November 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1876-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1876-1 Rating: moderate References: #1177895 Cross-References: CVE-2020-27153 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2020-27153: Fixed possible crash on disconnect (bsc#1177895). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1876=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bluez-5.48-lp151.8.15.1 bluez-cups-5.48-lp151.8.15.1 bluez-cups-debuginfo-5.48-lp151.8.15.1 bluez-debuginfo-5.48-lp151.8.15.1 bluez-debugsource-5.48-lp151.8.15.1 bluez-devel-5.48-lp151.8.15.1 bluez-test-5.48-lp151.8.15.1 bluez-test-debuginfo-5.48-lp151.8.15.1 libbluetooth3-5.48-lp151.8.15.1 libbluetooth3-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (x86_64): bluez-devel-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-5.48-lp151.8.15.1 libbluetooth3-32bit-debuginfo-5.48-lp151.8.15.1 - openSUSE Leap 15.1 (noarch): bluez-auto-enable-devices-5.48-lp151.8.15.1 References: https://www.suse.com/security/cve/CVE-2020-27153.html https://bugzilla.suse.com/1177895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1875-1: important: Security update for apache-commons-httpclient
by opensuse-security＠opensuse.org 08 Nov '20

08 Nov '20

openSUSE Security Update: Security update for apache-commons-httpclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1875-1 Rating: important References: #1178171 #945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1875=1 Package List: - openSUSE Leap 15.2 (noarch): apache-commons-httpclient-3.1-lp152.6.3.1 apache-commons-httpclient-demo-3.1-lp152.6.3.1 apache-commons-httpclient-javadoc-3.1-lp152.6.3.1 apache-commons-httpclient-manual-3.1-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2014-3577.html https://www.suse.com/security/cve/CVE-2015-5262.html https://bugzilla.suse.com/1178171 https://bugzilla.suse.com/945190 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1873-1: important: Security update for apache-commons-httpclient
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for apache-commons-httpclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1873-1 Rating: important References: #1178171 #945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors. [bsc#945190, CVE-2015-5262] - org.apache.http.conn.ssl.AbstractVerifier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows MITM attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate. [bsc#1178171, CVE-2014-3577] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1873=1 Package List: - openSUSE Leap 15.1 (noarch): apache-commons-httpclient-3.1-lp151.4.3.1 apache-commons-httpclient-demo-3.1-lp151.4.3.1 apache-commons-httpclient-javadoc-3.1-lp151.4.3.1 apache-commons-httpclient-manual-3.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2014-3577.html https://www.suse.com/security/cve/CVE-2015-5262.html https://bugzilla.suse.com/1178171 https://bugzilla.suse.com/945190 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1870-1: moderate: Security update for sddm
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for sddm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1870-1 Rating: moderate References: #1177201 Cross-References: CVE-2020-28049 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sddm fixes the following issue: - Fix X not having access control on startup (boo#1177201, CVE-2020-28049). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1870=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1870=1 Package List: - openSUSE Leap 15.2 (x86_64): sddm-0.18.0-lp152.5.3.1 sddm-branding-openSUSE-0.18.0-lp152.5.3.1 sddm-branding-upstream-0.18.0-lp152.5.3.1 sddm-debuginfo-0.18.0-lp152.5.3.1 sddm-debugsource-0.18.0-lp152.5.3.1 - openSUSE Leap 15.1 (x86_64): sddm-0.18.0-lp151.3.6.1 sddm-branding-openSUSE-0.18.0-lp151.3.6.1 sddm-branding-upstream-0.18.0-lp151.3.6.1 sddm-debuginfo-0.18.0-lp151.3.6.1 sddm-debugsource-0.18.0-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-28049.html https://bugzilla.suse.com/1177201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1869-1: important: Security update for u-boot
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1869-1 Rating: important References: #1162198 #1167209 Cross-References: CVE-2020-10648 CVE-2020-8432 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: - CVE-2020-8432: Fixed a double free in the cmd/gpt.c do_rename_gpt_parts() function, which allowed an attacker to execute arbitrary code (bsc#1162198) - CVE-2020-10648: Fixed improper signature verification during verified boot (bsc#1167209). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1869=1 Package List: - openSUSE Leap 15.2 (x86_64): u-boot-tools-2020.01-lp152.9.9.1 u-boot-tools-debuginfo-2020.01-lp152.9.9.1 References: https://www.suse.com/security/cve/CVE-2020-10648.html https://www.suse.com/security/cve/CVE-2020-8432.html https://bugzilla.suse.com/1162198 https://bugzilla.suse.com/1167209 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1868-1: critical: Security update for salt
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1868-1 Rating: critical References: #1159670 #1175987 #1176024 #1176294 #1176397 #1177867 #1178319 #1178361 #1178362 #1178485 Cross-References: CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes the following issues: - Avoid regression on "salt-master": set passphrase for salt-ssh keys to empty string (bsc#1178485) - Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846) - Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867) - Ensure virt.update stop_on_reboot is updated with its default value. - Do not break package building for systemd OSes. - Drop wrong mock from chroot unit test. - Support systemd versions with dot. (bsc#1176294) - Fix for grains.test_core unit test. - Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024) - Several changes to virtualization: * Fix virt update when cpu and memory are changed. * Memory Tuning GSoC. * Properly fix memory setting regression in virt.update. * Expose libvirt on_reboot in virt states. - Support transactional systems (MicroOS). - zypperpkg module ignores retcode 104 for search(). (bsc#1159670) - Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987) - Invalidate file list cache when cache file modified time is in the future. (bsc#1176397) - Prevent import errors when running test_btrfs unit tests This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1868=1 Package List: - openSUSE Leap 15.1 (noarch): salt-bash-completion-3000-lp151.5.30.1 salt-fish-completion-3000-lp151.5.30.1 salt-zsh-completion-3000-lp151.5.30.1 - openSUSE Leap 15.1 (x86_64): python2-salt-3000-lp151.5.30.1 python3-salt-3000-lp151.5.30.1 salt-3000-lp151.5.30.1 salt-api-3000-lp151.5.30.1 salt-cloud-3000-lp151.5.30.1 salt-doc-3000-lp151.5.30.1 salt-master-3000-lp151.5.30.1 salt-minion-3000-lp151.5.30.1 salt-proxy-3000-lp151.5.30.1 salt-ssh-3000-lp151.5.30.1 salt-standalone-formulas-configuration-3000-lp151.5.30.1 salt-syndic-3000-lp151.5.30.1 References: https://www.suse.com/security/cve/CVE-2020-16846.html https://www.suse.com/security/cve/CVE-2020-17490.html https://www.suse.com/security/cve/CVE-2020-25592.html https://bugzilla.suse.com/1159670 https://bugzilla.suse.com/1175987 https://bugzilla.suse.com/1176024 https://bugzilla.suse.com/1176294 https://bugzilla.suse.com/1176397 https://bugzilla.suse.com/1177867 https://bugzilla.suse.com/1178319 https://bugzilla.suse.com/1178361 https://bugzilla.suse.com/1178362 https://bugzilla.suse.com/1178485 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1861-1: moderate: Security update for gnome-settings-daemon, gnome-shell
