January 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0015-1: moderate: Security update for trousers
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for trousers ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0015-1 Rating: moderate References: #1157651 Cross-References: CVE-2019-18898 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for trousers fixes the following issues: - CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-15=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtspi1-0.3.14-lp151.4.3.1 libtspi1-debuginfo-0.3.14-lp151.4.3.1 trousers-0.3.14-lp151.4.3.1 trousers-debuginfo-0.3.14-lp151.4.3.1 trousers-debugsource-0.3.14-lp151.4.3.1 trousers-devel-0.3.14-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libtspi1-32bit-0.3.14-lp151.4.3.1 libtspi1-32bit-debuginfo-0.3.14-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-18898.html https://bugzilla.suse.com/1157651 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0024-1: moderate: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0024-1 Rating: moderate References: #1100345 #1133123 #1133153 #1133155 #1149839 Cross-References: CVE-2017-17555 CVE-2018-13305 CVE-2019-11338 CVE-2019-11339 CVE-2019-15942 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ffmpeg-4 fixes the following issues: ffmpeg-4 was updated to version 4.0.5, fixes boo#1133153 - CVE-2019-11339: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 allowed remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified. (bsc#1133153) - For other changes see /usr/share/doc/packages/libavcodec58/Changelog Update to version 4.2.1: * Stable bug fix release, mainly codecs and format fixes. - CVE-2019-15942: Conditional jump or move depends on uninitialised value" issue in h2645_parse (boo#1149839) Update to FFmpeg 4.2 "Ada" * tpad filter * AV1 decoding support through libdav1d * dedot filter * chromashift and rgbashift filters * freezedetect filter * truehd_core bitstream filter * dhav demuxer * PCM-DVD encoder * GIF parser * vividas demuxer * hymt decoder * anlmdn filter * maskfun filter * hcom demuxer and decoder * ARBC decoder * libaribb24 based ARIB STD-B24 caption support (profiles A and C) * Support decoding of HEVC 4:4:4 content in nvdec and cuviddec * removed libndi-newtek * agm decoder * KUX demuxer * AV1 frame split bitstream filter * lscr decoder * lagfun filter * asoftclip filter * Support decoding of HEVC 4:4:4 content in vdpau * colorhold filter * xmedian filter * asr filter * showspatial multimedia filter * VP4 video decoder * IFV demuxer * derain filter * deesser filter * mov muxer writes tracks with unspecified language instead of English by default * added support for using clang to compile CUDA kernels - See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog. Update to version 4.1.4 * See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog. - Enable runtime enabling for fdkaac via --enable-libfdk-aac-dlopen Update to version 4.1.3: * Updates and bug fixes for codecs, filters and formats. [boo#1133153, boo#1133155, CVE-2019-11338, CVE-2019-11339] Update to version 4.1.2: * Updates and bug fixes for codecs, filters and formats. Update to version 4.1.1: * Various filter and codec fixes and enhancements. * configure: Add missing xlib dependency for VAAPI X11 code. * For complete changelog, see /usr/share/doc/packages/ffmpeg-4/Changelog * enable AV1 support on x86_64 Update ffmpeg to 4.1: * Lots of filter updates as usual: deblock, tmix, aplify, fftdnoiz, aderivative, aintegral, pal75bars, pal100bars, adeclick, adeclip, lensfun (wrapper), colorconstancy, 1D LUT filter (lut1d), cue, acue, transpose_npp, amultiply, Block-Matching 3d (bm3d) denoising filter, acrossover filter, audio denoiser as afftdn filter, sinc audio filter source, chromahold, setparams, vibrance, xstack, (a)graphmonitor filter yadif_cuda filter. * AV1 parser * Support for AV1 in MP4 * PCM VIDC decoder and encoder * libtensorflow backend for DNN based filters like srcnn * -- The following only enabled in third-party builds: * ATRAC9 decoder * AVS2 video decoder via libdavs2 * IMM4 video decoder * Brooktree ProSumer video decoder * MatchWare Screen Capture Codec decoder * WinCam Motion Video decoder * RemotelyAnywhere Screen Capture decoder * AVS2 video encoder via libxavs2 * ILBC decoder * SER demuxer * Decoding S12M timecode in H264 * For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1 Update ffmpeg to 4.0.3: * For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.0.3 - CVE-2018-13305: Added a missing check for negative values of mqaunt variable (boo#1100345). