January 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0079-1: moderate: Security update for glusterfs
by opensuse-security＠opensuse.org 20 Jan '20

20 Jan '20

openSUSE Security Update: Security update for glusterfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0079-1 Rating: moderate References: #1090084 #1105776 #1107018 #1107019 #1107020 #1107021 #1107022 #1107023 #1107024 #1107025 #1107026 #1107027 #1107028 #1107029 Cross-References: CVE-2018-1088 CVE-2018-10904 CVE-2018-10907 CVE-2018-10911 CVE-2018-10913 CVE-2018-10914 CVE-2018-10923 CVE-2018-10924 CVE-2018-10926 CVE-2018-10927 CVE-2018-10928 CVE-2018-10929 CVE-2018-10930 CVE-2018-1112 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for glusterfs fixes the following issues: glusterfs was update to release 3.12.15: * Fixed a number of bugs and security issues: - CVE-2018-1088, CVE-2018-1112 [boo#1090084], CVE-2018-10904 [boo#1107018], CVE-2018-10907 [boo#1107019], CVE-2018-10911 [boo#1107020], CVE-2018-10913 [boo#1107021], CVE-2018-10914 [boo#1107022], CVE-2018-10923 [boo#1107023], CVE-2018-10924 [boo#1107024], CVE-2018-10926 [boo#1107025], CVE-2018-10927 [boo#1107026], CVE-2018-10928 [boo#1107027], CVE-2018-10928 [boo#1107027], CVE-2018-10929 [boo#1107028], CVE-2018-10930 [boo#1107029], boo#1105776 . Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-79=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): glusterfs-3.12.15-lp151.3.3.1 glusterfs-debuginfo-3.12.15-lp151.3.3.1 glusterfs-debugsource-3.12.15-lp151.3.3.1 glusterfs-devel-3.12.15-lp151.3.3.1 libgfapi0-3.12.15-lp151.3.3.1 libgfapi0-debuginfo-3.12.15-lp151.3.3.1 libgfchangelog0-3.12.15-lp151.3.3.1 libgfchangelog0-debuginfo-3.12.15-lp151.3.3.1 libgfdb0-3.12.15-lp151.3.3.1 libgfdb0-debuginfo-3.12.15-lp151.3.3.1 libgfrpc0-3.12.15-lp151.3.3.1 libgfrpc0-debuginfo-3.12.15-lp151.3.3.1 libgfxdr0-3.12.15-lp151.3.3.1 libgfxdr0-debuginfo-3.12.15-lp151.3.3.1 libglusterfs0-3.12.15-lp151.3.3.1 libglusterfs0-debuginfo-3.12.15-lp151.3.3.1 python-gluster-3.12.15-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1088.html https://www.suse.com/security/cve/CVE-2018-10904.html https://www.suse.com/security/cve/CVE-2018-10907.html https://www.suse.com/security/cve/CVE-2018-10911.html https://www.suse.com/security/cve/CVE-2018-10913.html https://www.suse.com/security/cve/CVE-2018-10914.html https://www.suse.com/security/cve/CVE-2018-10923.html https://www.suse.com/security/cve/CVE-2018-10924.html https://www.suse.com/security/cve/CVE-2018-10926.html https://www.suse.com/security/cve/CVE-2018-10927.html https://www.suse.com/security/cve/CVE-2018-10928.html https://www.suse.com/security/cve/CVE-2018-10929.html https://www.suse.com/security/cve/CVE-2018-10930.html https://www.suse.com/security/cve/CVE-2018-1112.html https://bugzilla.suse.com/1090084 https://bugzilla.suse.com/1105776 https://bugzilla.suse.com/1107018 https://bugzilla.suse.com/1107019 https://bugzilla.suse.com/1107020 https://bugzilla.suse.com/1107021 https://bugzilla.suse.com/1107022 https://bugzilla.suse.com/1107023 https://bugzilla.suse.com/1107024 https://bugzilla.suse.com/1107025 https://bugzilla.suse.com/1107026 https://bugzilla.suse.com/1107027 https://bugzilla.suse.com/1107028 https://bugzilla.suse.com/1107029 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0069-1: important: Security update for uftpd
by opensuse-security＠opensuse.org 18 Jan '20