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for gnome-settings-daemon, gnome-shell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1861-1 Rating: moderate References: #1172760 #1175155 Cross-References: CVE-2020-17489 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gnome-settings-daemon, gnome-shell fixes the following issues: gnome-settings-daemon: - Add support for recent UCM related changes in ALSA and PulseAudio. (jsc#SLE-16518) - Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. (jsc#SLE-16518) - Don't warn about starting/stopping services which don't exist. (bsc#1172760). gnome-shell: - Add support for recent UCM related changes in ALSA and PulseAudio. (jsc#SLE-16518) - CVE-2020-17489: reset auth prompt on vt switch before fade in in loginDialog (bsc#1175155). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1861=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-settings-daemon-lang-3.34.2+0-lp152.3.3.1 gnome-shell-lang-3.34.5-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): gnome-settings-daemon-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-debuginfo-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-debugsource-3.34.2+0-lp152.3.3.1 gnome-settings-daemon-devel-3.34.2+0-lp152.3.3.1 gnome-shell-3.34.5-lp152.2.9.1 gnome-shell-calendar-3.34.5-lp152.2.9.1 gnome-shell-calendar-debuginfo-3.34.5-lp152.2.9.1 gnome-shell-debuginfo-3.34.5-lp152.2.9.1 gnome-shell-debugsource-3.34.5-lp152.2.9.1 gnome-shell-devel-3.34.5-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-17489.html https://bugzilla.suse.com/1172760 https://bugzilla.suse.com/1175155 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1859-1: moderate: Security update for python
by opensuse-security＠opensuse.org 07 Nov '20

07 Nov '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1859-1 Rating: moderate References: #1177211 Cross-References: CVE-2020-26116 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: - bsc#1177211 (CVE-2020-26116) no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1859=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.17-lp151.10.25.1 libpython2_7-1_0-debuginfo-2.7.17-lp151.10.25.1 python-2.7.17-lp151.10.25.1 python-base-2.7.17-lp151.10.25.1 python-base-debuginfo-2.7.17-lp151.10.25.1 python-base-debugsource-2.7.17-lp151.10.25.1 python-curses-2.7.17-lp151.10.25.1 python-curses-debuginfo-2.7.17-lp151.10.25.1 python-debuginfo-2.7.17-lp151.10.25.1 python-debugsource-2.7.17-lp151.10.25.1 python-demo-2.7.17-lp151.10.25.1 python-devel-2.7.17-lp151.10.25.1 python-gdbm-2.7.17-lp151.10.25.1 python-gdbm-debuginfo-2.7.17-lp151.10.25.1 python-idle-2.7.17-lp151.10.25.1 python-tk-2.7.17-lp151.10.25.1 python-tk-debuginfo-2.7.17-lp151.10.25.1 python-xml-2.7.17-lp151.10.25.1 python-xml-debuginfo-2.7.17-lp151.10.25.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.17-lp151.10.25.1 python-doc-pdf-2.7.17-lp151.10.25.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp151.10.25.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp151.10.25.1 python-32bit-2.7.17-lp151.10.25.1 python-32bit-debuginfo-2.7.17-lp151.10.25.1 python-base-32bit-2.7.17-lp151.10.25.1 python-base-32bit-debuginfo-2.7.17-lp151.10.25.1 References: https://www.suse.com/security/cve/CVE-2020-26116.html https://bugzilla.suse.com/1177211 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1856-1: moderate: Security update for virt-bootstrap
by opensuse-security＠opensuse.org 06 Nov '20

06 Nov '20

openSUSE Security Update: Security update for virt-bootstrap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1856-1 Rating: moderate References: #1140750 Cross-References: CVE-2019-13314 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virt-bootstrap fixes the following issues: Security issue fixed: - CVE-2019-13314: Allow providing the container's root password using a file (bsc#1140750). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1856=1 Package List: - openSUSE Leap 15.1 (noarch): python2-virt-bootstrap-1.0.0-lp151.4.3.1 python3-virt-bootstrap-1.0.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13314.html https://bugzilla.suse.com/1140750 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1844-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1844-1 Rating: important References: #1177409 #1177412 #1177413 #1177414 Cross-References: CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27673 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen fixes the following issues: - bsc#1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286) - bsc#1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code (XSA-345) - bsc#1177413 - VUL-0: CVE-2020-27671: xen: undue deferral of IOMMU TLB flushes (XSA-346) - bsc#1177414 - VUL-0: CVE-2020-27670: xen: unsafe AMD IOMMU page table updates (XSA-347) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1844=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.3_10-lp151.2.27.1 xen-devel-4.12.3_10-lp151.2.27.1 xen-libs-4.12.3_10-lp151.2.27.1 xen-libs-debuginfo-4.12.3_10-lp151.2.27.1 xen-tools-domU-4.12.3_10-lp151.2.27.1 xen-tools-domU-debuginfo-4.12.3_10-lp151.2.27.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.3_10-lp151.2.27.1 xen-doc-html-4.12.3_10-lp151.2.27.1 xen-libs-32bit-4.12.3_10-lp151.2.27.1 xen-libs-32bit-debuginfo-4.12.3_10-lp151.2.27.1 xen-tools-4.12.3_10-lp151.2.27.1 xen-tools-debuginfo-4.12.3_10-lp151.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-27670.html https://www.suse.com/security/cve/CVE-2020-27671.html https://www.suse.com/security/cve/CVE-2020-27672.html https://www.suse.com/security/cve/CVE-2020-27673.html https://bugzilla.suse.com/1177409 https://bugzilla.suse.com/1177412 https://bugzilla.suse.com/1177413 https://bugzilla.suse.com/1177414 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1841-1: critical: Security update for tigervnc
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1841-1 Rating: critical References: #1176733 Cross-References: CVE-2020-26117 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tigervnc fixes the following issues: - CVE-2020-26117: Server certificates were stored as certiticate authorities, allowing malicious owners of these certificates to impersonate any server after a client had added an exception (bsc#1176733) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1841=1 Package List: - openSUSE Leap 15.1 (x86_64): libXvnc-devel-1.9.0-lp151.4.9.1 libXvnc1-1.9.0-lp151.4.9.1 libXvnc1-debuginfo-1.9.0-lp151.4.9.1 tigervnc-1.9.0-lp151.4.9.1 tigervnc-debuginfo-1.9.0-lp151.4.9.1 tigervnc-debugsource-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-debuginfo-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-module-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-module-debuginfo-1.9.0-lp151.4.9.1 - openSUSE Leap 15.1 (noarch): tigervnc-x11vnc-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-java-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-novnc-1.9.0-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-26117.html https://bugzilla.suse.com/1176733 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1840-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1840-1 Rating: moderate References: #1146608 Cross-References: CVE-2019-14973 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tiff fixes the following issues: - CVE-2019-14973: Fixed an improper check which was depended on the compiler which could have led to integer overflow (bsc#1146608). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1840=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtiff-devel-4.0.9-lp151.10.3.1 libtiff5-4.0.9-lp151.10.3.1 libtiff5-debuginfo-4.0.9-lp151.10.3.1 tiff-4.0.9-lp151.10.3.1 tiff-debuginfo-4.0.9-lp151.10.3.1 tiff-debugsource-4.0.9-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): libtiff-devel-32bit-4.0.9-lp151.10.3.1 libtiff5-32bit-4.0.9-lp151.10.3.1 libtiff5-32bit-debuginfo-4.0.9-lp151.10.3.1 References: https://www.suse.com/security/cve/CVE-2019-14973.html https://bugzilla.suse.com/1146608 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1834-1: moderate: Security update for tmux
