January 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0057-1: moderate: Security update for singularity
by opensuse-security＠opensuse.org 14 Jan '20

14 Jan '20

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0057-1 Rating: moderate References: #1159550 Cross-References: CVE-2019-19724 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity fixes the following issues: - CVE-2019-19724: Fixed incorrect file permissions on user configuration and cache directories (boo#1159550). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-57=1 Package List: - openSUSE Leap 15.1 (x86_64): libsingularity1-2.6.1-lp151.2.3.1 libsingularity1-debuginfo-2.6.1-lp151.2.3.1 singularity-2.6.1-lp151.2.3.1 singularity-debuginfo-2.6.1-lp151.2.3.1 singularity-debugsource-2.6.1-lp151.2.3.1 singularity-devel-2.6.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-19724.html https://bugzilla.suse.com/1159550 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0056-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 14 Jan '20

14 Jan '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0056-1 Rating: important References: #1150914 #1157614 #1160456 Cross-References: CVE-2019-12922 CVE-2019-18622 CVE-2020-5504 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.9.4 fixes the following issues: - CVE-2020-5504: SQL injection in user accounts page (boo#1160456). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-56=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.4-40.1 References: https://www.suse.com/security/cve/CVE-2019-12922.html https://www.suse.com/security/cve/CVE-2019-18622.html https://www.suse.com/security/cve/CVE-2020-5504.html https://bugzilla.suse.com/1150914 https://bugzilla.suse.com/1157614 https://bugzilla.suse.com/1160456 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0053-1: important: Security update for chromium
by opensuse-security＠opensuse.org 14 Jan '20

14 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0053-1 Rating: important References: #1160337 Cross-References: CVE-2019-5844 CVE-2019-5845 CVE-2019-5846 CVE-2020-6377 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium version 79.0.3945.117 fixes the following issues: - CVE-2020-6377: Fixed a use-after-free in audio - Various fixes from internal audits, fuzzing and other initiatives This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-53=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libre2-0-20200101-bp151.6.12.1 libre2-0-debuginfo-20200101-bp151.6.12.1 re2-debugsource-20200101-bp151.6.12.1 re2-devel-20200101-bp151.6.12.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.117-bp151.3.53.3 chromium-79.0.3945.117-bp151.3.53.3 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-0-64bit-20200101-bp151.6.12.1 libre2-0-64bit-debuginfo-20200101-bp151.6.12.1 References: https://www.suse.com/security/cve/CVE-2019-5844.html https://www.suse.com/security/cve/CVE-2019-5845.html https://www.suse.com/security/cve/CVE-2019-5846.html https://www.suse.com/security/cve/CVE-2020-6377.html https://bugzilla.suse.com/1160337 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0051-1: important: Security update for log4j
by opensuse-security＠opensuse.org 14 Jan '20