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-24=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-24=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-24=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-24=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ffmpeg-4-debugsource-4.2.1-lp151.2.3.1 ffmpeg-4-libavcodec-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libavdevice-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libavfilter-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libavformat-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libavresample-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libavutil-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libpostproc-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libswresample-devel-4.2.1-lp151.2.3.1 ffmpeg-4-libswscale-devel-4.2.1-lp151.2.3.1 ffmpeg-4-private-devel-4.2.1-lp151.2.3.1 libavcodec58-4.2.1-lp151.2.3.1 libavcodec58-debuginfo-4.2.1-lp151.2.3.1 libavdevice58-4.2.1-lp151.2.3.1 libavdevice58-debuginfo-4.2.1-lp151.2.3.1 libavfilter7-4.2.1-lp151.2.3.1 libavfilter7-debuginfo-4.2.1-lp151.2.3.1 libavformat58-4.2.1-lp151.2.3.1 libavformat58-debuginfo-4.2.1-lp151.2.3.1 libavresample4-4.2.1-lp151.2.3.1 libavresample4-debuginfo-4.2.1-lp151.2.3.1 libavutil56-4.2.1-lp151.2.3.1 libavutil56-debuginfo-4.2.1-lp151.2.3.1 libpostproc55-4.2.1-lp151.2.3.1 libpostproc55-debuginfo-4.2.1-lp151.2.3.1 libswresample3-4.2.1-lp151.2.3.1 libswresample3-debuginfo-4.2.1-lp151.2.3.1 libswscale5-4.2.1-lp151.2.3.1 libswscale5-debuginfo-4.2.1-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libavcodec58-32bit-4.2.1-lp151.2.3.1 libavcodec58-32bit-debuginfo-4.2.1-lp151.2.3.1 libavdevice58-32bit-4.2.1-lp151.2.3.1 libavdevice58-32bit-debuginfo-4.2.1-lp151.2.3.1 libavfilter7-32bit-4.2.1-lp151.2.3.1 libavfilter7-32bit-debuginfo-4.2.1-lp151.2.3.1 libavformat58-32bit-4.2.1-lp151.2.3.1 libavformat58-32bit-debuginfo-4.2.1-lp151.2.3.1 libavresample4-32bit-4.2.1-lp151.2.3.1 libavresample4-32bit-debuginfo-4.2.1-lp151.2.3.1 libavutil56-32bit-4.2.1-lp151.2.3.1 libavutil56-32bit-debuginfo-4.2.1-lp151.2.3.1 libpostproc55-32bit-4.2.1-lp151.2.3.1 libpostproc55-32bit-debuginfo-4.2.1-lp151.2.3.1 libswresample3-32bit-4.2.1-lp151.2.3.1 libswresample3-32bit-debuginfo-4.2.1-lp151.2.3.1 libswscale5-32bit-4.2.1-lp151.2.3.1 libswscale5-32bit-debuginfo-4.2.1-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debugsource-4.2.1-bp151.5.3.1 ffmpeg-4-libavcodec-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libavdevice-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libavfilter-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libavformat-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libavresample-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libavutil-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libpostproc-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libswresample-devel-4.2.1-bp151.5.3.1 ffmpeg-4-libswscale-devel-4.2.1-bp151.5.3.1 ffmpeg-4-private-devel-4.2.1-bp151.5.3.1 libavcodec58-4.2.1-bp151.5.3.1 libavcodec58-debuginfo-4.2.1-bp151.5.3.1 libavdevice58-4.2.1-bp151.5.3.1 libavdevice58-debuginfo-4.2.1-bp151.5.3.1 libavfilter7-4.2.1-bp151.5.3.1 libavfilter7-debuginfo-4.2.1-bp151.5.3.1 libavformat58-4.2.1-bp151.5.3.1 libavformat58-debuginfo-4.2.1-bp151.5.3.1 libavresample4-4.2.1-bp151.5.3.1 libavresample4-debuginfo-4.2.1-bp151.5.3.1 libavutil56-4.2.1-bp151.5.3.1 libavutil56-debuginfo-4.2.1-bp151.5.3.1 libpostproc55-4.2.1-bp151.5.3.1 libpostproc55-debuginfo-4.2.1-bp151.5.3.1 libswresample3-4.2.1-bp151.5.3.1 libswresample3-debuginfo-4.2.1-bp151.5.3.1 libswscale5-4.2.1-bp151.5.3.1 libswscale5-debuginfo-4.2.1-bp151.5.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libavcodec58-64bit-4.2.1-bp151.5.3.1 libavcodec58-64bit-debuginfo-4.2.1-bp151.5.3.1 libavdevice58-64bit-4.2.1-bp151.5.3.1 libavdevice58-64bit-debuginfo-4.2.1-bp151.5.3.1 libavfilter7-64bit-4.2.1-bp151.5.3.1 libavfilter7-64bit-debuginfo-4.2.1-bp151.5.3.1 libavformat58-64bit-4.2.1-bp151.5.3.1 libavformat58-64bit-debuginfo-4.2.1-bp151.5.3.1 libavresample4-64bit-4.2.1-bp151.5.3.1 libavresample4-64bit-debuginfo-4.2.1-bp151.5.3.1 libavutil56-64bit-4.2.1-bp151.5.3.1 libavutil56-64bit-debuginfo-4.2.1-bp151.5.3.1 libpostproc55-64bit-4.2.1-bp151.5.3.1 libpostproc55-64bit-debuginfo-4.2.1-bp151.5.3.1 libswresample3-64bit-4.2.1-bp151.5.3.1 libswresample3-64bit-debuginfo-4.2.1-bp151.5.3.1 libswscale5-64bit-4.2.1-bp151.5.3.1 libswscale5-64bit-debuginfo-4.2.1-bp151.5.