.suse.com/809831 https://bugzilla.suse.com/831629 https://bugzilla.suse.com/834601 https://bugzilla.suse.com/871152 https://bugzilla.suse.com/885662 https://bugzilla.suse.com/885882 https://bugzilla.suse.com/917607 https://bugzilla.suse.com/942751 https://bugzilla.suse.com/951166 https://bugzilla.suse.com/983582 https://bugzilla.suse.com/984751 https://bugzilla.suse.com/985177 https://bugzilla.suse.com/985348 https://bugzilla.suse.com/989523 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0087-1: important: Security update for tigervnc
by opensuse-security＠opensuse.org 21 Jan '20

21 Jan '20

openSUSE Security Update: Security update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0087-1 Rating: important References: #1159856 #1159858 #1159860 #1160250 #1160251 Cross-References: CVE-2019-15691 CVE-2019-15692 CVE-2019-15693 CVE-2019-15694 CVE-2019-15695 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for tigervnc fixes the following issues: - CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856). - CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250). - CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858). - CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251). - CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-87=1 Package List: - openSUSE Leap 15.1 (noarch): tigervnc-x11vnc-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-java-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-novnc-1.9.0-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libXvnc-devel-1.9.0-lp151.4.3.1 libXvnc1-1.9.0-lp151.4.3.1 libXvnc1-debuginfo-1.9.0-lp151.4.3.1 tigervnc-1.9.0-lp151.4.3.1 tigervnc-debuginfo-1.9.0-lp151.4.3.1 tigervnc-debugsource-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-debuginfo-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-module-1.9.0-lp151.4.3.1 xorg-x11-Xvnc-module-debuginfo-1.9.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-15691.html https://www.suse.com/security/cve/CVE-2019-15692.html https://www.suse.com/security/cve/CVE-2019-15693.html https://www.suse.com/security/cve/CVE-2019-15694.html https://www.suse.com/security/cve/CVE-2019-15695.html https://bugzilla.suse.com/1159856 https://bugzilla.suse.com/1159858 https://bugzilla.suse.com/1159860 https://bugzilla.suse.com/1160250 https://bugzilla.suse.com/1160251 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0085-1: important: Security update for slurm
by opensuse-security＠opensuse.org 21 Jan '20

21 Jan '20

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0085-1 Rating: important References: #1140709 #1153095 #1153259 #1155784 #1158696 #1159692 Cross-References: CVE-2019-12838 CVE-2019-19727 CVE-2019-19728 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for slurm to version 18.08.9 fixes the following issues: Security issues fixed: - CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692). - CVE-2019-12838: Fixed SchedMD Slurm SQL Injection issue (bnc#1140709). - CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784). Bug fixes: - Fix ownership of /var/spool/slurm on new installations and upgrade (bsc#1158696). - Fix %posttrans macro _res_update to cope with added newline (bsc#1153259). - Move srun from 'slurm' to 'slurm-node': srun is required on the nodes as well so sbatch will work. 