18 Jan '20

openSUSE Security Update: Security update for uftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0069-1 Rating: important References: #1160199 Cross-References: CVE-2020-5204 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for uftpd to version 2.11 fixes the following issues: - CVE-2020-5204: Fixed a buffer overflow in FTP PORT parser (boo#1160199). - Fixed additional bugs which could have security implications. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-69=1 Package List: - openSUSE Leap 15.1 (x86_64): uftpd-2.11-lp151.2.3.1 uftpd-debuginfo-2.11-lp151.2.3.1 uftpd-debugsource-2.11-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-5204.html https://bugzilla.suse.com/1160199 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0068-1: moderate: Security update for libredwg
by opensuse-security＠opensuse.org 17 Jan '20

17 Jan '20

openSUSE Security Update: Security update for libredwg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0068-1 Rating: moderate References: #1129868 #1129869 #1129870 #1129873 #1129874 #1129875 #1129876 #1129878 #1129879 #1129881 #1154080 #1159824 #1159825 #1159826 #1159827 #1159828 #1159831 #1159832 Cross-References: CVE-2019-20009 CVE-2019-20010 CVE-2019-20011 CVE-2019-20012 CVE-2019-20013 CVE-2019-20014 CVE-2019-20015 CVE-2019-9770 CVE-2019-9771 CVE-2019-9772 CVE-2019-9773 CVE-2019-9774 CVE-2019-9775 CVE-2019-9776 CVE-2019-9777 CVE-2019-9778 CVE-2019-9779 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has one errata is now available. Description: This update for libredwg fixes the following issues: libredwg was updated to release 0.9.3: * Added the -x,--extnames option to dwglayers for r13-r14 DWGs. * Fixed some leaks: SORTENTSTABLE, PROXY_ENTITY.ownerhandle for r13. * Add DICTIONARY.itemhandles[] for r13 and r14. * Fixed some dwglayers null pointer derefs, and flush its output for each layer. * Added several overflow checks from fuzzing [CVE-2019-20010, boo#1159825], [CVE-2019-20011, boo#1159826], [CVE-2019-20012, boo#1159827], [CVE-2019-20013, boo#1159828], [CVE-2019-20014, boo#1159831], [CVE-2019-20015, boo#1159832] * Disallow illegal SPLINE scenarios [CVE-2019-20009, boo#1159824] Update to release 0.9.1: * Fixed more null pointer dereferences, overflows, hangs and memory leaks for fuzzed (i.e. illegal) DWGs. Update to release 0.9 [boo#1154080]: * Added the DXF importer, using the new dynapi and the r2000 encoder. Only for r2000 DXFs. * Added utf8text conversion functions to the dynapi. * Added 3DSOLID encoder. * Added APIs to find handles for names, searching in tables and dicts. * API breaking changes - see NEWS file in package. * Fixed null pointer dereferences, and memory leaks (except DXF importer) [boo#1129868, CVE-2019-9779] [boo#1129869, CVE-2019-9778] [boo#1129870, CVE-2019-9777] [boo#1129873, CVE-2019-9776] [boo#1129874, CVE-2019-9773] [boo#1129875, CVE-2019-9772] [boo#1129876, CVE-2019-9771] [boo#1129878, CVE-2019-9775] [boo#1129879, CVE-2019-9774] [boo#1129881, CVE-2019-9770] Update to 0.8: * add a new dynamic API, read and write all header and object fields by name * API breaking changes * Fix many errors in DXF output * Fix JSON output * Many more bug fixes to handle specific object types Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-68=1 Package List: - openSUSE Leap 15.1 (x86_64): libredwg-debuginfo-0.9.3-lp151.2.3.1 libredwg-debugsource-0.9.3-lp151.2.3.1 libredwg-devel-0.9.3-lp151.2.3.1 libredwg-tools-0.9.3-lp151.2.3.1 libredwg-tools-debuginfo-0.9.3-lp151.2.3.1 libredwg0-0.9.3-lp151.2.3.1 libredwg0-debuginfo-0.9.3-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-20009.html https://www.suse.com/security/cve/CVE-2019-20010.html https://www.suse.com/security/cve/CVE-2019-20011.html https://www.suse.com/security/cve/CVE-2019-20012.html https://www.suse.com/security/cve/CVE-2019-20013.html https://www.suse.com/security/cve/CVE-2019-20014.html https://www.suse.com/security/cve/CVE-2019-20015.html https://www.suse.com/security/cve/CVE-2019-9770.html https://www.suse.com/security/cve/CVE-2019-9771.html https://www.suse.com/security/cve/CVE-2019-9772.html https://www.suse.com/security/cve/CVE-2019-9773.html https://www.suse.com/security/cve/CVE-2019-9774.html https://www.suse.com/security/cve/CVE-2019-9775.html https://www.suse.com/security/cve/CVE-2019-9776.html https://www.suse.com/security/cve/CVE-2019-9777.html https://www.suse.com/security/cve/CVE-2019-9778.html https://www.suse.com/security/cve/CVE-2019-9779.html https://bugzilla.suse.com/1129868 https://bugzilla.suse.com/1129869 https://bugzilla.suse.com/1129870 https://bugzilla.suse.com/1129873 https://bugzilla.suse.com/1129874 https://bugzilla.suse.com/1129875 https://bugzilla.suse.com/1129876 https://bugzilla.suse.com/1129878 https://bugzilla.suse.com/1129879 https://bugzilla.suse.com/1129881 https://bugzilla.suse.com/1154080 https://bugzilla.suse.com/1159824 https://bugzilla.suse.com/1159825 https://bugzilla.suse.com/1159826 https://bugzilla.suse.com/1159827 https://bugzilla.suse.com/1159828 https://bugzilla.suse.com/1159831 https://bugzilla.suse.com/1159832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0067-1: moderate: Security update for icingaweb2
by opensuse-security＠opensuse.org 16 Jan '20