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1834-1 Rating: moderate References: #1037468 #1116887 #1120170 #1178263 Cross-References: CVE-2018-19387 CVE-2020-27347 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for tmux fixes the following issues: - Update to version 3.1c * Fix a stack overflow on colon-separated CSI parsing. boo#1178263 CVE-2020-27347 - tmux 3.1b: * Fix crash when allow-rename ison and an empty name is set - tmux 3.1a: * Do not close stdout prematurely in control mode since it is needed to print exit messages. Prevents hanging when detaching with iTerm2 - includes changes between 3.1-rc1 and 3.1: * Only search the visible part of the history when marking (highlighting) search terms. This is much faster than searching the whole history and solves problems with large histories. The count of matches shown is now the visible matches rather than all matches * Search using regular expressions in copy mode. search-forward and search-backward use regular expressions by default; the incremental versions do not * Turn off mouse mode 1003 as well as the rest when exiting * Add selection_active format for when the selection is present but not moving with the cursor * Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and C-MouseDragEnd1Pane now work * Add -a to list-keys to also list keys without notes with -N * Do not jump to next word end if already on a word end when selecting a word; fixes select-word with single character words and vi(1) keys * Fix top and bottom pane calculation with pane border status enabled - Update to v3.1-rc * Please see the included CHANGES file - Fix tmux completion - Update to v3.0a * A lot of changes since v2.9a, please see the included CHANGES file. - Update to v2.9a - Fix bugs in select-pane and the main-horizontal and main-vertical layouts. - Add trailing newline to tmpfiles.d/tmux.conf. On newer systems (such as Leap 15.1), the lack of a trailing newline appears to cause the directory to not be created. This is only evident on setups where /run is an actual tmpfs (on btrfs-root installs, /run is a btrfs subvolume and thus /run/tmux is persistent across reboots). - Update to version 2.9 * Add format variables for the default formats in the various modes (tree_mode_format and so on) and add a -a flag to display-message to list variables with values. * Add a -v flag to display-message to show verbose messages as the format is parsed, this allows formats to be debugged * Add support for HPA (\033[`). * Add support for origin mode (\033[?6h). * No longer clear history on RIS. * Extend the #[] style syntax and use that together with previous format changes to allow the status line to be entirely configured with a single option. * Add E: and T: format modifiers to expand a format twice (useful to expand the value of an option). * The individual -fg, -bg and -attr options have been removed; they were superseded by -style options in tmux 1.9. * Add -b to display-panes like run-shell. * Handle UTF-8 in word-separators option. * New "terminal" colour allowing options to use the terminal default colour rather than inheriting the default from a parent option. * Do not move the cursor in copy mode when the mouse wheel is used. * Use the same working directory rules for jobs as new windows rather than always starting in the user's home. * Allow panes to be one line or column in size. * Go to last line when goto-line number is out of range in copy mode. * Yank previously cut text if any with C-y in the command prompt, only use the buffer if no text has been cut. * Add q: format modifier to quote shell special characters. * Add -Z to find-window. * Support for windows larger than the client. This adds two new options, window-size and default-size, and a new command, resize-window. The force-width and force-height options and the session_width and session_height formats have been removed. - update to 2.8 - move bash-completion to right place * Make display-panes block the client until a pane is chosen or it times out. * Clear history on RIS like most other terminals do. * Add an "Any" key to run a command if a key is pressed that is not bound in the current key table. * Expand formats in load-buffer and save-buffer. * Add a rectangle_toggle format. * Add set-hook -R to run a hook immediately. * Add pane focus hooks. * Allow any punctuation as separator for s/x/y not only /. * Improve resizing with the mouse (fix resizing the wrong pane in some layouts, and allow resizing multiple panes at the same time). * Allow , and } to be escaped in formats as #, and #}. * Add KRB5CCNAME to update-environment. * Change meaning of -c to display-message so the client is used if it matches the session given to -t. * Fixes to : form of SGR. * Add x and X to choose-tree to kill sessions, windows or panes. - Add bash completion for tmux - Update to 2.7 * Remove EVENT_* variables from environment on platforms where tmux uses them so they do not pass on to panes. * Fixed for hooks at server exit. * Remove SGR 10 (was equivalent to SGR 0 but no other terminal seems to do this). * Expand formats in window and session names. * Add -Z flag to choose-tree, choose-client, choose-buffer to automatically zoom the pane when the mode is entered and unzoom when it exits, assuming the pane is not already zoomed. This is now part of the default key bindings. * Add C-g to exit modes with emacs keys. * Add exit-empty option to exit server if no sessions (default = on) * Show if a filter is present in choose modes. * Add pipe-pane -I to to connect stdin of the child process. * Performance improvements for reflow. * Use RGB terminfo(5) capability to detect RGB colour terminals (the existing Tc extension remains unchanged). * Support for ISO colon-separated SGR sequences. * Add select-layout -E to spread panes out evenly (bound to E key). * Support wide characters properly when reflowing. * Pass PWD to new panes as a hint to shells, as well as calling chdir(). * Performance improvements for the various choose modes. * Only show first member of session groups in tree mode (-G flag to choose-tree to show all). * Support %else in config files to match %if * Fix "kind" terminfo(5) capability to be S-Down not S-Up. * Add a box around the preview label in tree mode. * Show exit status and time in the remain-on-exit pane text * Correctly use pane-base-index in tree mode. * Change the allow-rename option default to off. * Support for xterm(1) title stack escape sequences * Correctly remove padding cells to fix a UTF-8 display problem - build from release tarball instead of source (drops automake dep) - Bash completion is now removed and provided by - cleanup specfile directory with tmpfiles.d functionality in /run/tmux Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1834=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1834=1 Package List: - openSUSE Leap 15.2 (x86_64): tmux-3.1c-lp152.2.3.1 tmux-debuginfo-3.1c-lp152.2.3.1 tmux-debugsource-3.1c-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): tmux-3.1c-lp151.3.3.1 tmux-debuginfo-3.1c-lp151.3.3.1 tmux-debugsource-3.1c-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tmux-3.1c-bp152.2.3.1 tmux-debuginfo-3.1c-bp152.2.3.1 tmux-debugsource-3.1c-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): tmux-3.1c-bp151.4.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-3.1c-18.1 References: https://www.suse.com/security/cve/CVE-2018-19387.html https://www.suse.com/security/cve/CVE-2020-27347.html https://bugzilla.suse.com/1037468 https://bugzilla.suse.com/1116887 https://bugzilla.suse.com/1120170 https://bugzilla.suse.com/1178263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1842-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1842-1 Rating: moderate References: #1177582 Cross-References: CVE-2020-13943 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1842=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.36-lp151.3.33.1 tomcat-admin-webapps-9.0.36-lp151.3.33.1 tomcat-docs-webapp-9.0.36-lp151.3.33.1 tomcat-el-3_0-api-9.0.36-lp151.3.33.1 tomcat-embed-9.0.36-lp151.3.33.1 tomcat-javadoc-9.0.36-lp151.3.33.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.33.1 tomcat-jsvc-9.0.36-lp151.3.33.1 tomcat-lib-9.0.36-lp151.3.33.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.33.1 tomcat-webapps-9.0.36-lp151.3.33.1 References: https://www.suse.com/security/cve/CVE-2020-13943.html https://bugzilla.suse.com/1177582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1834-1: moderate: Security update for tmux
