October 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1616-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 05 Oct '20

05 Oct '20

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1616-1 Rating: important References: #1172686 #1173937 #1176589 #1176605 Cross-References: CVE-2020-15095 CVE-2020-8201 CVE-2020-8252 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for nodejs12 fixes the following issues: - nodejs12 was updated to 12.18.4 LTS: - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605). - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589). - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937). - Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1616=1 Package List: - openSUSE Leap 15.2 (x86_64): nodejs12-12.18.4-lp152.3.6.1 nodejs12-debuginfo-12.18.4-lp152.3.6.1 nodejs12-debugsource-12.18.4-lp152.3.6.1 nodejs12-devel-12.18.4-lp152.3.6.1 npm12-12.18.4-lp152.3.6.1 - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.18.4-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-15095.html https://www.suse.com/security/cve/CVE-2020-8201.html https://www.suse.com/security/cve/CVE-2020-8252.html https://bugzilla.suse.com/1172686 https://bugzilla.suse.com/1173937 https://bugzilla.suse.com/1176589 https://bugzilla.suse.com/1176605 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1613-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1613-1 Rating: moderate References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pip fixes the following issues: - CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1613=1 Package List: - openSUSE Leap 15.1 (noarch): python2-pip-10.0.1-lp151.3.3.1 python3-pip-10.0.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1611-1: moderate: Security update for grafana
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for grafana ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1611-1 Rating: moderate References: #1044444 #1044933 #1115960 #1170557 Cross-References: CVE-2018-19039 CVE-2019-15043 CVE-2020-12245 CVE-2020-13379 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for grafana fixes the following issues: grafana was updated to version 7.1.5: * Features / Enhancements - Stats: Stop counting the same user multiple times. - Field overrides: Filter by field name using regex. - AzureMonitor: map more units. - Explore: Don't run queries on datasource change. - Graph: Support setting field unit & override data source (automatic) unit. - Explore: Unification of logs/metrics/traces user interface - Table: JSON Cell should try to convert strings to JSON - Variables: enables cancel for slow query variables queries. - TimeZone: unify the time zone pickers to one that can rule them all. - Search: support URL query params. - Grafana-UI: Add FileUpload. - TablePanel: Sort numbers correctly. * Bug fixes - Alerting: remove LongToWide call in alerting. - AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used. - Variables: Fixes issue with All variable not being resolved. - Templating: Fixes so texts show in picker not the values. - Templating: Templating: Fix undefined result when using raw interpolation format - TextPanel: Fix content overflowing panel boundaries. - StatPanel: Fix stat panel display name not showing when explicitly set. - Query history: Fix search filtering if null value. - Flux: Ensure connections to InfluxDB are closed. - Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything). - Prometheus: Fix prom links in mixed mode. - Sign In Use correct url for the Sign In button. - StatPanel: Fixes issue with name showing for single series / field results - BarGauge: Fix space bug in single series mode. - Auth: Fix POST request failures with anonymous access - Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable - Templating: Fixed recursive queries triggered when switching dashboard settings view - GraphPanel: Fix annotations overflowing panels. - Prometheus: Fix performance issue in processing of histogram labels. - Datasources: Handle URL parsing error. - Security: Use Header.Set and Header.Del for X-Grafana-User header. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1611=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): grafana-7.1.5-bp151.2.1 References: https://www.suse.com/security/cve/CVE-2018-19039.html https://www.suse.com/security/cve/CVE-2019-15043.html https://www.suse.com/security/cve/CVE-2020-12245.html https://www.suse.com/security/cve/CVE-2020-13379.html https://bugzilla.suse.com/1044444 https://bugzilla.suse.com/1044933 https://bugzilla.suse.com/1115960 https://bugzilla.suse.com/1170557 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1608-1: important: Security update for xen
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1608-1 Rating: important References: #1027519 #1176339 #1176341 #1176343 #1176344 #1176345 #1176346 #1176347 #1176348 #1176349 #1176350 Cross-References: CVE-2020-25595 CVE-2020-25596 CVE-2020-25597 CVE-2020-25598 CVE-2020-25599 CVE-2020-25600 CVE-2020-25601 CVE-2020-25602 CVE-2020-25603 CVE-2020-25604 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2020-25602: Fixed an issue where there was a crash when handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333) - CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path (bsc#1176341,XSA-334) - CVE-2020-25604: Fixed a race condition when migrating timers between x86 HVM vCPU-s (bsc#1176343,XSA-336) - CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337) - CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338) - CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339) - CVE-2020-25603: Fixed an issue due to missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340) - CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342) - CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343) - CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344) - Various other fixes (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1608=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.1_08-lp152.2.9.1 xen-devel-4.13.1_08-lp152.2.9.1 xen-libs-4.13.1_08-lp152.2.9.1 xen-libs-debuginfo-4.13.1_08-lp152.2.9.1 xen-tools-domU-4.13.1_08-lp152.2.9.1 xen-tools-domU-debuginfo-4.13.1_08-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.1_08-lp152.2.9.1 xen-doc-html-4.13.1_08-lp152.2.9.1 xen-libs-32bit-4.13.1_08-lp152.2.9.1 xen-libs-32bit-debuginfo-4.13.1_08-lp152.2.9.1 xen-tools-4.13.1_08-lp152.2.9.1 xen-tools-debuginfo-4.13.1_08-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.1_08-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-25595.html https://www.suse.com/security/cve/CVE-2020-25596.html https://www.suse.com/security/cve/CVE-2020-25597.html https://www.suse.com/security/cve/CVE-2020-25598.html https://www.suse.com/security/cve/CVE-2020-25599.html https://www.suse.com/security/cve/CVE-2020-25600.html https://www.suse.com/security/cve/CVE-2020-25601.html https://www.suse.com/security/cve/CVE-2020-25602.html https://www.suse.com/security/cve/CVE-2020-25603.html https://www.suse.com/security/cve/CVE-2020-25604.