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debugsource-4.2.1-bp150.24.1 ffmpeg-4-libavcodec-devel-4.2.1-bp150.24.1 ffmpeg-4-libavdevice-devel-4.2.1-bp150.24.1 ffmpeg-4-libavfilter-devel-4.2.1-bp150.24.1 ffmpeg-4-libavformat-devel-4.2.1-bp150.24.1 ffmpeg-4-libavresample-devel-4.2.1-bp150.24.1 ffmpeg-4-libavutil-devel-4.2.1-bp150.24.1 ffmpeg-4-libpostproc-devel-4.2.1-bp150.24.1 ffmpeg-4-libswresample-devel-4.2.1-bp150.24.1 ffmpeg-4-libswscale-devel-4.2.1-bp150.24.1 ffmpeg-4-private-devel-4.2.1-bp150.24.1 libavcodec58-4.2.1-bp150.24.1 libavcodec58-debuginfo-4.2.1-bp150.24.1 libavdevice58-4.2.1-bp150.24.1 libavdevice58-debuginfo-4.2.1-bp150.24.1 libavfilter7-4.2.1-bp150.24.1 libavfilter7-debuginfo-4.2.1-bp150.24.1 libavformat58-4.2.1-bp150.24.1 libavformat58-debuginfo-4.2.1-bp150.24.1 libavresample4-4.2.1-bp150.24.1 libavresample4-debuginfo-4.2.1-bp150.24.1 libavutil56-4.2.1-bp150.24.1 libavutil56-debuginfo-4.2.1-bp150.24.1 libpostproc55-4.2.1-bp150.24.1 libpostproc55-debuginfo-4.2.1-bp150.24.1 libswresample3-4.2.1-bp150.24.1 libswresample3-debuginfo-4.2.1-bp150.24.1 libswscale5-4.2.1-bp150.24.1 libswscale5-debuginfo-4.2.1-bp150.24.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libavcodec58-64bit-4.2.1-bp150.24.1 libavcodec58-64bit-debuginfo-4.2.1-bp150.24.1 libavdevice58-64bit-4.2.1-bp150.24.1 libavdevice58-64bit-debuginfo-4.2.1-bp150.24.1 libavfilter7-64bit-4.2.1-bp150.24.1 libavfilter7-64bit-debuginfo-4.2.1-bp150.24.1 libavformat58-64bit-4.2.1-bp150.24.1 libavformat58-64bit-debuginfo-4.2.1-bp150.24.1 libavresample4-64bit-4.2.1-bp150.24.1 libavresample4-64bit-debuginfo-4.2.1-bp150.24.1 libavutil56-64bit-4.2.1-bp150.24.1 libavutil56-64bit-debuginfo-4.2.1-bp150.24.1 libpostproc55-64bit-4.2.1-bp150.24.1 libpostproc55-64bit-debuginfo-4.2.1-bp150.24.1 libswresample3-64bit-4.2.1-bp150.24.1 libswresample3-64bit-debuginfo-4.2.1-bp150.24.1 libswscale5-64bit-4.2.1-bp150.24.1 libswscale5-64bit-debuginfo-4.2.1-bp150.24.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ffmpeg-4-libavcodec-devel-4.0.5-17.1 ffmpeg-4-libavdevice-devel-4.0.5-17.1 ffmpeg-4-libavfilter-devel-4.0.5-17.1 ffmpeg-4-libavformat-devel-4.0.5-17.1 ffmpeg-4-libavresample-devel-4.0.5-17.1 ffmpeg-4-libavutil-devel-4.0.5-17.1 ffmpeg-4-libpostproc-devel-4.0.5-17.1 ffmpeg-4-libswresample-devel-4.0.5-17.1 ffmpeg-4-libswscale-devel-4.0.5-17.1 ffmpeg-4-private-devel-4.0.5-17.1 libavcodec58-4.0.5-17.1 libavdevice58-4.0.5-17.1 libavfilter7-4.0.5-17.1 libavformat58-4.0.5-17.1 libavresample4-4.0.5-17.1 libavutil56-4.0.5-17.1 libpostproc55-4.0.5-17.1 libswresample3-4.0.5-17.1 libswscale5-4.0.5-17.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64_ilp32): libavcodec58-64bit-4.0.5-17.1 libavdevice58-64bit-4.0.5-17.1 libavfilter7-64bit-4.0.5-17.1 libavformat58-64bit-4.0.5-17.1 libavresample4-64bit-4.0.5-17.1 libavutil56-64bit-4.0.5-17.1 libpostproc55-64bit-4.0.5-17.1 libswresample3-64bit-4.0.5-17.1 libswscale5-64bit-4.0.5-17.1 References: https://www.suse.com/security/cve/CVE-2017-17555.html https://www.suse.com/security/cve/CVE-2018-13305.html https://www.suse.com/security/cve/CVE-2019-11338.html https://www.suse.com/security/cve/CVE-2019-11339.html https://www.suse.com/security/cve/CVE-2019-15942.html https://bugzilla.suse.com/1100345 https://bugzilla.suse.com/1133123 https://bugzilla.suse.com/1133153 https://bugzilla.suse.com/1133155 https://bugzilla.suse.com/1149839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0038-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0038-1 Rating: important References: #1139924 #1159723 #1159729 Cross-References: CVE-2019-10072 CVE-2019-12418 CVE-2019-17563 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tomcat to version 9.0.30 fixes the following issues: Security issue fixed: - CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723). - CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-38=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.30-lp151.3.6.1 tomcat-admin-webapps-9.0.30-lp151.3.6.1 tomcat-docs-webapp-9.0.30-lp151.3.6.1 tomcat-el-3_0-api-9.0.30-lp151.3.6.1 tomcat-embed-9.0.30-lp151.3.6.1 tomcat-javadoc-9.0.30-lp151.3.6.1 tomcat-jsp-2_3-api-9.0.30-lp151.3.6.1 tomcat-jsvc-9.0.30-lp151.3.6.1 tomcat-lib-9.0.30-lp151.3.6.1 