16 Jan '20

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0067-1 Rating: moderate References: #1101357 #1119784 #1119785 #1119799 #1119800 #1119801 Cross-References: CVE-2018-18246 CVE-2018-18247 CVE-2018-18248 CVE-2018-18249 CVE-2018-18250 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for icingaweb2 to version 2.7.3 fixes the following issues: icingaweb2 update to 2.7.3: * Fixed an issue where servicegroups for roles with filtered objects were not available icingaweb2 update to 2.7.2: * Performance imrovements and bug fixes icingaweb2 update to 2.7.1: * Highlight links in the notes of an object * Fixed an issue where sort rules were no longer working * Fixed an issue where statistics were shown with an anarchist way * Fixed an issue where wildcards could no show results icingaweb2 update to 2.7.0: * New languages support * Now module developers got additional ways to customize Icinga Web 2 * UI enhancements icingaweb2 update to 2.6.3: * Fixed various issues with LDAP * Fixed issues with timezone * UI enhancements * Stability fixes icingaweb2 update to 2.6.2: You can find issues and features related to this release on our Roadmap. This bugfix release addresses the following topics: * Database connections to MySQL 8 no longer fail * LDAP connections now have a timeout configuration which defaults to 5 seconds * User groups are now correctly loaded for externally authenticated users * Filters are respected for all links in the host and service group overviews * Fixed permission problems where host and service actions provided by modules were missing * Fixed an SQL error in the contact list view when filtering for host groups * Fixed time zone (DST) detection * Fixed the contact details view if restrictions are active * Doc parser and documentation fixes Fix security issues: - CVE-2018-18246: fixed an CSRF in moduledisable (boo#1119784) - CVE-2018-18247: fixed an XSS via /icingaweb2/navigation/add (boo#1119785) - CVE-2018-18248: fixed an XSS attack is possible via query strings or a dir parameter (boo#1119801) - CVE-2018-18249: fixed an injection of PHP ini-file directives involves environment variables as channel to send out information (boo#1119799) - CVE-2018-18250: fixed parameters that can break navigation dashlets (boo#1119800) - Remove setuid from new upstream spec file for following dirs: /etc/icingaweb2, /etc/icingaweb/modules, /etc/icingaweb2/modules/setup, /etc/icingaweb2/modules/translation, /var/log/icingaweb2 icingaweb2 updated to 2.6.1: - You can find issues and features related to this release on our [Roadmap](https://github.com/Icinga/icingaweb2/milestone/51?closed=1). - The command audit now logs a command's payload as JSON which fixes a [bug](https://github.com/Icinga/icingaweb2/issues/3535) that has been introduced in version 2.6.0. icingaweb2 was updated to 2.6.0: - You can find issues and features related to this release on our Roadmap. * Enabling you to do stuff you couldn't before - Support for PHP 7.2 added - Support for SQLite resources added - Login and Command (monitoring) auditing added with the help of a dedicated module - Pluginoutput rendering is now hookable by modules which allows to render custom icons, emojis and .. cute kitties :octocat: * Avoiding that you miss something - It's now possible to toggle between list- and grid-mode for the host- and servicegroup overviews - The servicegrid now supports to flip its axes which allows it to be put into a landscape mode - Contacts