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176339 https://bugzilla.suse.com/1176341 https://bugzilla.suse.com/1176343 https://bugzilla.suse.com/1176344 https://bugzilla.suse.com/1176345 https://bugzilla.suse.com/1176346 https://bugzilla.suse.com/1176347 https://bugzilla.suse.com/1176348 https://bugzilla.suse.com/1176349 https://bugzilla.suse.com/1176350 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1604-1: moderate: Security update for zabbix
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for zabbix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1604-1 Rating: moderate References: #1174253 Cross-References: CVE-2020-11800 CVE-2020-15803 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zabbix fixes the following issues: Updated to version 3.0.31. + CVE-2020-15803: Fixed an XSS in the URL Widget (boo#1174253). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1604=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1604=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1604=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1604=1 Package List: - openSUSE Leap 15.2 (noarch): zabbix-bash-completion-3.0.31-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): zabbix-agent-3.0.31-lp152.2.3.1 zabbix-agent-debuginfo-3.0.31-lp152.2.3.1 zabbix-debuginfo-3.0.31-lp152.2.3.1 zabbix-debugsource-3.0.31-lp152.2.3.1 zabbix-java-gateway-3.0.31-lp152.2.3.1 zabbix-phpfrontend-3.0.31-lp152.2.3.1 zabbix-proxy-3.0.31-lp152.2.3.1 zabbix-proxy-mysql-3.0.31-lp152.2.3.1 zabbix-proxy-mysql-debuginfo-3.0.31-lp152.2.3.1 zabbix-proxy-postgresql-3.0.31-lp152.2.3.1 zabbix-proxy-postgresql-debuginfo-3.0.31-lp152.2.3.1 zabbix-proxy-sqlite-3.0.31-lp152.2.3.1 zabbix-proxy-sqlite-debuginfo-3.0.31-lp152.2.3.1 zabbix-server-3.0.31-lp152.2.3.1 zabbix-server-debuginfo-3.0.31-lp152.2.3.1 zabbix-server-mysql-3.0.31-lp152.2.3.1 zabbix-server-mysql-debuginfo-3.0.31-lp152.2.3.1 zabbix-server-postgresql-3.0.31-lp152.2.3.1 zabbix-server-postgresql-debuginfo-3.0.31-lp152.2.3.1 zabbix-server-sqlite-3.0.31-lp152.2.3.1 zabbix-server-sqlite-debuginfo-3.0.31-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): zabbix-agent-3.0.31-lp151.2.6.1 zabbix-agent-debuginfo-3.0.31-lp151.2.6.1 zabbix-debuginfo-3.0.31-lp151.2.6.1 zabbix-debugsource-3.0.31-lp151.2.6.1 zabbix-java-gateway-3.0.31-lp151.2.6.1 zabbix-phpfrontend-3.0.31-lp151.2.6.1 zabbix-proxy-3.0.31-lp151.2.6.1 zabbix-proxy-mysql-3.0.31-lp151.2.6.1 zabbix-proxy-mysql-debuginfo-3.0.31-lp151.2.6.1 zabbix-proxy-postgresql-3.0.31-lp151.2.6.1 zabbix-proxy-postgresql-debuginfo-3.0.31-lp151.2.6.1 zabbix-proxy-sqlite-3.0.31-lp151.2.6.1 zabbix-proxy-sqlite-debuginfo-3.0.31-lp151.2.6.1 zabbix-server-3.0.31-lp151.2.6.1 zabbix-server-debuginfo-3.0.31-lp151.2.6.1 zabbix-server-mysql-3.0.31-lp151.2.6.1 zabbix-server-mysql-debuginfo-3.0.31-lp151.2.6.1 zabbix-server-postgresql-3.0.31-lp151.2.6.1 zabbix-server-postgresql-debuginfo-3.0.31-lp151.2.6.1 zabbix-server-sqlite-3.0.31-lp151.2.6.1 zabbix-server-sqlite-debuginfo-3.0.31-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): zabbix-bash-completion-3.0.31-lp151.