14 Jan '20

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0051-1 Rating: important References: #1159646 Cross-References: CVE-2019-17571 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer (bsc#1159646). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-51=1 Package List: - openSUSE Leap 15.1 (noarch): log4j-1.2.17-lp151.5.3.1 log4j-javadoc-1.2.17-lp151.5.3.1 log4j-manual-1.2.17-lp151.5.3.1 log4j-mini-1.2.17-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-17571.html https://bugzilla.suse.com/1159646 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0036-1: moderate: Security update for rubygem-excon
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for rubygem-excon ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0036-1 Rating: moderate References: #1159342 Cross-References: CVE-2019-16779 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-excon fixes the following issues: CVE-2019-16779 (boo#1159342): Fix a race condition around persistent connections, where a connection, which was interrupted, would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-36=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-excon-0.59.0-lp151.3.3.1 ruby2.5-rubygem-excon-doc-0.59.0-lp151.3.3.1 ruby2.5-rubygem-excon-testsuite-0.59.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-16779.html https://bugzilla.suse.com/1159342 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0014-1: moderate: Security update for php7-imagick
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for php7-imagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0014-1 Rating: moderate References: #1135418 Cross-References: CVE-2019-11037 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7-imagick fixes the following issues: Upgrade to version 3.4.4: Added: * function Imagick::optimizeImageTransparency() * METRIC_STRUCTURAL_SIMILARITY_ERROR * METRIC_STRUCTURAL_DISSIMILARITY_ERROR * COMPRESSION_ZSTD - https://github.com/facebook/zstd * COMPRESSION_WEBP * CHANNEL_COMPOSITE_MASK * FILTER_CUBIC_SPLINE - "Define the lobes with the -define filter:lobes={2,3,4} (reference https://imagemagick.org/discourse-server/viewtopic.php?f=2&t=32506)." * Imagick now explicitly conflicts with the Gmagick extension. Fixes: * Correct version check to make RemoveAlphaChannel and FlattenAlphaChannel be available when using Imagick with ImageMagick version 6.7.8-x * Bug 77128 - Imagick::setImageInterpolateMethod() not available on Windows * Prevent memory leak when ImagickPixel::__construct called after object instantiation. * Prevent segfault when ImagickPixel internal constructor not called. * Imagick::setResourceLimit support for values larger than 2GB (2^31) on 32bit platforms. * Corrected memory overwrite in Imagick::colorDecisionListImage() * Bug 77791 - ImagickKernel::fromMatrix() out of bounds write. Fixes CVE-2019-11037, boo#1135418 The following functions have been deprecated: * ImagickDraw, matte * Imagick::averageimages * Imagick::colorfloodfillimage * Imagick::filter * Imagick::flattenimages * Imagick::getimageattribute * Imagick::getimagechannelextrema * Imagick::getimageclipmask * Imagick::getimageextrema * Imagick::getimageindex * Imagick::getimagematte * Imagick::getimagemattecolor * Imagick::getimagesize * Imagick::mapimage * Imagick::mattefloodfillimage * Imagick::medianfilterimage * Imagick::mosaicimages * Imagick::orderedposterizeimage * Imagick::paintfloodfillimage * Imagick::paintopaqueimage * Imagick::painttransparentimage * Imagick::radialblurimage * Imagick::recolorimage * Imagick::reducenoiseimage * Imagick::roundcornersimage * Imagick::roundcorners * Imagick::setimageattribute * Imagick::setimagebias * Imagick::setimageclipmask * Imagick::setimageindex * Imagick::setimagemattecolor * Imagick::setimagebiasquantum * Imagick::setimageopacity * Imagick::transformimage Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-14=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-14=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-14=1 Package List: - openSUSE Leap 15.1 (x86_64): php7-imagick-3.4.4-lp151.8.3.1 php7-imagick-debuginfo-3.4.4-lp151.8.3.1 php7-imagick-debugsource-3.4.4-lp151.8.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): php7-imagick-3.4.4-bp151.2.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): php7-imagick-3.4.4-5.1 References: https://www.suse.com/security/cve/CVE-2019-11037.html https://bugzilla.suse.com/1135418 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0021-1: moderate: Security update for dia