tomcat-servlet-4_0-api-9.0.30-lp151.3.6.1 tomcat-webapps-9.0.30-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-10072.html https://www.suse.com/security/cve/CVE-2019-12418.html https://www.suse.com/security/cve/CVE-2019-17563.html https://bugzilla.suse.com/1139924 https://bugzilla.suse.com/1159723 https://bugzilla.suse.com/1159729 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0024-1: moderate: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0024-1 Rating: moderate References: #1100345 #1133123 #1133153 #1133155 #1149839 Cross-References: CVE-2017-17555 CVE-2018-13305 CVE-2019-11338 CVE-2019-11339 CVE-2019-15942 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ffmpeg-4 fixes the following issues: ffmpeg-4 was updated to version 4.0.5, fixes boo#1133153 - CVE-2019-11339: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 allowed remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified. (bsc#1133153) - For other changes see /usr/share/doc/packages/libavcodec58/Changelog Update to version 4.2.1: * Stable bug fix release, mainly codecs and format fixes. - CVE-2019-15942: Conditional jump or move depends on uninitialised value" issue in h2645_parse (boo#1149839) Update to FFmpeg 4.2 "Ada" * tpad filter * AV1 decoding support through libdav1d * dedot filter * chromashift and rgbashift filters * freezedetect filter * truehd_core bitstream filter * dhav demuxer * PCM-DVD encoder * GIF parser * vividas demuxer * hymt decoder * anlmdn filter * maskfun filter * hcom demuxer and decoder * ARBC decoder * libaribb24 based ARIB STD-B24 caption support (profiles A and C) * Support decoding of HEVC 4:4:4 content in nvdec and cuviddec * removed libndi-newtek * agm decoder * KUX demuxer * AV1 frame split bitstream filter * lscr decoder * lagfun filter * asoftclip filter * Support decoding of HEVC 4:4:4 content in vdpau * colorhold filter * xmedian filter * asr filter * showspatial multimedia filter * VP4 video decoder * IFV demuxer * derain filter * deesser filter * mov muxer writes tracks with unspecified language instead of English by default * added support for using clang to compile CUDA kernels - See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog. Update to version 4.1.4 * See /usr/share/doc/packages/ffmpeg-4/Changelog for the complete changelog. - Enable runtime enabling for fdkaac via --enable-libfdk-aac-dlopen Update to version 4.1.3: * Updates and bug fixes for codecs, filters and formats. [boo#1133153, boo#1133155, CVE-2019-11338, CVE-2019-11339] Update to version 4.1.2: * Updates and bug fixes for codecs, filters and formats. Update to version 4.1.1: * Various filter and codec fixes and enhancements. * configure: Add missing xlib dependency for VAAPI X11 code. * For complete changelog, see /usr/share/doc/packages/ffmpeg-4/Changelog * enable AV1 support on x86_64 Update ffmpeg to 4.1: * Lots of filter updates as usual: deblock, tmix, aplify, fftdnoiz, aderivative, aintegral, pal75bars, pal100bars, adeclick, adeclip, lensfun (wrapper), colorconstancy, 1D LUT filter (lut1d), cue, acue, transpose_npp, amultiply, Block-Matching 3d (bm3d) denoising filter, acrossover filter, audio denoiser as afftdn filter, sinc audio filter source, chromahold, setparams, vibrance, xstack, (a)graphmonitor filter yadif_cuda filter. * AV1 parser * Support for AV1 in MP4 * PCM VIDC decoder and encoder * libtensorflow backend for DNN based filters like srcnn * -- The following only enabled in third-party builds: * ATRAC9 decoder * AVS2 video decoder via libdavs2 * IMM4 video decoder * Brooktree ProSumer video decoder * MatchWare Screen Capture Codec decoder * WinCam Motion Video decoder * RemotelyAnywhere Screen Capture decoder * AVS2 video encoder via libxavs2 * ILBC decoder * SER demuxer * Decoding S12M timecode in H264 * For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1 Update ffmpeg to 4.0.3: * For complete changelog, see https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.0.3 - CVE-2018-13305: Added a missing check for negative values of mqaunt variable (boo#1100345). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-24=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ffmpeg-4-libavcodec-devel-4.0.5-17.1 ffmpeg-4-libavdevice-devel-4.0.5-17.1 ffmpeg-4-libavfilter-devel-4.0.5-17.1 ffmpeg-4-libavformat-devel-4.0.5-17.1 ffmpeg-4-libavresample-devel-4.0.5-17.1 ffmpeg-4-libavutil-devel-4.0.5-17.1 ffmpeg-4-libpostproc-devel-4.0.5-17.1 ffmpeg-4-libswresample-devel-4.0.5-17.1 ffmpeg-4-libswscale-devel-4.0.5-17.1 ffmpeg-4-private-devel-4.0.5-17.1 libavcodec58-4.0.5-17.1 libavdevice58-4.0.5-17.1 libavfilter7-4.0.5-17.1 libavformat58-4.0.5-17.1 libavresample4-4.0.5-17.1 libavutil56-4.0.5-17.1 libpostproc55-4.0.5-17.1 libswresample3-4.0.5-17.1 libswscale5-4.0.5-17.