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): zabbix-agent-3.0.31-bp152.2.3.1 zabbix-agent-debuginfo-3.0.31-bp152.2.3.1 zabbix-debuginfo-3.0.31-bp152.2.3.1 zabbix-debugsource-3.0.31-bp152.2.3.1 zabbix-java-gateway-3.0.31-bp152.2.3.1 zabbix-phpfrontend-3.0.31-bp152.2.3.1 zabbix-proxy-3.0.31-bp152.2.3.1 zabbix-proxy-mysql-3.0.31-bp152.2.3.1 zabbix-proxy-mysql-debuginfo-3.0.31-bp152.2.3.1 zabbix-proxy-postgresql-3.0.31-bp152.2.3.1 zabbix-proxy-postgresql-debuginfo-3.0.31-bp152.2.3.1 zabbix-proxy-sqlite-3.0.31-bp152.2.3.1 zabbix-proxy-sqlite-debuginfo-3.0.31-bp152.2.3.1 zabbix-server-3.0.31-bp152.2.3.1 zabbix-server-debuginfo-3.0.31-bp152.2.3.1 zabbix-server-mysql-3.0.31-bp152.2.3.1 zabbix-server-mysql-debuginfo-3.0.31-bp152.2.3.1 zabbix-server-postgresql-3.0.31-bp152.2.3.1 zabbix-server-postgresql-debuginfo-3.0.31-bp152.2.3.1 zabbix-server-sqlite-3.0.31-bp152.2.3.1 zabbix-server-sqlite-debuginfo-3.0.31-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): zabbix-bash-completion-3.0.31-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): zabbix-agent-3.0.31-bp151.4.6.1 zabbix-java-gateway-3.0.31-bp151.4.6.1 zabbix-phpfrontend-3.0.31-bp151.4.6.1 zabbix-proxy-3.0.31-bp151.4.6.1 zabbix-proxy-mysql-3.0.31-bp151.4.6.1 zabbix-proxy-postgresql-3.0.31-bp151.4.6.1 zabbix-proxy-sqlite-3.0.31-bp151.4.6.1 zabbix-server-3.0.31-bp151.4.6.1 zabbix-server-mysql-3.0.31-bp151.4.6.1 zabbix-server-postgresql-3.0.31-bp151.4.6.1 zabbix-server-sqlite-3.0.31-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): zabbix-bash-completion-3.0.31-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-11800.html https://www.suse.com/security/cve/CVE-2020-15803.html https://bugzilla.suse.com/1174253 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1599-1: critical: Security update for dpdk
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1599-1 Rating: critical References: #1176590 Cross-References: CVE-2020-14374 CVE-2020-14375 CVE-2020-14376 CVE-2020-14377 CVE-2020-14378 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - dpdk was updated to 19.11.4 - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590). - For a list of fixes check: https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8 denial of service in the host (bsc#1176590). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1599=1 Package List: - openSUSE Leap 15.2 (x86_64): dpdk-19.11.4-lp152.2.8.1 dpdk-debuginfo-19.11.4-lp152.2.8.1 dpdk-debugsource-19.11.4-lp152.2.8.1 dpdk-devel-19.11.4-lp152.2.8.1 dpdk-devel-debuginfo-19.11.4-lp152.2.8.1 dpdk-examples-19.11.4-lp152.2.8.1 dpdk-examples-debuginfo-19.11.4-lp152.2.8.1 dpdk-kmp-default-19.11.4_k5.3.18_lp152.41-lp152.2.8.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_lp152.41-lp152.2.8.1 dpdk-kmp-preempt-19.11.4_k5.3.18_lp152.41-lp152.2.8.1 dpdk-kmp-preempt-debuginfo-19.11.4_k5.3.18_lp152.41-lp152.2.8.1 dpdk-tools-19.11.4-lp152.2.8.1 dpdk-tools-debuginfo-19.11.4-lp152.2.8.1 libdpdk-20_0-19.11.4-lp152.2.8.1 libdpdk-20_0-debuginfo-19.11.4-lp152.2.8.1 - openSUSE Leap 15.2 (noarch): dpdk-doc-19.11.4-lp152.2.8.1 References: https://www.suse.com/security/cve/CVE-2020-14374.html https://www.suse.com/security/cve/CVE-2020-14375.html https://www.suse.com/security/cve/CVE-2020-14376.html https://www.suse.com/security/cve/CVE-2020-14377.html https://www.suse.com/security/cve/CVE-2020-14378.html https://bugzilla.suse.com/1176590 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1598-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 04 Oct '20