only associated with services are visible now when restricted based on host filters - Negated and combined membership filters now work as expected (#2934) - A more prominent error message in case the monitoring backend goes down - The filter editor doesn't get cleared anymore upon hitting Enter * Making your life a bit easier - The tactical overview is now filterable and can be safely put into the dashboard - It is now possible to register new announcements over the REST Api - Filtering for custom variables now works in UTF8 environments * Ensuring you understand everything - The monitoring health is now beautiful to look at and properly behaves in narrow environments - Updated German localization - Updated Italian localization * Freeing you from unrealiable things - Removed support for PHP < 5.6 - Removed support for persistent database connections Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-67=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-67=1 Package List: - openSUSE Leap 15.1 (noarch): icingacli-2.7.3-lp151.6.5.1 icingaweb2-2.7.3-lp151.6.5.1 icingaweb2-common-2.7.3-lp151.6.5.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp151.6.5.1 icingaweb2-vendor-JShrink-2.7.3-lp151.6.5.1 icingaweb2-vendor-Parsedown-2.7.3-lp151.6.5.1 icingaweb2-vendor-dompdf-2.7.3-lp151.6.5.1 icingaweb2-vendor-lessphp-2.7.3-lp151.6.5.1 icingaweb2-vendor-zf1-2.7.3-lp151.6.5.1 php-Icinga-2.7.3-lp151.6.5.1 - openSUSE Leap 15.0 (noarch): icingacli-2.7.3-lp150.4.7.1 icingaweb2-2.7.3-lp150.4.7.1 icingaweb2-common-2.7.3-lp150.4.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp150.4.7.1 icingaweb2-vendor-JShrink-2.7.3-lp150.4.7.1 icingaweb2-vendor-Parsedown-2.7.3-lp150.4.7.1 icingaweb2-vendor-dompdf-2.7.3-lp150.4.7.1 icingaweb2-vendor-lessphp-2.7.3-lp150.4.7.1 icingaweb2-vendor-zf1-2.7.3-lp150.4.7.1 php-Icinga-2.7.3-lp150.4.7.1 - openSUSE Backports SLE-15-SP1 (noarch): icingacli-2.7.3-bp151.5.3.1 icingaweb2-2.7.3-bp151.5.3.1 icingaweb2-common-2.7.3-bp151.5.3.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 php-Icinga-2.7.3-bp151.5.3.1 - openSUSE Backports SLE-15 (noarch): icingacli-2.7.3-bp150.2.7.1 icingaweb2-2.7.3-bp150.2.7.1 icingaweb2-common-2.7.3-bp150.2.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp150.2.7.1 icingaweb2-vendor-JShrink-2.7.3-bp150.2.7.1 icingaweb2-vendor-Parsedown-2.7.3-bp150.2.7.1 icingaweb2-vendor-dompdf-2.7.3-bp150.2.7.1 icingaweb2-vendor-lessphp-2.7.3-bp150.2.7.1 icingaweb2-vendor-zf1-2.7.3-bp150.2.7.1 php-Icinga-2.7.3-bp150.2.7.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.7.3-9.1 icingaweb2-2.7.3-9.1 icingaweb2-common-2.7.3-9.1 icingaweb2-vendor-HTMLPurifier-2.7.3-9.1 icingaweb2-vendor-JShrink-2.7.3-9.1 icingaweb2-vendor-Parsedown-2.7.3-9.1 icingaweb2-vendor-dompdf-2.7.3-9.1 icingaweb2-vendor-lessphp-2.7.3-9.1 icingaweb2-vendor-zf1-2.7.3-9.1 php-Icinga-2.7.3-9.1 References: https://www.suse.com/security/cve/CVE-2018-18246.html https://www.suse.com/security/cve/CVE-2018-18247.html https://www.suse.com/security/cve/CVE-2018-18248.html https://www.suse.com/security/cve/CVE-2018-18249.html https://www.suse.com/security/cve/CVE-2018-18250.html https://bugzilla.suse.com/1101357 https://bugzilla.suse.com/1119784 https://bugzilla.suse.com/1119785 https://bugzilla.suse.com/1119799 https://bugzilla.suse.com/1119800 https://bugzilla.suse.com/1119801 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0067-1: moderate: Security update for icingaweb2
by opensuse-security＠opensuse.org 16 Jan '20