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64_ilp32): libavcodec58-64bit-4.0.5-17.1 libavdevice58-64bit-4.0.5-17.1 libavfilter7-64bit-4.0.5-17.1 libavformat58-64bit-4.0.5-17.1 libavresample4-64bit-4.0.5-17.1 libavutil56-64bit-4.0.5-17.1 libpostproc55-64bit-4.0.5-17.1 libswresample3-64bit-4.0.5-17.1 libswscale5-64bit-4.0.5-17.1 References: https://www.suse.com/security/cve/CVE-2017-17555.html https://www.suse.com/security/cve/CVE-2018-13305.html https://www.suse.com/security/cve/CVE-2019-11338.html https://www.suse.com/security/cve/CVE-2019-11339.html https://www.suse.com/security/cve/CVE-2019-15942.html https://bugzilla.suse.com/1100345 https://bugzilla.suse.com/1133123 https://bugzilla.suse.com/1133153 https://bugzilla.suse.com/1133155 https://bugzilla.suse.com/1149839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0011-1: important: Security update for xen
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0011-1 Rating: important References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for xen fixes the following issues: - CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307). - CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 (bsc#1158003 XSA-307). - CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest,leading to a guest denial of service (bsc#1158004 XSA-308). - CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309). - CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310). - CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311). - CVE-2019-19579: Fixed a privilege escaltion where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306). - Fixed an issue where PCI passthrough failed on AMD machine xen host (bsc#1157047). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-11=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.1_06-lp151.2.9.1 xen-devel-4.12.1_06-lp151.2.9.1 xen-libs-4.12.1_06-lp151.2.9.1 xen-libs-debuginfo-4.12.1_06-lp151.2.9.1 xen-tools-domU-4.12.1_06-lp151.2.9.1 xen-tools-domU-debuginfo-4.12.1_06-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.1_06-lp151.2.9.1 xen-doc-html-4.12.1_06-lp151.2.9.1 xen-libs-32bit-4.12.1_06-lp151.2.9.1 xen-libs-32bit-debuginfo-4.12.1_06-lp151.2.9.1 xen-tools-4.12.1_06-lp151.2.9.1 xen-tools-debuginfo-4.12.1_06-lp151.2.9.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0045-1: moderate: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0045-1 Rating: moderate References: #1122469 #1143349 #1150397 #1152308 #1153367 #1158590 Cross-References: CVE-2019-16884 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issue fixed: - CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308). Bug fixes: - Update to Docker 19.03.5-ce (bsc#1158590). - Update to Docker 19.03.3-ce (bsc#1153367). - Update to Docker 19.03.2-ce (bsc#1150397). - Fixed default installation such that --userns-remap=default works properly (bsc#1143349). - Fixed nginx blocked by apparmor (bsc#1122469). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-45=1 Package List: - openSUSE Leap 15.1 (noarch): docker-bash-completion-19.03.5_ce-lp151.2.15.1 docker-zsh-completion-19.03.5_ce-lp151.2.15.1 - openSUSE Leap 15.1 (x86_64): containerd-1.2.10-lp151.2.9.1 containerd-ctr-1.2.10-lp151.2.9.1 docker-19.03.5_ce-lp151.2.15.1 docker-debuginfo-19.03.5_ce-lp151.2.15.1 docker-libnetwork-0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1 docker-runc-1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.12.1 docker-runc-debuginfo-1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.12.1 docker-test-19.03.5_ce-lp151.2.15.1 docker-test-debuginfo-19.03.5_ce-lp151.2.15.1 golang-github-docker-libnetwork-0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-16884.html https://bugzilla.suse.com/1122469 https://bugzilla.suse.com/1143349 https://bugzilla.suse.com/1150397 https://bugzilla.suse.com/1152308 https://bugzilla.suse.com/1153367 https://bugzilla.suse.com/1158590 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0031-1: moderate: Security update for proftpd