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1834-1 Rating: moderate References: #1037468 #1116887 #1120170 #1178263 Cross-References: CVE-2018-19387 CVE-2020-27347 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for tmux fixes the following issues: - Update to version 3.1c * Fix a stack overflow on colon-separated CSI parsing. boo#1178263 CVE-2020-27347 - tmux 3.1b: * Fix crash when allow-rename ison and an empty name is set - tmux 3.1a: * Do not close stdout prematurely in control mode since it is needed to print exit messages. Prevents hanging when detaching with iTerm2 - includes changes between 3.1-rc1 and 3.1: * Only search the visible part of the history when marking (highlighting) search terms. This is much faster than searching the whole history and solves problems with large histories. The count of matches shown is now the visible matches rather than all matches * Search using regular expressions in copy mode. search-forward and search-backward use regular expressions by default; the incremental versions do not * Turn off mouse mode 1003 as well as the rest when exiting * Add selection_active format for when the selection is present but not moving with the cursor * Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and C-MouseDragEnd1Pane now work * Add -a to list-keys to also list keys without notes with -N * Do not jump to next word end if already on a word end when selecting a word; fixes select-word with single character words and vi(1) keys * Fix top and bottom pane calculation with pane border status enabled - Update to v3.1-rc * Please see the included CHANGES file - Fix tmux completion - Update to v3.0a * A lot of changes since v2.9a, please see the included CHANGES file. - Update to v2.9a - Fix bugs in select-pane and the main-horizontal and main-vertical layouts. - Add trailing newline to tmpfiles.d/tmux.conf. On newer systems (such as Leap 15.1), the lack of a trailing newline appears to cause the directory to not be created. This is only evident on setups where /run is an actual tmpfs (on btrfs-root installs, /run is a btrfs subvolume and thus /run/tmux is persistent across reboots). - Update to version 2.9 * Add format variables for the default formats in the various modes (tree_mode_format and so on) and add a -a flag to display-message to list variables with values. * Add a -v flag to display-message to show verbose messages as the format is parsed, this allows formats to be debugged * Add support for HPA (\033[`). * Add support for origin mode (\033[?6h). * No longer clear history on RIS. * Extend the #[] style syntax and use that together with previous format changes to allow the status line to be entirely configured with a single option. * Add E: and T: format modifiers to expand a format twice (useful to expand the value of an option). * The individual -fg, -bg and -attr options have been removed; they were superseded by -style options in tmux 1.9. * Add -b to display-panes like run-shell. * Handle UTF-8 in word-separators option. * New "terminal" colour allowing options to use the terminal default colour rather than inheriting the default from a parent option. * Do not move the cursor in copy mode when the mouse wheel is used. * Use the same working directory rules for jobs as new windows rather than always starting in the user's home. * Allow panes to be one line or column in size. * Go to last line when goto-line number is out of range in copy mode. * Yank previously cut text if any with C-y in the command prompt, only use the buffer if no text has been cut. * Add q: format modifier to quote shell special characters. * Add -Z to find-window. * Support for windows larger than the client. This adds two new options, window-size and default-size, and a new command, resize-window. The force-width and force-height options and the session_width and session_height formats have been removed. - update to 2.8 - move bash-completion to right place * Make display-panes block the client until a pane is chosen or it times out. * Clear history on RIS like most other terminals do. * Add an "Any" key to run a command if a key is pressed that is not bound in the current key table. * Expand formats in load-buffer and save-buffer. * Add a rectangle_toggle format. * Add set-hook -R to run a hook immediately. * Add pane focus hooks. * Allow any punctuation as separator for s/x/y not only /. * Improve resizing with the mouse (fix resizing the wrong pane in some layouts, and allow resizing multiple panes at the same time). * Allow , and } to be escaped in formats as #, and #}. * Add KRB5CCNAME to update-environment. * Change meaning of -c to display-message so the client is used if it matches the session given to -t. * Fixes to : form of SGR. * Add x and X to choose-tree to kill sessions, windows or panes. - Add bash completion for tmux - Update to 2.7 * Remove EVENT_* variables from environment on platforms where tmux uses them so they do not pass on to panes. * Fixed for hooks at server exit. * Remove SGR 10 (was equivalent to SGR 0 but no other terminal seems to do this). * Expand formats in window and session names. * Add -Z flag to choose-tree, choose-client, choose-buffer to automatically zoom the pane when the mode is entered and unzoom when it exits, assuming the pane is not already zoomed. This is now part of the default key bindings. * Add C-g to exit modes with emacs keys. * Add exit-empty option to exit server if no sessions (default = on) * Show if a filter is present in choose modes. * Add pipe-pane -I to to connect stdin of the child process. * Performance improvements for reflow. * Use RGB terminfo(5) capability to detect RGB colour terminals (the existing Tc extension remains unchanged). * Support for ISO colon-separated SGR sequences. * Add select-layout -E to spread panes out evenly (bound to E key). * Support wide characters properly when reflowing. * Pass PWD to new panes as a hint to shells, as well as calling chdir(). * Performance improvements for the various choose modes. * Only show first member of session groups in tree mode (-G flag to choose-tree to show all). * Support %else in config files to match %if * Fix "kind" terminfo(5) capability to be S-Down not S-Up. * Add a box around the preview label in tree mode. * Show exit status and time in the remain-on-exit pane text * Correctly use pane-base-index in tree mode. * Change the allow-rename option default to off. * Support for xterm(1) title stack escape sequences * Correctly remove padding cells to fix a UTF-8 display problem - build from release tarball instead of source (drops automake dep) - Bash completion is now removed and provided by - cleanup specfile directory with tmpfiles.d functionality in /run/tmux Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1834=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-3.1c-18.1 References: https://www.suse.com/security/cve/CVE-2018-19387.html https://www.suse.com/security/cve/CVE-2020-27347.html https://bugzilla.suse.com/1037468 https://bugzilla.suse.com/1116887 https://bugzilla.suse.com/1120170 https://bugzilla.suse.com/1178263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1843-1: moderate: Security update for transfig
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1843-1 Rating: moderate References: #1143650 Cross-References: CVE-2019-14275 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for transfig fixes the following issues: Security issue fixed: - CVE-2019-14275: Fixed stack-based buffer overflow in the calc_arrow function (bsc#1143650). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1843=1 Package List: - openSUSE Leap 15.1 (x86_64): transfig-3.2.6a-lp151.4.9.1 transfig-debuginfo-3.2.6a-lp151.4.9.1 transfig-debugsource-3.2.6a-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-14275.html https://bugzilla.suse.com/1143650 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1833-1: critical: Security update for salt