16 Jan '20

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0067-1 Rating: moderate References: #1101357 #1119784 #1119785 #1119799 #1119800 #1119801 Cross-References: CVE-2018-18246 CVE-2018-18247 CVE-2018-18248 CVE-2018-18249 CVE-2018-18250 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for icingaweb2 to version 2.7.3 fixes the following issues: icingaweb2 update to 2.7.3: * Fixed an issue where servicegroups for roles with filtered objects were not available icingaweb2 update to 2.7.2: * Performance imrovements and bug fixes icingaweb2 update to 2.7.1: * Highlight links in the notes of an object * Fixed an issue where sort rules were no longer working * Fixed an issue where statistics were shown with an anarchist way * Fixed an issue where wildcards could no show results icingaweb2 update to 2.7.0: * New languages support * Now module developers got additional ways to customize Icinga Web 2 * UI enhancements icingaweb2 update to 2.6.3: * Fixed various issues with LDAP * Fixed issues with timezone * UI enhancements * Stability fixes icingaweb2 update to 2.6.2: You can find issues and features related to this release on our Roadmap. This bugfix release addresses the following topics: * Database connections to MySQL 8 no longer fail * LDAP connections now have a timeout configuration which defaults to 5 seconds * User groups are now correctly loaded for externally authenticated users * Filters are respected for all links in the host and service group overviews * Fixed permission problems where host and service actions provided by modules were missing * Fixed an SQL error in the contact list view when filtering for host groups * Fixed time zone (DST) detection * Fixed the contact details view if restrictions are active * Doc parser and documentation fixes Fix security issues: - CVE-2018-18246: fixed an CSRF in moduledisable (boo#1119784) - CVE-2018-18247: fixed an XSS via /icingaweb2/navigation/add (boo#1119785) - CVE-2018-18248: fixed an XSS attack is possible via query strings or a dir parameter (boo#1119801) - CVE-2018-18249: fixed an injection of PHP ini-file directives involves environment variables as channel to send out information (boo#1119799) - CVE-2018-18250: fixed parameters that can break navigation dashlets (boo#1119800) - Remove setuid from new upstream spec file for following dirs: /etc/icingaweb2, /etc/icingaweb/modules, /etc/icingaweb2/modules/setup, /etc/icingaweb2/modules/translation, /var/log/icingaweb2 icingaweb2 updated to 2.6.1: - You can find issues and features related to this release on our [Roadmap](https://github.com/Icinga/icingaweb2/milestone/51?closed=1). - The command audit now logs a command's payload as JSON which fixes a [bug](https://github.com/Icinga/icingaweb2/issues/3535) that has been introduced in version 2.6.0. icingaweb2 was updated to 2.6.0: - You can find issues and features related to this release on our Roadmap. * Enabling you to do stuff you couldn't before - Support for PHP 7.2 added - Support for SQLite resources added - Login and Command (monitoring) auditing added with the help of a dedicated module - Pluginoutput rendering is now hookable by modules which allows to render custom icons, emojis and .. cute kitties :octocat: * Avoiding that you miss