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for proftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0031-1 Rating: moderate References: #1113041 #1144056 #1154600 #1155834 #1156210 #1157798 #1157803 Cross-References: CVE-2017-7418 CVE-2019-12815 CVE-2019-18217 CVE-2019-19269 CVE-2019-19270 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for proftpd fixes the following issues: * GeoIP has been discontinued by Maxmind (boo#1156210) This update removes module build for geoip see https://support.maxmind.com/geolite-legacy-discontinuation-notice/ - CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating the certificate of a client connecting to the server (boo#1157803) - CVE-2019-19270: Fixed a Failure to check for the appropriate field of a CRL entry prevents some valid CRLs from being taken into account (boo#1157798) - CVE-2019-18217: Fixed remote unauthenticated denial-of-service due to incorrect handling of overly long commands (boo#1154600 gh#846) Update to 1.3.6b * Fixed pre-authentication remote denial-of-service issue (Issue #846). * Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824). Update to 1.3.6a: * Fixed symlink navigation (Bug#4332). * Fixed building of mod_sftp using OpenSSL 1.1.x releases (Issue#674). * Fixed SITE COPY honoring of <Limit> restrictions (Bug#4372). * Fixed segfault on login when using mod_sftp + mod_sftp_pam (Issue#656). * Fixed restarts when using mod_facl as a static module * Add missing Requires(pre): group(ftp) for Leap 15 and Tumbleweed (boo#1155834) * Add missing Requires(pre): user(ftp) for Leap 15 and Tumbleweed (boo#1155834) * Use pam_keyinit.so (boo#1144056) - Reduce hard dependency on systemd to only that which is necessary for building and installation. update to 1.3.6: * Support for using Redis for caching, logging; see the doc/howto/Redis.html documentation. * Fixed mod_sql_postgres SSL support (Issue #415). * Support building against LibreSSL instead of OpenSSL (Issue #361). * Better support on AIX for login restraictions (Bug #4285). * TimeoutLogin (and other timeouts) were not working properly for SFTP connections (Bug#4299). * Handling of the SIGILL and SIGINT signals, by the daemon process, now causes the child processes to be terminated as well (Issue #461). * RPM .spec file naming changed to conform to Fedora guidelines. * Fix for "AllowChrootSymlinks off" checking each component for symlinks (CVE-2017-7418). New Modules: * mod_redis, mod_tls_redis, mod_wrap2_redis With Redis now supported as a caching mechanism, similar to Memcache, there are now Redis-using modules: mod_redis (for configuring the Redis connection information), mod_tls_redis (for caching SSL sessions and OCSP information using Redis), and mod_wrap2_redis (for using ACLs stored in Redis). Changed Modules: * mod_ban: The mod_ban module's BanCache directive can now use Redis-based caching; see doc/contrib/mod_ban.html#BanCache. -New Configuration Directives * SQLPasswordArgon2, SQLPasswordScrypt The key lengths for Argon2 and Scrypt-based passwords are now configurable via these new directives; previously, the key length had been hardcoded to be 32 bytes, which is not interoperable with all other implementations (Issue #454). Changed Configuration Directives * AllowChrootSymlinks When "AllowChrootSymlinks off" was used, only the last portion of the DefaultRoot path would be checked to see if it was a symlink. Now, each component of the DefaultRoot path will be checked to see if it is a symlink when "AllowChrootSymlinks off" is used. * Include The Include directive can now be used within a <Limit> section, e.g.: <Limit LOGIN> Include /path/to/allowed.txt DenyAll </Limit> API Changes * A new JSON API has been added, for use by third-party modules. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-31=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-31=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-31=1 Package List: - openSUSE Leap 15.1 (x86_64): proftpd-1.3.6b-lp151.3.6.1 proftpd-debuginfo-1.3.6b-lp151.3.6.1 proftpd-debugsource-1.3.6b-lp151.3.6.1 proftpd-devel-1.3.6b-lp151.3.6.1 proftpd-doc-1.3.6b-lp151.3.6.1 proftpd-ldap-1.3.6b-lp151.3.6.1 proftpd-ldap-debuginfo-1.3.6b-lp151.3.6.1 proftpd-mysql-1.3.6b-lp151.3.6.1 proftpd-mysql-debuginfo-1.3.6b-lp151.3.6.1 proftpd-pgsql-1.3.6b-lp151.3.6.1 proftpd-pgsql-debuginfo-1.3.6b-lp151.3.6.1 proftpd-radius-1.3.6b-lp151.3.6.1 proftpd-radius-debuginfo-1.3.6b-lp151.3.6.1 proftpd-sqlite-1.3.6b-lp151.3.6.1 proftpd-sqlite-debuginfo-1.3.6b-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): proftpd-lang-1.3.6b-lp151.3.