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for dia ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0021-1 Rating: moderate References: #1158194 Cross-References: CVE-2019-19451 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dia fixes the following issue: - CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-21=1 Package List: - openSUSE Leap 15.1 (noarch): dia-lang-0.97.3-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): dia-0.97.3-lp151.4.3.1 dia-debuginfo-0.97.3-lp151.4.3.1 dia-debugsource-0.97.3-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-19451.html https://bugzilla.suse.com/1158194 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0022-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0022-1 Rating: moderate References: #1148987 #1155338 #1155339 Cross-References: CVE-2019-13627 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987). Bug fixes: - Added CMAC AES self test (bsc#1155339). - Added CMAC TDES self test missing (bsc#1155338). - Fix test dsa-rfc6979 in FIPS mode. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-22=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libgcrypt-cavs-1.8.2-lp151.9.7.1 libgcrypt-cavs-debuginfo-1.8.2-lp151.9.7.1 libgcrypt-debugsource-1.8.2-lp151.9.7.1 libgcrypt-devel-1.8.2-lp151.9.7.1 libgcrypt-devel-debuginfo-1.8.2-lp151.9.7.1 libgcrypt20-1.8.2-lp151.9.7.1 libgcrypt20-debuginfo-1.8.2-lp151.9.7.1 libgcrypt20-hmac-1.8.2-lp151.9.7.1 - openSUSE Leap 15.1 (x86_64): libgcrypt-devel-32bit-1.8.2-lp151.9.7.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp151.9.7.1 libgcrypt20-32bit-1.8.2-lp151.9.7.1 libgcrypt20-32bit-debuginfo-1.8.2-lp151.9.7.1 libgcrypt20-hmac-32bit-1.8.2-lp151.9.7.1 References: https://www.suse.com/security/cve/CVE-2019-13627.html https://bugzilla.suse.com/1148987 https://bugzilla.suse.com/1155338 https://bugzilla.suse.com/1155339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0020-1: moderate: Security update for shibboleth-sp
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0020-1 Rating: moderate References: #1157471 Cross-References: CVE-2019-19191 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-20=1 Package List: - openSUSE Leap 15.1 (x86_64): libshibsp-lite7-2.6.1-lp151.3.3.1 libshibsp-lite7-debuginfo-2.6.1-lp151.3.3.1 libshibsp7-2.6.1-lp151.3.3.1 libshibsp7-debuginfo-2.6.1-lp151.3.3.1 shibboleth-sp-2.6.1-lp151.3.3.1 shibboleth-sp-debuginfo-2.6.1-lp151.3.3.1 shibboleth-sp-debugsource-2.6.1-lp151.3.3.1 shibboleth-sp-devel-2.6.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-19191.html https://bugzilla.suse.com/1157471 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0014-1: moderate: Security update for php7-imagick
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for php7-imagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0014-1 Rating: moderate References: #1135418 Cross-References: CVE-2019-11037 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7-imagick fixes the following issues: Upgrade to version 3.4.4: Added: * function Imagick::optimizeImageTransparency() * METRIC_STRUCTURAL_SIMILARITY_ERROR * METRIC_STRUCTURAL_DISSIMILARITY_ERROR * COMPRESSION_ZSTD - https://github.com/facebook/zstd * COMPRESSION_WEBP * CHANNEL_COMPOSITE_MASK * FILTER_CUBIC_SPLINE - "Define the lobes with the -define filter:lobes={2,3,4} (reference https://imagemagick.org/discourse-server/viewtopic.php?f=2&t=32506)." * Imagick now explicitly conflicts with the Gmagick extension. Fixes: * Correct version check to make RemoveAlphaChannel and FlattenAlphaChannel be available when using Imagick with ImageMagick version 6.7.8-x * Bug 77128 - Imagick::setImageInterpolateMethod() not available on Windows * Prevent memory leak when ImagickPixel::__construct called after object instantiation. * Prevent segfault when ImagickPixel internal constructor not called. * Imagick::setResourceLimit support for values larger than 2GB (2^31) on 32bit platforms. * Corrected memory overwrite in Imagick::colorDecisionListImage() * Bug 77791 - ImagickKernel::fromMatrix() out of bounds write. Fixes CVE-2019-11037, boo#1135418 The following functions have been deprecated: * ImagickDraw, matte * Imagick::averageimages * Imagick::colorfloodfillimage * Imagick::filter * Imagick::flattenimages * Imagick::getimageattribute * Imagick::getimagechannelextrema * Imagick::getimageclipmask * Imagick::getimageextrema * Imagick::getimageindex * Imagick::getimagematte * Imagick::getimagemattecolor * Imagick::getimagesize * Imagick::mapimage * Imagick::mattefloodfillimage * Imagick::medianfilterimage * Imagick::mosaicimages * Imagick::orderedposterizeimage * Imagick::paintfloodfillimage * Imagick::paintopaqueimage * Imagick::painttransparentimage * Imagick::radialblurimage * Imagick::recolorimage * Imagick::reducenoiseimage * Imagick::roundcornersimage * Imagick::roundcorners * Imagick::setimageattribute * Imagick::setimagebias * Imagick::setimageclipmask * Imagick::setimageindex * Imagick::setimagemattecolor * Imagick::setimagebiasquantum * Imagick::setimageopacity * Imagick::transformimage Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-14=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-14=1 Package List: - openSUSE Leap 15.1 (x86_64): php7-imagick-3.4.4-lp151.8.3.1 php7-imagick-debuginfo-3.4.4-lp151.8.3.1 php7-imagick-debugsource-3.4.4-lp151.8.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): php7-imagick-3.4.4-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11037.html https://bugzilla.suse.com/1135418 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0