something - It's now possible to toggle between list- and grid-mode for the host- and servicegroup overviews - The servicegrid now supports to flip its axes which allows it to be put into a landscape mode - Contacts only associated with services are visible now when restricted based on host filters - Negated and combined membership filters now work as expected (#2934) - A more prominent error message in case the monitoring backend goes down - The filter editor doesn't get cleared anymore upon hitting Enter * Making your life a bit easier - The tactical overview is now filterable and can be safely put into the dashboard - It is now possible to register new announcements over the REST Api - Filtering for custom variables now works in UTF8 environments * Ensuring you understand everything - The monitoring health is now beautiful to look at and properly behaves in narrow environments - Updated German localization - Updated Italian localization * Freeing you from unrealiable things - Removed support for PHP < 5.6 - Removed support for persistent database connections Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-67=1 Package List: - openSUSE Leap 15.1 (noarch): icingacli-2.7.3-lp151.6.5.1 icingaweb2-2.7.3-lp151.6.5.1 icingaweb2-common-2.7.3-lp151.6.5.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp151.6.5.1 icingaweb2-vendor-JShrink-2.7.3-lp151.6.5.1 icingaweb2-vendor-Parsedown-2.7.3-lp151.6.5.1 icingaweb2-vendor-dompdf-2.7.3-lp151.6.5.1 icingaweb2-vendor-lessphp-2.7.3-lp151.6.5.1 icingaweb2-vendor-zf1-2.7.3-lp151.6.5.1 php-Icinga-2.7.3-lp151.6.5.1 - openSUSE Leap 15.0 (noarch): icingacli-2.7.3-lp150.4.7.1 icingaweb2-2.7.3-lp150.4.7.1 icingaweb2-common-2.7.3-lp150.4.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp150.4.7.1 icingaweb2-vendor-JShrink-2.7.3-lp150.4.7.1 icingaweb2-vendor-Parsedown-2.7.3-lp150.4.7.1 icingaweb2-vendor-dompdf-2.7.3-lp150.4.7.1 icingaweb2-vendor-lessphp-2.7.3-lp150.4.7.1 icingaweb2-vendor-zf1-2.7.3-lp150.4.7.1 php-Icinga-2.7.3-lp150.4.7.1 - openSUSE Backports SLE-15-SP1 (noarch): icingacli-2.7.3-bp151.5.3.1 icingaweb2-2.7.3-bp151.5.3.1 icingaweb2-common-2.7.3-bp151.5.3.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 php-Icinga-2.7.3-bp151.5.3.1 - openSUSE Backports SLE-15 (noarch): icingacli-2.7.3-bp150.2.7.1 icingaweb2-2.7.3-bp150.2.7.1 icingaweb2-common-2.7.3-bp150.2.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp150.2.7.1 icingaweb2-vendor-JShrink-2.7.3-bp150.2.7.1 icingaweb2-vendor-Parsedown-2.7.3-bp150.2.7.1 icingaweb2-vendor-dompdf-2.7.3-bp150.2.7.1 icingaweb2-vendor-lessphp-2.7.3-bp150.2.7.1 icingaweb2-vendor-zf1-2.7.3-bp150.2.7.1 php-Icinga-2.7.3-bp150.2.7.1 References: https://www.suse.com/security/cve/CVE-2018-18246.html https://www.suse.com/security/cve/CVE-2018-18247.html https://www.suse.com/security/cve/CVE-2018-18248.html https://www.suse.com/security/cve/CVE-2018-18249.html https://www.suse.com/security/cve/CVE-2018-18250.html https://bugzilla.suse.com/1101357 https://bugzilla.suse.com/1119784 https://bugzilla.suse.com/1119785 https://bugzilla.suse.com/1119799 https://bugzilla.suse.com/1119800 https://bugzilla.suse.com/1119801 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0062-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 15 Jan '20