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): proftpd-1.3.6b-bp151.4.6.2 proftpd-devel-1.3.6b-bp151.4.6.2 proftpd-doc-1.3.6b-bp151.4.6.2 proftpd-ldap-1.3.6b-bp151.4.6.2 proftpd-mysql-1.3.6b-bp151.4.6.2 proftpd-pgsql-1.3.6b-bp151.4.6.2 proftpd-radius-1.3.6b-bp151.4.6.2 proftpd-sqlite-1.3.6b-bp151.4.6.2 - openSUSE Backports SLE-15-SP1 (noarch): proftpd-lang-1.3.6b-bp151.4.6.2 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): proftpd-1.3.6b-bp150.3.6.1 proftpd-debuginfo-1.3.6b-bp150.3.6.1 proftpd-debugsource-1.3.6b-bp150.3.6.1 proftpd-devel-1.3.6b-bp150.3.6.1 proftpd-doc-1.3.6b-bp150.3.6.1 proftpd-ldap-1.3.6b-bp150.3.6.1 proftpd-ldap-debuginfo-1.3.6b-bp150.3.6.1 proftpd-mysql-1.3.6b-bp150.3.6.1 proftpd-mysql-debuginfo-1.3.6b-bp150.3.6.1 proftpd-pgsql-1.3.6b-bp150.3.6.1 proftpd-pgsql-debuginfo-1.3.6b-bp150.3.6.1 proftpd-radius-1.3.6b-bp150.3.6.1 proftpd-radius-debuginfo-1.3.6b-bp150.3.6.1 proftpd-sqlite-1.3.6b-bp150.3.6.1 proftpd-sqlite-debuginfo-1.3.6b-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): proftpd-lang-1.3.6b-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2017-7418.html https://www.suse.com/security/cve/CVE-2019-12815.html https://www.suse.com/security/cve/CVE-2019-18217.html https://www.suse.com/security/cve/CVE-2019-19269.html https://www.suse.com/security/cve/CVE-2019-19270.html https://bugzilla.suse.com/1113041 https://bugzilla.suse.com/1144056 https://bugzilla.suse.com/1154600 https://bugzilla.suse.com/1155834 https://bugzilla.suse.com/1156210 https://bugzilla.suse.com/1157798 https://bugzilla.suse.com/1157803 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0010-1: important: Security update for chromium, re2
by opensuse-security＠opensuse.org 13 Jan '20

13 Jan '20

openSUSE Security Update: Security update for chromium, re2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0010-1 Rating: important References: #1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707 CVE-2019-13708 CVE-2019-13709 CVE-2019-13710 CVE-2019-13711 CVE-2019-13713 CVE-2019-13714 CVE-2019-13715 CVE-2019-13716 CVE-2019-13717 CVE-2019-13718 CVE-2019-13719 CVE-2019-15903 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium, re2 fixes the following issues: Chromium was updated to 78.0.3904.70 boo#1154806: * CVE-2019-13699: Use-after-free in media * CVE-2019-13700: Buffer overrun in Blink * CVE-2019-13701: URL spoof in navigation * CVE-2019-13702: Privilege elevation in Installer * CVE-2019-13703: URL bar spoofing * CVE-2019-13704: CSP bypass * CVE-2019-13705: Extension permission bypass * CVE-2019-13706: Out-of-bounds read in PDFium * CVE-2019-13707: File storage disclosure * CVE-2019-13708: HTTP authentication spoof * CVE-2019-13709: File download protection bypass * CVE-2019-13710: File download protection bypass * CVE-2019-13711: Cross-context information leak * CVE-2019-15903: Buffer overflow in expat * CVE-2019-13713: Cross-origin data leak * CVE-2019-13714: CSS injection * CVE-2019-13715: Address bar spoofing * CVE-2019-13716: Service worker state error * CVE-2019-13717: Notification obscured * CVE-2019-13718: IDN spoof * CVE-2019-13719: Notification obscured * Various fixes from internal audits, fuzzing and other initiatives - Use internal resources for icon and appdata This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-10=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libre2-0-20190901-bp151.6.9.1 re2-devel-20190901-bp151.6.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-78.0.3904.70-bp151.3.50.1 chromedriver-debuginfo-78.0.3904.70-bp151.3.50.1 chromium-78.0.3904.70-bp151.3.50.1 chromium-debuginfo-78.0.3904.70-bp151.3.50.1 chromium-debugsource-78.0.3904.70-bp151.3.50.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-0-64bit-20190901-bp151.6.9.1 References: https://www.suse.com/security/cve/CVE-2019-13699.html https://www.suse.com/security/cve/CVE-2019-13700.html https://www.suse.com/security/cve/CVE-2019-13701.html https://www.suse.com/security/cve/CVE-2019-13702.html https://www.suse.com/security/cve/CVE-2019-13703.html https://www.suse.com/security/cve/CVE-2019-13704.html https://www.suse.com/security/cve/CVE-2019-13705.html https://www.suse.com/security/cve/CVE-2019-13706.html https://www.suse.com/security/cve/CVE-2019-13707.html https://www.suse.com/security/cve/CVE-2019-13708.html https://www.suse.com/security/cve/CVE-2019-13709.html