'slurm-node' is a requirement when 'slurm' is installed (bsc#1153095). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-85=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.9-lp151.2.6.1 libpmi0-debuginfo-18.08.9-lp151.2.6.1 libslurm33-18.08.9-lp151.2.6.1 libslurm33-debuginfo-18.08.9-lp151.2.6.1 perl-slurm-18.08.9-lp151.2.6.1 perl-slurm-debuginfo-18.08.9-lp151.2.6.1 slurm-18.08.9-lp151.2.6.1 slurm-auth-none-18.08.9-lp151.2.6.1 slurm-auth-none-debuginfo-18.08.9-lp151.2.6.1 slurm-config-18.08.9-lp151.2.6.1 slurm-config-man-18.08.9-lp151.2.6.1 slurm-cray-18.08.9-lp151.2.6.1 slurm-cray-debuginfo-18.08.9-lp151.2.6.1 slurm-debuginfo-18.08.9-lp151.2.6.1 slurm-debugsource-18.08.9-lp151.2.6.1 slurm-devel-18.08.9-lp151.2.6.1 slurm-doc-18.08.9-lp151.2.6.1 slurm-hdf5-18.08.9-lp151.2.6.1 slurm-hdf5-debuginfo-18.08.9-lp151.2.6.1 slurm-lua-18.08.9-lp151.2.6.1 slurm-lua-debuginfo-18.08.9-lp151.2.6.1 slurm-munge-18.08.9-lp151.2.6.1 slurm-munge-debuginfo-18.08.9-lp151.2.6.1 slurm-node-18.08.9-lp151.2.6.1 slurm-node-debuginfo-18.08.9-lp151.2.6.1 slurm-openlava-18.08.9-lp151.2.6.1 slurm-pam_slurm-18.08.9-lp151.2.6.1 slurm-pam_slurm-debuginfo-18.08.9-lp151.2.6.1 slurm-plugins-18.08.9-lp151.2.6.1 slurm-plugins-debuginfo-18.08.9-lp151.2.6.1 slurm-seff-18.08.9-lp151.2.6.1 slurm-sjstat-18.08.9-lp151.2.6.1 slurm-slurmdbd-18.08.9-lp151.2.6.1 slurm-slurmdbd-debuginfo-18.08.9-lp151.2.6.1 slurm-sql-18.08.9-lp151.2.6.1 slurm-sql-debuginfo-18.08.9-lp151.2.6.1 slurm-sview-18.08.9-lp151.2.6.1 slurm-sview-debuginfo-18.08.9-lp151.2.6.1 slurm-torque-18.08.9-lp151.2.6.1 slurm-torque-debuginfo-18.08.9-lp151.2.6.1 slurm-webdoc-18.08.9-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12838.html https://www.suse.com/security/cve/CVE-2019-19727.html https://www.suse.com/security/cve/CVE-2019-19728.html https://bugzilla.suse.com/1140709 https://bugzilla.suse.com/1153095 https://bugzilla.suse.com/1153259 https://bugzilla.suse.com/1155784 https://bugzilla.suse.com/1158696 https://bugzilla.suse.com/1159692 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0084-1: moderate: Security update for Mesa
by opensuse-security＠opensuse.org 21 Jan '20

21 Jan '20

openSUSE Security Update: Security update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0084-1 Rating: moderate References: #1156015 Cross-References: CVE-2019-5068 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Mesa fixes the following issues: Security issue fixed: - CVE-2019-5068: Fixed exploitable shared memory permissions vulnerability (bsc#1156015). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-84=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): Mesa-18.3.2-lp151.23.9.1 Mesa-KHR-devel-18.3.2-lp151.23.9.1 Mesa-debugsource-18.3.2-lp151.23.9.1 Mesa-devel-18.3.2-lp151.23.9.1 Mesa-dri-18.3.2-lp151.23.9.1 Mesa-dri-debuginfo-18.3.2-lp151.23.9.1 Mesa-dri-devel-18.3.2-lp151.23.9.1 Mesa-dri-nouveau-18.3.2-lp151.23.9.1 Mesa-dri-nouveau-debuginfo-18.3.2-lp151.23.9.1 Mesa-drivers-debugsource-18.3.2-lp151.23.9.1 Mesa-gallium-18.3.2-lp151.23.9.1 Mesa-gallium-debuginfo-18.3.2-lp151.23.9.1 Mesa-libEGL-devel-18.3.2-lp151.23.9.1 Mesa-libEGL1-18.3.2-lp151.23.9.1 Mesa-libEGL1-debuginfo-18.3.2-lp151.23.9.1 Mesa-libGL-devel-18.3.2-lp151.23.9.1 Mesa-libGL1-18.3.2-lp151.23.9.1 Mesa-libGL1-debuginfo-18.3.2-lp151.23.9.1 Mesa-libGLESv1_CM-devel-18.3.2-lp151.23.9.1 Mesa-libGLESv1_CM1-18.3.2-lp151.23.9.1 Mesa-libGLESv2-2-18.3.2-lp151.23.9.1 Mesa-libGLESv2-devel-18.3.2-lp151.23.9.1 Mesa-libGLESv3-devel-18.3.2-lp151.23.9.1 Mesa-libOpenCL-18.3.2-lp151.23.9.1 Mesa-libOpenCL-debuginfo-18.3.2-lp151.23.9.1 Mesa-libVulkan-devel-18.3.2-lp151.23.9.1 Mesa-libd3d-18.3.2-lp151.23.9.1 Mesa-libd3d-debuginfo-18.3.2-lp151.23.9.1 Mesa-libd3d-devel-18.3.2-lp151.23.9.1 Mesa-libglapi-devel-18.3.2-lp151.23.9.1 Mesa-libglapi0-18.3.2-lp151.23.9.1 Mesa-libglapi0-debuginfo-18.3.2-lp151.23.9.1 Mesa-libva-18.3.2-lp151.23.9.1 Mesa-libva-debuginfo-18.3.2-lp151.23.9.1 libOSMesa-devel-18.3.2-lp151.23.9.1 libOSMesa8-18.3.2-lp151.23.9.1 libOSMesa8-debuginfo-18.3.2-lp151.23.9.1 libXvMC_nouveau-18.3.2-lp151.23.9.1 libXvMC_nouveau-debuginfo-18.3.2-lp151.23.9.1 libXvMC_r600-18.3.2-lp151.23.9.1 libXvMC_r600-debuginfo-18.3.2-lp151.23.9.1 libgbm-devel-18.3.2-lp151.23.9.1 libgbm1-18.3.2-lp151.23.9.1 libgbm1-debuginfo-18.3.2-lp151.23.9.1 libvdpau_nouveau-18.3.2-lp151.23.9.1 libvdpau_nouveau-debuginfo-18.3.2-lp151.23.9.1 libvdpau_r300-18.3.2-lp151.23.9.1 libvdpau_r300-debuginfo-18.3.2-lp151.23.9.1 libvdpau_r600-18.3.2-lp151.23.9.1 libvdpau_r600-debuginfo-18.3.2-lp151.23.9.1 libvdpau_radeonsi-18.3.2-lp151.23.9.1 libvdpau_radeonsi-debuginfo-18.3.2-lp151.23.9.1 libvulkan_intel-18.3.2-lp151.23.9.1 libvulkan_intel-debuginfo-18.3.2-lp151.23.9.1 libvulkan_radeon-18.3.2-lp151.23.9.1 libvulkan_radeon-debuginfo-18.3.2-lp151.23.9.1 libxatracker-devel-1.0.0-lp151.23.9.1 libxatracker2-1.0.0-lp151.23.9.1 libxatracker2-debuginfo-1.0.0-lp151.23.9.1 - openSUSE Leap 15.1 (x86_64): Mesa-32bit-18.3.2-lp151.23.9.1 Mesa-dri-32bit-18.3.2-lp151.23.9.1 Mesa-dri-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-dri-nouveau-32bit-18.3.2-lp151.23.9.1 Mesa-dri-nouveau-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-gallium-32bit-18.3.2-lp151.23.9.1 Mesa-gallium-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-libEGL1-32bit-18.3.2-lp151.23.9.1 Mesa-libEGL1-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-libGL1-32bit-18.3.2-lp151.23.9.1 Mesa-libGL1-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-libd3d-32bit-18.3.2-lp151.23.9.1 Mesa-libd3d-32bit-debuginfo-18.3.2-lp151.23.9.1 Mesa-libd3d-devel-32bit-18.3.2-lp151.23.9.1 Mesa-libglapi-devel-32bit-18.3.2-lp151.23.9.1 Mesa-libglapi0-32bit-18.3.2-lp151.23.9.1 Mesa-libglapi0-32bit-debuginfo-18.3.2-lp151.23.9.1 libOSMesa-devel-32bit-18.3.2-lp151.23.9.1 libOSMesa8-32bit-18.3.2-lp151.23.9.1 libOSMesa8-32bit-debuginfo-18.3.2-lp151.23.9.1 libXvMC_nouveau-32bit-18.3.2-lp151.23.9.1 