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1833-1 Rating: critical References: #1159670 #1175987 #1176024 #1176294 #1176397 #1177867 #1178319 #1178361 #1178362 Cross-References: CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for salt fixes the following issues: - Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846) - Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867) - Ensure virt.update stop_on_reboot is updated with its default value. - Do not break package building for systemd OSes. - Drop wrong mock from chroot unit test. - Support systemd versions with dot. (bsc#1176294) - Fix for grains.test_core unit test. - Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024) - Several changes to virtualization: * Fix virt update when cpu and memory are changed. * Memory Tuning GSoC. * Properly fix memory setting regression in virt.update. * Expose libvirt on_reboot in virt states. - Support transactional systems (MicroOS). - zypperpkg module ignores retcode 104 for search(). (bsc#1159670) - Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987) - Invalidate file list cache when cache file modified time is in the future. (bsc#1176397) - Prevent import errors when running test_btrfs unit tests. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1833=1 Package List: - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.15.1 python3-salt-3000-lp152.3.15.1 salt-3000-lp152.3.15.1 salt-api-3000-lp152.3.15.1 salt-cloud-3000-lp152.3.15.1 salt-doc-3000-lp152.3.15.1 salt-master-3000-lp152.3.15.1 salt-minion-3000-lp152.3.15.1 salt-proxy-3000-lp152.3.15.1 salt-ssh-3000-lp152.3.15.1 salt-standalone-formulas-configuration-3000-lp152.3.15.1 salt-syndic-3000-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.15.1 salt-fish-completion-3000-lp152.3.15.1 salt-zsh-completion-3000-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-16846.html https://www.suse.com/security/cve/CVE-2020-17490.html https://www.suse.com/security/cve/CVE-2020-25592.html https://bugzilla.suse.com/1159670 https://bugzilla.suse.com/1175987 https://bugzilla.suse.com/1176024 https://bugzilla.suse.com/1176294 https://bugzilla.suse.com/1176397 https://bugzilla.suse.com/1177867 https://bugzilla.suse.com/1178319 https://bugzilla.suse.com/1178361 https://bugzilla.suse.com/1178362 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1831-1: important: Security update for chromium
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1831-1 Rating: important References: #1178375 Cross-References: CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 CVE-2020-16011 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1831=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1831=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1831=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-86.0.4240.183-lp152.2.45.1 chromedriver-debuginfo-86.0.4240.183-lp152.2.45.1 chromium-86.0.4240.183-lp152.2.45.1 chromium-debuginfo-86.0.4240.183-lp152.2.45.1 - openSUSE Leap 15.1 (x86_64): chromedriver-86.0.4240.183-lp151.2.150.1 chromedriver-debuginfo-86.0.4240.183-lp151.2.150.1 chromium-86.0.4240.183-lp151.2.150.1 chromium-debuginfo-86.0.4240.183-lp151.2.150.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-86.0.4240.183-bp151.3.119.1 chromium-86.0.4240.183-bp151.3.119.1 References: https://www.suse.com/security/cve/CVE-2020-16004.html https://www.suse.com/security/cve/CVE-2020-16005.html https://www.suse.com/security/cve/CVE-2020-16006.html https://www.suse.com/security/cve/CVE-2020-16007.html https://www.suse.com/security/cve/CVE-2020-16008.html https://www.suse.com/security/cve/CVE-2020-16009.html https://www.suse.com/security/cve/CVE-2020-16011.html https://bugzilla.suse.com/1178375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1829-1: important: Security update for chromium, gn
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for chromium, gn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1829-1 Rating: important References: #1177408 #1177936 #1178375 Cross-References: CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 CVE-2020-16011 CVE-2020-6557 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 39 vulnerabilities is now available. Description: This update for chromium, gn fixes the following issues: chromium was updated to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. - chromium-86-f_seal.patch: F_SEAL* definitions added for leap 15.1 and 15.2 - Remove vdpau->vaapi bridge as it breaks a lot: (fixes welcome by someone else than me) - Fix cookiemonster: Update to 86.0.4240.75 boo#1177408: * CVE-2020-15967: Use after free in payments. * CVE-2020-15968: Use after free in Blink. * CVE-2020-15969: Use after free in WebRTC. * CVE-2020-15970: Use after free in NFC. * CVE-2020-15971: Use after free in printing. * CVE-2020-15972: Use after free in audio. * CVE-2020-15990: Use after free in autofill. * CVE-2020-15991: Use after free in password manager. * CVE-2020-15973: Insufficient policy enforcement in extensions. * CVE-2020-15974: Integer overflow in Blink. * CVE-2020-15975: Integer overflow in SwiftShader. * CVE-2020-15976: Use after free in WebXR. * CVE-2020-6557: Inappropriate implementation in networking. * CVE-2020-15977: Insufficient data validation in dialogs. * CVE-2020-15978: Insufficient data validation in navigation. * CVE-2020-15979: Inappropriate implementation in V8. * CVE-2020-15980: Insufficient policy enforcement in Intents. * CVE-2020-15981: Out of bounds read in audio. * CVE-2020-15982: Side-channel information leakage in cache. * CVE-2020-15983: Insufficient data validation in webUI. * CVE-2020-15984: Insufficient policy enforcement in Omnibox. * CVE-2020-15985: Inappropriate implementation in Blink. * CVE-2020-15986: Integer overflow in media. * CVE-2020-15987: Use after free in WebRTC. * CVE-2020-15992: Insufficient policy enforcement in networking. * CVE-2020-15988: Insufficient policy enforcement in downloads. * CVE-2020-15989: Uninitialized Use in PDFium. - Update to 0.1807: * no upstream changelog Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1829=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): gn-0.1807-bp152.2.3.4 gn-debuginfo-0.1807-bp152.2.3.4 gn-debugsource-0.1807-bp152.2.3.4 - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-86.0.4240.183-bp152.2.26.1 chromium-86.0.4240.183-bp152.2.26.1 References: https://www.suse.com/security/cve/CVE-2020-15967.html https://www.suse.com/security/cve/CVE-2020-15968.html https://www.suse.com/security/cve/CVE-2020-15969.html https://www.suse.com/security/cve/CVE-2020-15970.html https://www.suse.com/security/cve/CVE-2020-15971.html https://www.suse.com/security/cve/CVE-2020-15972.html https://www.suse.com/security/cve/CVE-2020-15973.html https://www.suse.com/security/cve/CVE-2020-15974.html https://www.suse.com/security/cve/CVE-2020-15975.html https://www.suse.com/security/cve/CVE-2020-15976.html https://www.suse.com/security/cve/CVE-2020-15977.html https://www.suse.com/security/cve/CVE-2020-15978.html https://www.suse.com/security/cve/CVE-2020-15979.html https://www.suse.com/security/cve/CVE-2020-15980.html https://www.suse.com/security/cve/CVE-2020-15981.html https://www.suse.com/security/cve/CVE-2020-15982.html https://www.suse.com/security/cve/CVE-2020-15983.html https://www.suse.com/security/cve/CVE-2020-15984.html https://www.suse.com/security/cve/CVE-2020-15985.html https://www.suse.com/security/cve/CVE-2020-15986.html https://www.suse.com/security/cve/CVE-2020-15987.html https://www.suse.com/security/cve/CVE-2020-15988.html https://www.suse.com/security/cve/CVE-2020-15989.html https://www.suse.com/security/cve/CVE-2020-15990.html https://www.suse.com/security/cve/CVE-2020-15991.html https://www.suse.com/security/cve/CVE-2020-15992.html https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://www.suse.com/security/cve/CVE-2020-16004.html https://www.suse.com/security/cve/CVE-2020-16005.html https://www.suse.com/security/cve/CVE-2020-16006.html https://www.suse.com/security/cve/CVE-2020-16007.html https://www.suse.com/security/cve/CVE-2020-16008.html https://www.suse.com/security/cve/CVE-2020-16009.html https://www.suse.com/security/cve/CVE-2020-16011.html https://www.suse.com/security/cve/CVE-2020-6557.html https://bugzilla.suse.com/1177408 https://bugzilla.suse.com/1177936 https://bugzilla.suse.com/1178375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1825-1: important: Security update for pacemaker
by opensuse-security＠opensuse.org 04 Nov '20

04 Nov '20