15 Jan '20

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0062-1 Rating: moderate References: #1155346 #1157775 #1158101 #1158809 Cross-References: CVE-2019-1551 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for openssl-1_1 fixes the following issues: Security issue fixed: - CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809). Various FIPS related improvements were done: - FIPS: Backport SSH KDF to openssl (jsc#SLE-8789, bsc#1157775). - Port FIPS patches from SLE-12 (bsc#1158101). - Use SHA-2 in the RSA pairwise consistency check (bsc#1155346). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-62=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_1-devel-1.1.0i-lp151.8.6.1 libopenssl1_1-1.1.0i-lp151.8.6.1 libopenssl1_1-debuginfo-1.1.0i-lp151.8.6.1 libopenssl1_1-hmac-1.1.0i-lp151.8.6.1 openssl-1_1-1.1.0i-lp151.8.6.1 openssl-1_1-debuginfo-1.1.0i-lp151.8.6.1 openssl-1_1-debugsource-1.1.0i-lp151.8.6.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_1-devel-32bit-1.1.0i-lp151.8.6.1 libopenssl1_1-32bit-1.1.0i-lp151.8.6.1 libopenssl1_1-32bit-debuginfo-1.1.0i-lp151.8.6.1 libopenssl1_1-hmac-32bit-1.1.0i-lp151.8.6.1 - openSUSE Leap 15.1 (noarch): openssl-1_1-doc-1.1.0i-lp151.8.6.1 References: https://www.suse.com/security/cve/CVE-2019-1551.html https://bugzilla.suse.com/1155346 https://bugzilla.suse.com/1157775 https://bugzilla.suse.com/1158101 https://bugzilla.suse.com/1158809 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0060-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 15 Jan '20

15 Jan '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0060-1 Rating: important References: #1160305 #1160498 Cross-References: CVE-2019-17015 CVE-2019-17016 CVE-2019-17017 CVE-2019-17021 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 68.4.1 ESR * Fixed: Security fix MFSA 2020-03 (bsc#1160498) * CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement - Firefox Extended Support Release 68.4.0 ESR * Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) * CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows * CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting * CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp * CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows * CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-60=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.4.1-lp151.2.24.1 MozillaFirefox-branding-upstream-68.4.1-lp151.2.24.1 MozillaFirefox-buildsymbols-68.4.1-lp151.2.24.1 MozillaFirefox-debuginfo-68.4.1-lp151.2.24.1 MozillaFirefox-debugsource-68.4.1-lp151.2.24.1 MozillaFirefox-devel-68.4.1-lp151.2.24.1 MozillaFirefox-translations-common-68.4.1-lp151.2.24.1 MozillaFirefox-translations-other-68.4.1-lp151.2.24.1 References: https://www.suse.com/security/cve/CVE-2019-17015.html https://www.suse.com/security/cve/CVE-2019-17016.html https://www.suse.com/security/cve/CVE-2019-17017.html https://www.suse.com/security/cve/CVE-2019-17021.html https://www.suse.com/security/cve/CVE-2019-17022.html https://www.suse.com/security/cve/CVE-2019-17024.html https://www.suse.com/security/cve/CVE-2019-17026.html https://bugzilla.suse.com/1160305 https://bugzilla.suse.com/1160498 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0058-1: important: Security update for virglrenderer
by opensuse-security＠opensuse.org 15 Jan '20