libXvMC_nouveau-32bit-debuginfo-18.3.2-lp151.23.9.1 libXvMC_r600-32bit-18.3.2-lp151.23.9.1 libXvMC_r600-32bit-debuginfo-18.3.2-lp151.23.9.1 libgbm-devel-32bit-18.3.2-lp151.23.9.1 libgbm1-32bit-18.3.2-lp151.23.9.1 libgbm1-32bit-debuginfo-18.3.2-lp151.23.9.1 libvdpau_nouveau-32bit-18.3.2-lp151.23.9.1 libvdpau_nouveau-32bit-debuginfo-18.3.2-lp151.23.9.1 libvdpau_r300-32bit-18.3.2-lp151.23.9.1 libvdpau_r300-32bit-debuginfo-18.3.2-lp151.23.9.1 libvdpau_r600-32bit-18.3.2-lp151.23.9.1 libvdpau_r600-32bit-debuginfo-18.3.2-lp151.23.9.1 libvdpau_radeonsi-32bit-18.3.2-lp151.23.9.1 libvdpau_radeonsi-32bit-debuginfo-18.3.2-lp151.23.9.1 libvulkan_intel-32bit-18.3.2-lp151.23.9.1 libvulkan_intel-32bit-debuginfo-18.3.2-lp151.23.9.1 libvulkan_radeon-32bit-18.3.2-lp151.23.9.1 libvulkan_radeon-32bit-debuginfo-18.3.2-lp151.23.9.1 References: https://www.suse.com/security/cve/CVE-2019-5068.html https://bugzilla.suse.com/1156015 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0080-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 20 Jan '20

20 Jan '20

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0080-1 Rating: moderate References: #1159922 #1159923 #1159924 #1159927 Cross-References: CVE-2019-11045 CVE-2019-11046 CVE-2019-11047 CVE-2019-11050 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php7 fixes the following issues: - CVE-2019-11045: Fixed an issue with improper input validation in the filename handling of the DirectoryIterator class (bsc#1159923). - CVE-2019-11046: Fixed an information leak in bc_shift_addsub() (bsc#1159924). - CVE-2019-11047, CVE-2019-11050: Fixed multiple information leaks in exif_read_data() (bsc#1159922, bsc#1159927). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-80=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-mod_php7-7.2.5-lp151.6.19.2 apache2-mod_php7-debuginfo-7.2.5-lp151.6.19.2 php7-7.2.5-lp151.6.19.2 php7-bcmath-7.2.5-lp151.6.19.2 php7-bcmath-debuginfo-7.2.5-lp151.6.19.2 php7-bz2-7.2.5-lp151.6.19.2 php7-bz2-debuginfo-7.2.5-lp151.6.19.2 php7-calendar-7.2.5-lp151.6.19.2 php7-calendar-debuginfo-7.2.5-lp151.6.19.2 php7-ctype-7.2.5-lp151.6.19.2 php7-ctype-debuginfo-7.2.5-lp151.6.19.2 php7-curl-7.2.5-lp151.6.19.2 php7-curl-debuginfo-7.2.5-lp151.6.19.2 php7-dba-7.2.5-lp151.6.19.2 php7-dba-debuginfo-7.2.5-lp151.6.19.2 php7-debuginfo-7.2.5-lp151.6.19.2 php7-debugsource-7.2.5-lp151.6.19.2 php7-devel-7.2.5-lp151.6.19.2 php7-dom-7.2.5-lp151.6.19.2 php7-dom-debuginfo-7.2.5-lp151.6.19.2 php7-embed-7.2.5-lp151.6.19.2 php7-embed-debuginfo-7.2.5-lp151.6.19.2 php7-enchant-7.2.5-lp151.6.19.2 php7-enchant-debuginfo-7.2.5-lp151.6.19.2 php7-exif-7.2.5-lp151.6.19.2 php7-exif-debuginfo-7.2.5-lp151.6.19.2 php7-fastcgi-7.2.5-lp151.6.19.2 php7-fastcgi-debuginfo-7.2.5-lp151.6.19.2 php7-fileinfo-7.2.5-lp151.6.19.2 php7-fileinfo-debuginfo-7.2.5-lp151.6.19.2 php7-firebird-7.2.5-lp151.6.19.2 php7-firebird-debuginfo-7.2.5-lp151.6.19.2 php7-fpm-7.2.5-lp151.6.19.2 php7-fpm-debuginfo-7.2.5-lp151.6.19.2 php7-ftp-7.2.5-lp151.6.19.2 php7-ftp-debuginfo-7.2.5-lp151.6.19.2 php7-gd-7.2.5-lp151.6.19.2 