openSUSE Security Update: Security update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1825-1 Rating: important References: #1167171 #1173668 #1175557 #1177916 Cross-References: CVE-2020-25654 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for pacemaker fixes the following issues: - executor: restrict certain IPC requests to Pacemaker daemons (CVE-2020-25654, bsc#1177916) - extra: add vim modelines to agents - extra: quote shell variables in agent code where appropriate (bsc#1175557) - extra: remove trailing whitespace from agent code - extra: update agent boilerplate (copyright/license notices) - extra: use 4-space indents in resource agent code - extra: use ":=" where appropriate in agent code - fencer: restrict certain IPC requests to privileged users (CVE-2020-25654, bsc#1177916) - move bcond_with/without up front for e.g. pcmk_release - pacemakerd: ignore shutdown requests from unprivileged users (CVE-2020-25654, bsc#1177916) - rpm: add spec option for enabling CIB secrets - rpm: put user-configurable items at top of spec - rpm: use the user/group ID 90 for haclient/hacluster to be consistent with cluster-glue (bsc#1167171) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1825=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpacemaker-devel-2.0.1+20190417.13d370ca9-lp151.2.16.4 libpacemaker3-2.0.1+20190417.13d370ca9-lp151.2.16.4 libpacemaker3-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-cli-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-cli-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-debugsource-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-remote-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-remote-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 - openSUSE Leap 15.1 (noarch): pacemaker-cts-2.0.1+20190417.13d370ca9-lp151.2.16.4 References: https://www.suse.com/security/cve/CVE-2020-25654.html https://bugzilla.suse.com/1167171 https://bugzilla.suse.com/1173668 https://bugzilla.suse.com/1175557 https://bugzilla.suse.com/1177916 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1820-1: moderate: Security update for icinga2
by opensuse-security＠opensuse.org 03 Nov '20

03 Nov '20

openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1820-1 Rating: moderate References: #1159869 #1172171 #1174075 Cross-References: CVE-2020-14004 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for icinga2 fixes the following issues: - Info that since version 2.12.0 following security issue is fixed: prepare-dirs script allows for symlink attack in the icinga user context. boo#1172171 (CVE-2020-14004) Update to 2.12.1: * Bugfixes + Core - Fix crashes during config update #8348 #8345 - Fix crash while removing a downtime #8228 - Ensure the daemon doesn't get killed by logrotate #8170 - Fix hangup during shutdown #8211 - Fix a deadlock in Icinga DB #8168 - Clean up zombie processes during reload #8376 - Reduce check latency #8276 + IDO - Prevent unnecessary IDO updates #8327 #8320 - Commit IDO MySQL transactions earlier #8349 - Make sure to insert IDO program status #8330 - Improve IDO queue stats logging #8271 #8328 #8379 + Misc - Ensure API connections are closed properly #8293 - Prevent unnecessary notifications #8299 - Don't skip null values of command arguments #8174 - Fix Windows .exe version #8234 - Reset Icinga check warning after successful config update #8189 Update to 2.12.0: * Breaking changes - Deprecate Windows plugins in favor of our - PowerShell plugins #8071 - Deprecate Livestatus #8051 - Refuse acknowledging an already acknowledged checkable #7695 - Config lexer: complain on EOF in heredocs, i.e. {{{abc<EOF> #7541 * Enhancements + Core - Implement new database backend: Icinga DB #7571 - Re-send notifications previously suppressed by their time periods #7816 + API - Host/Service: Add acknowledgement_last_change and next_update attributes #7881 #7534 - Improve error message for POST queries #7681 - /v1/actions/remove-comment: let users specify themselves #7646 - /v1/actions/remove-downtime: let users specify themselves #7645 - /v1/config/stages: Add 'activate' parameter #7535 + CLI - Add pki verify command for better TLS certificate troubleshooting #7843 - Add OpenSSL version to 'Build' section in --version #7833 - Improve experience with 'Node Setup for Agents/Satellite' #7835 + DSL - Add get_template() and get_templates() #7632 - MacroProcessor::ResolveArguments(): skip null argument values #7567 - Fix crash due to dependency apply rule with ignore_on_error and non-existing parent #7538 - Introduce ternary operator (x ? y : z) #7442 - LegacyTimePeriod: support specifying seconds #7439 - Add support for Lambda Closures (() use(x) => x and () use(x) => { return x }) #7417 + ITL - Add notemp parameter to oracle health #7748 - Add extended checks options to snmp-interface command template #7602 - Add file age check for Windows command definition #7540 + Docs - Development: Update debugging instructions #7867 - Add new API clients #7859 - Clarify CRITICAL vs. UNKNOWN #7665 - Explicitly explain how to disable freshness checks #7664 - Update installation for RHEL/CentOS 8 and SLES 15 #7640 - Add Powershell example to validate the certificate #7603 + Misc - Don't send event::Heartbeat to unauthenticated peers #7747 - OpenTsdbWriter: Add custom tag support #7357 * Bugfixes + Core - Fix JSON-RPC crashes #7532 #7737 - Fix zone definitions in zones #7546 - Fix deadlock during start on OpenBSD #7739 - Consider PENDING not a problem #7685 - Fix zombie processes after reload #7606 - Don't wait for checks to finish during reload #7894 + Cluster - Fix segfault during heartbeat timeout with clients not yet signed #7970 - Make the config update process mutually exclusive (Prevents file system race conditions) #7936 - Fix check_timeout not being forwarded to agent command endpoints #7861 - Config sync: Use a more friendly message when configs are equal and don't need a reload #7811 - Fix open connections when agent waits for CA approval #7686 - Consider a JsonRpcConnection alive on a single byte of TLS payload, not only on a whole message #7836 - Send JsonRpcConnection heartbeat every 20s instead of 10s #8102 - Use JsonRpcConnection heartbeat only to update connection liveness (m_Seen) #8142 - Fix TLS context not being updated on signed certificate messages on agents #7654 + API - Close connections w/o successful TLS handshakes after 10s #7809 - Handle permission exceptions soon enough, returning 404 #7528 + SELinux - Fix safe-reload #7858 - Allow direct SMTP notifications #7749 + Windows - Terminate check processes with UNKNOWN state on timeout #7788 - Ensure that log replay files are properly renamed #7767 + Metrics - Graphite/OpenTSDB: Ensure that reconnect failure is detected #7765 - Always send 0 as value for thresholds #7696 + Scripts - Fix notification scripts to stay compatible with Dash #7706 - Fix bash line continuation in mail-host-notification.sh #7701 - Fix notification scripts string comparison #7647 - Service and host mail-notifications: Add line-breaks to very long output #6822 - Set correct UTF-8 email subject header (RFC1342) #6369 + Misc - DSL: Fix segfault due to passing null as custom function to Array#{sort,map,reduce,filter,any,all}() #8053 - CLI: pki save-cert: allow to specify --key and --cert for backwards compatibility #7995 - Catch exception when trusted cert is not readable during node setup on agent/satellite #7838 - CheckCommand ssl: Fix wrong parameter -N #7741 - Code quality fixes - Small documentation fixes - Update to 2.11.5 Version 2.11.5 fixes file system race conditions in the config update process occurring in large HA environments and improves the cluster connection liveness mechanisms. * Bugfixes + Make the config update process mutually exclusive (Prevents file system race conditions) #8093 + Consider a JsonRpcConnection alive on a single byte of TLS payload, not only on a whole message #8094 + Send JsonRpcConnection heartbeat every 20s instead of 10s #8103 + Use JsonRpcConnection heartbeat only to update connection liveness (m_Seen) #8097 - Update to 2.11.4 Version 2.11.4 fixes a crash during a heartbeat timeout with clients not yet signed. It also resolves an issue with endpoints not reconnecting after a reload/deploy, which caused a lot of UNKNOWN states. * Bugfixes + Cluster - Fix segfault during heartbeat timeout with clients not yet signed #7997 - Fix endpoints not reconnecting after reload (UNKNOWN hosts/services after reload) #8043 + Setup - Fix exception on trusted cert not readable during node setup #8044 - prepare-dirs: Only set permissions during directory creation #8046 + DSL - Fix segfault on missing compare function in Array functions (sort, map, reduce, filter, any, all) #8054 - Update to 2.11.3 * Bugfixes - Cluster Fix JSON-RPC crashes (#7532) in large environments: #7846 #7848 #7849 - Set minimum require boost version to 1.66 - Fix boo#1159869 Permission error when use the icinga cli wizard. - BuildRequire pkgconfig(libsystemd) instead of systemd-devel: Aloow OBS to shortcut through the -mini flavors. - Update to 2.11.2 This release fixes a problem where the newly introduced config sync "check-change-then-reload" functionality