15 Jan '20

openSUSE Security Update: Security update for virglrenderer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0058-1 Rating: important References: #1159478 #1159479 #1159482 #1159486 Cross-References: CVE-2019-18388 CVE-2019-18389 CVE-2019-18390 CVE-2019-18391 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virglrenderer fixes the following issues: - CVE-2019-18388: Fixed a null pointer dereference which could have led to denial of service (bsc#1159479). - CVE-2019-18390: Fixed an out of bound read which could have led to denial of service (bsc#1159478). - CVE-2019-18389: Fixed a heap buffer overflow which could have led to guest escape or denial of service (bsc#1159482). - CVE-2019-18391: Fixed a heap based buffer overflow which could have led to guest escape or denial of service (bsc#1159486). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-58=1 Package List: - openSUSE Leap 15.1 (x86_64): libvirglrenderer0-0.6.0-lp151.4.3.1 libvirglrenderer0-debuginfo-0.6.0-lp151.4.3.1 virglrenderer-debuginfo-0.6.0-lp151.4.3.1 virglrenderer-debugsource-0.6.0-lp151.4.3.1 virglrenderer-devel-0.6.0-lp151.4.3.1 virglrenderer-test-server-0.6.0-lp151.4.3.1 virglrenderer-test-server-debuginfo-0.6.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-18388.html https://www.suse.com/security/cve/CVE-2019-18389.html https://www.suse.com/security/cve/CVE-2019-18390.html https://www.suse.com/security/cve/CVE-2019-18391.html https://bugzilla.suse.com/1159478 https://bugzilla.suse.com/1159479 https://bugzilla.suse.com/1159482 https://bugzilla.suse.com/1159486 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0059-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 15 Jan '20

15 Jan '20

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0059-1 Rating: important References: #1149792 #1159352 Cross-References: CVE-2019-16775 CVE-2019-16776 CVE-2019-16777 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs8 to version 8.17.0 fixes the following issues: Security issues fixed: - CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via "bin" field (bsc#1159352). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-59=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs8-8.17.0-lp151.2.9.1 nodejs8-debuginfo-8.17.0-lp151.2.9.1 nodejs8-debugsource-8.17.0-lp151.2.9.1 nodejs8-devel-8.17.0-lp151.2.9.1 npm8-8.17.0-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): nodejs8-docs-8.17.0-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-16775.html https://www.suse.com/security/cve/CVE-2019-16776.html https://www.suse.com/security/cve/CVE-2019-16777.html https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1159352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0055-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 14 Jan '20

14 Jan '20

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0055-1 Rating: moderate References: #1159852 #1160321 #1160364 Cross-References: CVE-2019-19950 CVE-2019-19951 CVE-2019-19953 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2019-19950: Fixed a use-after-free in ThrowException and ThrowLoggedException of magick/error.c. (boo#1159852) - CVE-2019-19951: Fixed a heap-based buffer overflow in ImportRLEPixels() (boo#1160321). - CVE-2019-19953: Fixed a heap-based buffer overflow in EncodeImage() (boo#1160364). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-55=1 Package List: - openSUSE Leap 15.1 (x86_64): GraphicsMagick-1.3.29-lp151.4.14.1 GraphicsMagick-debuginfo-1.3.29-lp151.4.14.1 GraphicsMagick-debugsource-1.3.29-lp151.4.14.1 GraphicsMagick-devel-1.3.29-lp151.4.14.1 libGraphicsMagick++-Q16-12-1.3.29-lp151.4.14.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp151.4.14.1 libGraphicsMagick++-devel-1.3.29-lp151.4.14.1 libGraphicsMagick-Q16-3-1.3.29-lp151.4.14.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp151.4.14.1 libGraphicsMagick3-config-1.3.29-lp151.4.14.1 libGraphicsMagickWand-Q16-2-1.3.29-lp151.4.14.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp151.4.14.1 perl-GraphicsMagick-1.3.29-lp151.4.14.1 perl-GraphicsMagick-debuginfo-1.3.29-lp151.4.14.1 References: https://www.suse.com/security/cve/CVE-2019-19950.html https://www.suse.com/security/cve/CVE-2019-19951.html https://www.suse.com/security/cve/CVE-2019-19953.html https://bugzilla.suse.com/1159852 https://bugzilla.suse.com/1160321 https://bugzilla.suse.com/1160364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0