php7-gd-debuginfo-7.2.5-lp151.6.19.2 php7-gettext-7.2.5-lp151.6.19.2 php7-gettext-debuginfo-7.2.5-lp151.6.19.2 php7-gmp-7.2.5-lp151.6.19.2 php7-gmp-debuginfo-7.2.5-lp151.6.19.2 php7-iconv-7.2.5-lp151.6.19.2 php7-iconv-debuginfo-7.2.5-lp151.6.19.2 php7-intl-7.2.5-lp151.6.19.2 php7-intl-debuginfo-7.2.5-lp151.6.19.2 php7-json-7.2.5-lp151.6.19.2 php7-json-debuginfo-7.2.5-lp151.6.19.2 php7-ldap-7.2.5-lp151.6.19.2 php7-ldap-debuginfo-7.2.5-lp151.6.19.2 php7-mbstring-7.2.5-lp151.6.19.2 php7-mbstring-debuginfo-7.2.5-lp151.6.19.2 php7-mysql-7.2.5-lp151.6.19.2 php7-mysql-debuginfo-7.2.5-lp151.6.19.2 php7-odbc-7.2.5-lp151.6.19.2 php7-odbc-debuginfo-7.2.5-lp151.6.19.2 php7-opcache-7.2.5-lp151.6.19.2 php7-opcache-debuginfo-7.2.5-lp151.6.19.2 php7-openssl-7.2.5-lp151.6.19.2 php7-openssl-debuginfo-7.2.5-lp151.6.19.2 php7-pcntl-7.2.5-lp151.6.19.2 php7-pcntl-debuginfo-7.2.5-lp151.6.19.2 php7-pdo-7.2.5-lp151.6.19.2 php7-pdo-debuginfo-7.2.5-lp151.6.19.2 php7-pgsql-7.2.5-lp151.6.19.2 php7-pgsql-debuginfo-7.2.5-lp151.6.19.2 php7-phar-7.2.5-lp151.6.19.2 php7-phar-debuginfo-7.2.5-lp151.6.19.2 php7-posix-7.2.5-lp151.6.19.2 php7-posix-debuginfo-7.2.5-lp151.6.19.2 php7-readline-7.2.5-lp151.6.19.2 php7-readline-debuginfo-7.2.5-lp151.6.19.2 php7-shmop-7.2.5-lp151.6.19.2 php7-shmop-debuginfo-7.2.5-lp151.6.19.2 php7-snmp-7.2.5-lp151.6.19.2 php7-snmp-debuginfo-7.2.5-lp151.6.19.2 php7-soap-7.2.5-lp151.6.19.2 php7-soap-debuginfo-7.2.5-lp151.6.19.2 php7-sockets-7.2.5-lp151.6.19.2 php7-sockets-debuginfo-7.2.5-lp151.6.19.2 php7-sodium-7.2.5-lp151.6.19.2 php7-sodium-debuginfo-7.2.5-lp151.6.19.2 php7-sqlite-7.2.5-lp151.6.19.2 php7-sqlite-debuginfo-7.2.5-lp151.6.19.2 php7-sysvmsg-7.2.5-lp151.6.19.2 php7-sysvmsg-debuginfo-7.2.5-lp151.6.19.2 php7-sysvsem-7.2.5-lp151.6.19.2 php7-sysvsem-debuginfo-7.2.5-lp151.6.19.2 php7-sysvshm-7.2.5-lp151.6.19.2 php7-sysvshm-debuginfo-7.2.5-lp151.6.19.2 php7-test-7.2.5-lp151.6.19.2 php7-tidy-7.2.5-lp151.6.19.2 php7-tidy-debuginfo-7.2.5-lp151.6.19.2 php7-tokenizer-7.2.5-lp151.6.19.2 php7-tokenizer-debuginfo-7.2.5-lp151.6.19.2 php7-wddx-7.2.5-lp151.6.19.2 php7-wddx-debuginfo-7.2.5-lp151.6.19.2 php7-xmlreader-7.2.5-lp151.6.19.2 php7-xmlreader-debuginfo-7.2.5-lp151.6.19.2 php7-xmlrpc-7.2.5-lp151.6.19.2 php7-xmlrpc-debuginfo-7.2.5-lp151.6.19.2 php7-xmlwriter-7.2.5-lp151.6.19.2 php7-xmlwriter-debuginfo-7.2.5-lp151.6.19.2 php7-xsl-7.2.5-lp151.6.19.2 php7-xsl-debuginfo-7.2.5-lp151.6.19.2 php7-zip-7.2.5-lp151.6.19.2 php7-zip-debuginfo-7.2.5-lp151.6.19.2 php7-zlib-7.2.5-lp151.6.19.2 php7-zlib-debuginfo-7.2.5-lp151.6.19.2 - openSUSE Leap 15.1 (noarch): php7-pear-7.2.5-lp151.6.19.2 php7-pear-Archive_Tar-7.2.5-lp151.6.19.2 References: https://www.suse.com/security/cve/CVE-2019-11045.html https://www.suse.com/security/cve/CVE-2019-11046.html https://www.suse.com/security/cve/CVE-2019-11047.html https://www.suse.com/security/cve/CVE-2019-11050.html https://bugzilla.suse.com/1159922 https://bugzilla.suse.com/1159923 https://bugzilla.suse.com/1159924 https://bugzilla.suse.com/1159927 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0