04 Oct '20

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1598-1 Rating: moderate References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pip fixes the following issues: - CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1598=1 Package List: - openSUSE Leap 15.2 (noarch): python2-pip-10.0.1-lp152.4.3.1 python3-pip-10.0.1-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1593-1: critical: Security update for dpdk
by opensuse-security＠opensuse.org 03 Oct '20

03 Oct '20

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1593-1 Rating: critical References: #1176590 Cross-References: CVE-2020-14374 CVE-2020-14375 CVE-2020-14376 CVE-2020-14377 CVE-2020-14378 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - dpdk was updated to 18.11.9. For a list of fixes check: - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590). For a list of fixes check: https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1593=1 Package List: - openSUSE Leap 15.1 (x86_64): dpdk-18.11.9-lp151.3.8.1 dpdk-debuginfo-18.11.9-lp151.3.8.1 dpdk-debugsource-18.11.9-lp151.3.8.1 dpdk-devel-18.11.9-lp151.3.8.1 dpdk-devel-debuginfo-18.11.9-lp151.3.8.1 dpdk-examples-18.11.9-lp151.3.8.1 dpdk-examples-debuginfo-18.11.9-lp151.3.8.1 dpdk-kmp-default-18.11.9_k4.12.14_lp151.28.67-lp151.3.8.1 dpdk-kmp-default-debuginfo-18.11.9_k4.12.14_lp151.28.67-lp151.3.8.1 dpdk-tools-18.11.9-lp151.3.8.1 dpdk-tools-debuginfo-18.11.9-lp151.3.8.1 libdpdk-18_11-18.11.9-lp151.3.8.1 libdpdk-18_11-debuginfo-18.11.9-lp151.3.8.1 - openSUSE Leap 15.1 (noarch): dpdk-doc-18.11.9-lp151.3.8.1 References: https://www.suse.com/security/cve/CVE-2020-14374.html https://www.suse.com/security/cve/CVE-2020-14375.html https://www.suse.com/security/cve/CVE-2020-14376.html https://www.suse.com/security/cve/CVE-2020-14377.html https://www.suse.com/security/cve/CVE-2020-14378.html https://bugzilla.suse.com/1176590 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1591-1: moderate: Security update for bcm43xx-firmware
by opensuse-security＠opensuse.org 03 Oct '20

03 Oct '20

openSUSE Security Update: Security update for bcm43xx-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1591-1 Rating: moderate References: #1176631 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for bcm43xx-firmware fixes the following issues: - Update bluetooth firmware to address Sweyntooth and Spectra issues (bsc#1176631): This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1591=1 Package List: - openSUSE Leap 15.1 (noarch): bcm43xx-firmware-20180314-lp151.6.3.1 References: https://bugzilla.suse.com/1176631 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1587-1: moderate: Security update for go1.14
by opensuse-security＠opensuse.org 02 Oct '20

02 Oct '20

openSUSE Security Update: Security update for go1.14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1587-1 Rating: moderate References: #1164903 #1176031 Cross-References: CVE-2020-24553 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.14 fixes the following issues: - go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. Refs bsc#1164903 go1.14 release tracking * go#41192 net/http/fcgi: race detected during execution of TestResponseWriterSniffsContentType test * go#41016 net/http: Transport.CancelRequest no longer cancels in-flight request * go#40973 net/http: RoundTrip unexpectedly changes Request * go#40968 runtime: checkptr incorrectly -race flagging when using &^ arithmetic * go#40938 cmd/compile: R12 can be clobbered for write barrier call on PPC64 * go#40848 testing: "=== PAUSE" lines do not change the test name for the next log line * go#40797 cmd/compile: inline marker targets not reachable after assembly on arm * go#40766 cmd/compile: inline marker targets not reachable after assembly on ppc64x * go#40501 cmd/compile: for range loop reading past slice end * go#40411 runtime: Windows service lifecycle events behave incorrectly when called within a golang environment * go#40398 runtime: fatal error: checkdead: runnable g * go#40192 runtime: pageAlloc.searchAddr may point to unmapped memory in discontiguous heaps, violating its invariant * go#39955 cmd/link: incorrect GC bitmap when global's type is in another shared object * go#39690 cmd/compile: s390x floating point <-> integer conversions clobbering the condition code * go#39279 net/http: Re-connect with upgraded HTTP2 connection fails to send Request.body * go#38904 doc: include fix for #34437 in Go 1.14 release notes - go1.14.8 (released 2020-09-01) includes security fixes to the net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903 go1.14 release tracking * bsc#1176031 CVE-2020-24553 * go#41164 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specified This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1587=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.14-1.14.9-lp152.2.6.1 go1.14-doc-1.14.9-lp152.2.6.1 go1.14-race-1.14.9-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-24553.html https://bugzilla.suse.com/1164903 https://bugzilla.suse.com/1176031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0