could cause endless reload loops with agents. The most visible parts are failing command endpoint checks with "not connected" UNKNOWN state. Only applies to HA enabled zones with 2 masters and/or 2 satellites. * Bugfixes - Cluster Config Sync - Config sync checksum change detection may not work within high load HA clusters #7565 - Update to 2.11.1 This release fixes a hidden long lasting bug unveiled with 2.11 and distributed setups. If you are affected by agents/satellites not accepting configuration anymore, or not reloading, please upgrade. * Bugfixes - Cluster Config Sync - Never accept authoritative config markers from other instances #7552 - This affects setups where agent/satellites are newer than the config master, e.g. satellite/agent=2.11.0, master=2.10. - Configuration - Error message for command_endpoint should hint that zone is not set #7514 - Global variable 'ActiveStageOverride' has been set implicitly via 'ActiveStageOverride ... #7521 * Documentation - Docs: Add upgrading/troubleshooting details for repos, config sync, agents #7526 - Explain repository requirements for 2.11: https://icinga.com/docs/icinga2/latest/doc/16-upgrading-icinga-2/#added-boo st-166 - command_endpoint objects require a zone: https://icinga.com/docs/icinga2/latest/doc/16-upgrading-icinga-2/#agent-hos ts-with-command-endpoint-require-a-zone - Zones declared in zones.d are not loaded anymore: https://icinga.com/docs/icinga2/latest/doc/16-upgrading-icinga-2/#config-sy nc-zones-in-zones - Update to 2.11.0 * Core - Rewrite Network Stack (cluster, REST API) based on Boost Asio, Beast, Coroutines - Technical concept: #7041 - Requires package updates: Boost >1.66 (either from packages.icinga.com, EPEL or backports). SLES11 & Ubuntu 14 are EOL. - Require TLS 1.2 and harden default cipher list - Improved Reload Handling (umbrella process, now 3 processes at runtime) - Support running Icinga 2 in (Docker) containers natively in foreground - Quality: Use Modern JSON for C++ library instead of YAJL (dead project) - Quality: Improve handling of invalid UTF8 strings * API - Fix crashes on Linux, Unix and Windows from Nessus scans #7431 - Locks and stalled waits are fixed with the core rewrite in #7071 - schedule-downtime action supports all_services for host downtimes - Improve storage handling for runtime created objects in the _api package * Cluster - HA aware features & improvements for failover handling #2941 #7062 - Improve cluster config sync with staging #6716 - Fixed that same downtime/comment objects would be synced again in a cluster loop #7198 * Checks & Notifications - Ensure that notifications during a restart are sent - Immediately notify about a problem after leaving a downtime and still NOT-OK - Improve reload handling and wait for features/metrics - Store notification command results and sync them in HA enabled zones #6722 * DSL/Configuration - Add getenv() function - Fix TimePeriod range support over midnight - concurrent_checks in the Checker feature has no effect, use the global MaxConcurrentChecks constant instead * CLI - Permissions: node wizard/setup, feature, api setup now run in the Icinga user context, not root - ca list shows pending CSRs by default, ca remove/restore allow to delete signing requests * ITL - Add new commands and missing attributes * Windows - Update bundled NSClient++ to 0.5.2.39 - Refine agent setup wizard & update requirements to .NET 4.6 * Documentation - Service Monitoring: How to create plugins by example, check commands and a modern version of the supported plugin API with best practices - Features: Better structure on metrics, and supported features - Technical Concepts: TLS Network IO, Cluster Feature HA, Cluster Config Sync - Development: Rewritten for better debugging and development experience for contributors including a style guide. Add nightly build setup instructions. - Packaging: INSTALL.md was integrated into the Development chapter, being available at https://icinga.com/docs too. - Update to 2.10.6 * Bugfixes - Fix el7 not loading ECDHE cipher suites #7247 - update to 2.10.5 * Core - Fix crashes with logrotate signals #6737 (thanks Elias Ohm) * API - Fix crashes and problems with permission filters from recent Namespace introduction #6785 (thanks Elias Ohm) #6874 (backported from 2.11) - Reduce log spam with locked connections (real fix is the network stack rewrite in 2.11) #6877 * Cluster - Fix problems with replay log rotation and storage #6932 (thanks Peter Eckel) * IDO DB - Fix that reload shutdown deactivates hosts and hostgroups (introduced in 2.9) #7157 * Documentation - Improve the REST API chapter: Unix timestamp handling, filters, unify POST requests with filters in the body - Better layout for the features chapter, specifically metrics and events - Split object types into monitoring, runtime, features - Add technical concepts for cluster messages Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1820=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1820=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1820=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1820=1 Package List: - openSUSE Leap 15.2 (x86_64): icinga2-2.12.1-lp152.3.3.3 icinga2-bin-2.12.1-lp152.3.3.3 icinga2-bin-debuginfo-2.12.1-lp152.3.3.3 icinga2-common-2.12.1-lp152.3.3.3 icinga2-debuginfo-2.12.1-lp152.3.3.3 icinga2-debugsource-2.12.1-lp152.3.3.3 icinga2-doc-2.12.1-lp152.3.3.3 icinga2-ido-mysql-2.12.1-lp152.3.3.3 icinga2-ido-mysql-debuginfo-2.12.1-lp152.3.3.3 icinga2-ido-pgsql-2.12.1-lp152.3.3.3 icinga2-ido-pgsql-debuginfo-2.12.1-lp152.3.3.3 nano-icinga2-2.12.1-lp152.3.3.3 vim-icinga2-2.12.1-lp152.3.3.3 - openSUSE Leap 15.1 (x86_64): icinga2-2.12.1-lp151.2.3.4 icinga2-bin-2.12.1-lp151.2.3.4 icinga2-bin-debuginfo-2.12.1-lp151.2.3.4 icinga2-common-2.12.1-lp151.2.3.4 icinga2-debuginfo-2.12.1-lp151.2.3.4 icinga2-debugsource-2.12.1-lp151.2.3.4 icinga2-doc-2.12.1-lp151.2.3.4 icinga2-ido-mysql-2.12.1-lp151.2.3.4 icinga2-ido-mysql-debuginfo-2.12.1-lp151.2.3.4 icinga2-ido-pgsql-2.12.1-lp151.2.3.4 icinga2-ido-pgsql-debuginfo-2.12.1-lp151.2.3.4 nano-icinga2-2.12.1-lp151.2.3.4 vim-icinga2-2.12.1-lp151.2.3.4 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): icinga2-2.12.1-bp152.4.3.1 icinga2-bin-2.12.1-bp152.4.3.1 icinga2-bin-debuginfo-2.12.1-bp152.4.3.1 icinga2-common-2.12.1-bp152.4.3.1 icinga2-debuginfo-2.12.1-bp152.4.3.1 icinga2-debugsource-2.12.1-bp152.4.3.1 icinga2-doc-2.12.1-bp152.4.3.1 icinga2-ido-mysql-2.12.1-bp152.4.3.1 icinga2-ido-mysql-debuginfo-2.12.1-bp152.4.3.1 icinga2-ido-pgsql-2.12.1-bp152.4.3.1 icinga2-ido-pgsql-debuginfo-2.12.1-bp152.4.3.1 nano-icinga2-2.12.1-bp152.4.3.1 vim-icinga2-2.12.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): icinga2-2.12.1-bp151.3.3.4 icinga2-bin-2.12.1-bp151.3.3.4 icinga2-common-2.12.1-bp151.3.3.4 icinga2-doc-2.12.1-bp151.3.3.4 icinga2-ido-mysql-2.12.1-bp151.3.3.4 icinga2-ido-pgsql-2.12.1-bp151.3.3.4 nano-icinga2-2.12.1-bp151.3.3.4 vim-icinga2-2.12.1-bp151.3.3.4 References: https://www.suse.com/security/cve/CVE-2020-14004.html https://bugzilla.suse.com/1159869 https://bugzilla.suse.com/1172171 https://bugzilla.suse.com/1174075 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1822-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 03 Nov '20

03 Nov '20