https://www.suse.com/security/cve/CVE-2019-13710.html https://www.suse.com/security/cve/CVE-2019-13711.html https://www.suse.com/security/cve/CVE-2019-13713.html https://www.suse.com/security/cve/CVE-2019-13714.html https://www.suse.com/security/cve/CVE-2019-13715.html https://www.suse.com/security/cve/CVE-2019-13716.html https://www.suse.com/security/cve/CVE-2019-13717.html https://www.suse.com/security/cve/CVE-2019-13718.html https://www.suse.com/security/cve/CVE-2019-13719.html https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1154806 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0009-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Jan '20

12 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0009-1 Rating: important References: #1160337 Cross-References: CVE-2019-5844 CVE-2019-5845 CVE-2019-5846 CVE-2020-6377 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium version 79.0.3945.117 fixes the following issues: - CVE-2020-6377: Fixed a use-after-free in audio - Various fixes from internal audits, fuzzing and other initiatives This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-9=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libre2-0-20200101-bp151.6.6.1 libre2-0-debuginfo-20200101-bp151.6.6.1 re2-debugsource-20200101-bp151.6.6.1 re2-devel-20200101-bp151.6.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.117-bp151.3.47.1 chromium-79.0.3945.117-bp151.3.47.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-0-64bit-20200101-bp151.6.6.1 libre2-0-64bit-debuginfo-20200101-bp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2019-5844.html https://www.suse.com/security/cve/CVE-2019-5845.html https://www.suse.com/security/cve/CVE-2019-5846.html https://www.suse.com/security/cve/CVE-2020-6377.html https://bugzilla.suse.com/1160337 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0008-1: moderate: Security update for mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 11 Jan '20

11 Jan '20

openSUSE Security Update: Security update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0008-1 Rating: moderate References: #1141322 #1158527 #1159819 Cross-References: CVE-2018-18508 CVE-2019-11745 CVE-2019-17006 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to NSS 3.47.1: Security issues fixed: - CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819). - CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527). - CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322). mozilla-nspr was updated to version 4.23: - Whitespace in C files was cleaned up and no longer uses tab characters for indenting. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-8=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.47.1-lp151.2.9.1 libfreebl3-debuginfo-3.47.1-lp151.2.9.1 libfreebl3-hmac-3.47.1-lp151.2.9.1 libsoftokn3-3.47.1-lp151.2.9.1 libsoftokn3-debuginfo-3.47.1-lp151.2.9.1 libsoftokn3-hmac-3.47.1-lp151.2.9.1 mozilla-nspr-4.23-lp151.2.6.1 mozilla-nspr-debuginfo-4.23-lp151.2.6.1 mozilla-nspr-debugsource-4.23-lp151.2.6.1 mozilla-nspr-devel-4.23-lp151.2.6.1 mozilla-nss-3.47.1-lp151.2.9.1 mozilla-nss-certs-3.47.1-lp151.2.9.1 mozilla-nss-certs-debuginfo-3.47.1-lp151.2.9.1 mozilla-nss-debuginfo-3.47.1-lp151.2.9.1 mozilla-nss-debugsource-3.47.1-lp151.2.9.1 mozilla-nss-devel-3.47.1-lp151.2.9.1 mozilla-nss-sysinit-3.47.1-lp151.2.9.1 mozilla-nss-sysinit-debuginfo-3.47.1-lp151.2.9.1 mozilla-nss-tools-3.47.1-lp151.2.9.1 mozilla-nss-tools-debuginfo-3.47.1-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): libfreebl3-32bit-3.47.1-lp151.2.9.1 libfreebl3-32bit-debuginfo-3.47.1-lp151.2.9.1 libfreebl3-hmac-32bit-3.47.1-lp151.2.9.1 libsoftokn3-32bit-3.47.1-lp151.2.9.1 libsoftokn3-32bit-debuginfo-3.47.1-lp151.2.9.1 libsoftokn3-hmac-32bit-3.47.1-lp151.2.9.1 mozilla-nspr-32bit-4.23-lp151.2.6.1 mozilla-nspr-32bit-debuginfo-4.23-lp151.2.6.1 mozilla-nss-32bit-3.47.1-lp151.2.9.1 mozilla-nss-32bit-debuginfo-3.47.1-lp151.2.9.1 mozilla-nss-certs-32bit-3.47.1-lp151.2.9.1 mozilla-nss-certs-32bit-debuginfo-3.47.1-lp151.2.9.1 mozilla-nss-sysinit-32bit-3.47.1-lp151.2.9.1 mozilla-nss-sysinit-32bit-debuginfo-3.47.1-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-18508.html https://www.suse.com/security/cve/CVE-2019-11745.html https://www.suse.com/security/cve/CVE-2019-17006.html https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1158527 https://bugzilla.suse.com/1159819 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0