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1822-1 Rating: moderate References: #1157594 #1177967 Cross-References: CVE-2020-15917 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for claws-mail fixes the following issues: - Additional cleanup of the template handling claws-mail was updated to 3.17.8 (boo#1177967) * Shielded template's |program{} and |attach_program{} so that the command-line that is executed does not allow sequencing such as with && || ;, preventing possible execution of nasty, or at least unexpected, commands * bug fixes: claws#4376 * updated English, French, and Spanish manuals - Update to 3.17.7 * Image Viewer: Image attachments, when displayed, are now resized to fit the available width rather than the available height. * -d is now an alias to --debug. * Libravatar plugin: New styles supported: Robohash and Pagan. * SpamAssassin plugin: The 'Maximum size' option now matches SpamAssassin's maximum; it can now handle messages up to 256MB. * LiteHTML viewer plugin: The UI is now translatable. Bug fixes: * bug 4313, 'Recursion stack overflow with rebuilding folder tree' * bug 4372, '[pl_PL] Crash after "Send later" without recipient and then "Close"' * bug 4373, 'attach mailto URI double free' * bug 4374, 'insert mailto URI misses checks' * bug 4384, 'U+00AD (soft hyphen) changed to space in Subject' * bug 4386, 'Allow Sieve config without userid without warning' * Add missing SSL settings when cloning accounts. * Parsing of command-line arguments. * PGP Core plugin: fix segv in address completion with a keyring. * Libravatar plugin: fixes to image display. - Disable python-gtk plugin on suse_version > 1500: still relying on python2, which is EOL. - Update to 3.17.6: * It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues. * A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL). * The progress window when importing an mbox file is now more responsive. * A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled. * Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3. Bug fixes: * bug 3922, 'minimize to tray on startup not working' * bug 4220, 'generates files in cache without content' * bug 4325, 'Following redirects when retrieving image' * bug 4342, 'Import mbox file command doesn't work twice on a row' * fix STARTTLS protocol violation * fix initial debug line * fix fat-fingered crash when v (hiding msgview) is pressed just before c (check signature) * fix non-translation of some Templates strings - Update to 3.17.5 + Inline Git patches now have colour syntax highlighting The colours of these, and patch attachments, are configurable on the 'Other' tab of the Display/Colors page of the general preferences. + The previously hidden preference, 'summary_from_show', is now configurable within the UI, on the 'Message List' tab of the Display/Summaries page of the general preferences, 'Displayed in From column [ ]'. + 'Re-edit' has been added to the message context menu when in the Drafts folder. + Additional Date header formats are supported: - weekday, month, day, hh, mm, ss, year, zone - weekday, month, day, hh, mm, ss, year + LiteHtml viewer plugin: scrolling with the keyboard has been implemented. + The included tools/scripts have been updated: - eud2gc.py converted to Python 3 - tbird2claws.py converted to Python 3 - tbird2claws.py converted to Python 3 - google_search.pl has been replaced with ddg_search.pl (that is, duckduckgo.com instead of google.com) - fix_date.sh and its documentation have been updated - multiwebsearch.pl 'fm' (freshmeat.net) has been removed; 'google' has been replaced by 'ddg' - the outdated OOo2claws-mail.pl script has been removed + Updated manuals + Updated translations: British English, Catalan, Czech, Danish, Dutch, French, German, Russian, Slovak, Spanish, Swedish, Traditional Chinese, Turkish + bug fixes: claws#2131, claws#4237, claws#4239, claws#4248, claws#4253, claws#4257, claws#4277, claws#4278, claws#4305 + Misc bugs fixed: - Fix crash in litehtml_viewer when tag has no href - removed "The following file has been attached..." dialogue - MBOX import: give a better estimation of the time left and grey out widgets while importing - Fixed "vcard.c:238:2: warning: ‘strncpy’ output truncate before terminating nul copying as many bytes from a string as its length" - RSSyl: Fix handling deleted feed items where modified and published dates do not match - fix bolding of target folder - when creating a new account, don't pre-fill data from the default account - respect 'default selection' settings when moving a msg with manual filtering - Fix printing of empty pages when the selected part is rendered with a plugin not implementing print - Addressbook folder selection dialogs: make sure folder list is sorted and apply global prefs to get stripes in lists. - when user cancels the GPG signing passphrase dialogue, don't bother the user with an "error" dialogue - Fix imap keyword search. Libetpan assumes keyword search is a MUST but RFC states it is a MAY. Fix advanced search on MS Exchange - fix SHIFT+SPACE in msg list, moving in reverse - revert pasting images as attachments - Fix help about command-line arguments that require a parameter. - Printing: only print as plain text if the part is of type text - fix a segfault with default info icon when trying to print a non-text part. - Add a test on build-time libetpan version to require the proper version at run-time (boo#1157594) - Move "Mark all read/unread" menu entries where they belong. remove-MarkAll-from-message-menu.patch (claws#4278) add-MarkAll-to-folder-menu.patch (claws#4278) - Make litehtml plugin build on Tumbleweed. - Update to 3.17.4: * New HTML viewer plugin: Litehtml viewer * Added option 'Enable keyboard shortcuts' to the 'Keyboard shortcuts' frame on /Configuration/Preferences/Other/Miscellaneous * Compose: implemented copying of attached images to clipboard * Compose: images and text/uri-list (files) can now be attached by pasting into the Compose window * Python plugin: window sizes are now remembered for the Python console, the 'Open URLs' and the 'Set mailbox order' windows. * Fancy plugin: the download-link feature now follows redirections * MBOX export: the Enter key in the dialogue now starts the export * The date (ISO format) has been added to log timestamps * Update translations - bug 1920, 'No automatic NNTP filtering' - bug 2045, 'address book blocks focus on email window' - bug 2131, 'Focus stealing after mail check' - bug 2627, 'Filtering does not work on NNTP' - bug 3070, 'misbehaving text wrapping when URL chars are present' - bug 3838, 'Canceled right-click on message list leaves UI in inconsistent state' - bug 3977, 'Fix crashes when some external APIs fail' - bug 3979, 'Hang (with killing needed) during action which extracts attachments' - bug 4029, 'segfault after deleting message in a window' - bug 4031, 'fingerprint in SSL/TLS certificates for ... (regress error)' - bug 4037, 'Fix some small issues' - bug 4142, 'Translation error on Russian' - bug 4145, 'proxy server for sending doesn't work' - bug 4155, 'remember directory of last saving' - bug 4166, 'corrupted double-linked list' - bug 4167, 'Max line length exceeded when forwarding mail' - bug 4188, 'STL file is sent not as an attachment but as its base64 representation in plaintext' - CID 1442278, 'impossible to trigger buffer overflow' - Make key accelerators from menu work in addressbook window - save checkbox choices of display/summaries/defaults prefs - Do not throw an error when cancelling 'Save email as...'. - occasional crash on drag'n'drop of msgs - possible stack overflow in vcalendar's Curl data handler - crash when LDAP address source is defined in index, but - support is disabled - crash in Fancy plugin if one of the MIME parts has no - -ID - a few small memory leaks in scan_mailto_url() - configure script for rare cases where python is not installed - incorrect charset conversion in sc_html_read_line(). - markup in 'key not fully trusted' warning in pgpcore - use after free in rare code path in rssyl_subscribe() - several memory leaks - verify_folderlist_xml() for fresh starts - printf formats for size_t and goffset arguments. - alertpanel API use in win32 part of mimeview.c - pid handling in debug output of kill_children_cb() - incorrect pointer arithmetic in w32_filesel.c Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1822=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1822=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1822=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1822=1 Package List: - openSUSE Leap 15.2 (noarch): claws-mail-lang-3.17.8-lp152.3.6.1 - openSUSE Leap 15.2 (x86_64): claws-mail-3.17.8-lp152.3.6.1 claws-mail-debuginfo-3.17.8-lp152.3.6.1 claws-mail-debugsource-3.17.8-lp152.3.6.1 claws-mail-devel-3.17.8-lp152.3.6.1 - openSUSE Leap 15.1 (x86_64): claws-mail-3.17.8-lp151.2.6.1 claws-mail-debuginfo-3.17.8-lp151.2.6.1 claws-mail-debugsource-3.17.8-lp151.2.6.1 claws-mail-devel-3.17.8-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): claws-mail-lang-3.17.8-lp151.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): claws-mail-3.17.8-bp152.3.6.1 claws-mail-debuginfo-3.17.8-bp152.3.6.1 claws-mail-debugsource-3.17.8-bp152.3.6.1 claws-mail-devel-3.17.8-bp152.3.6.1 - openSUSE Backports SLE-15-SP2 (noarch): claws-mail-lang-3.17.8-bp152.3.6.1 - openSUSE Backports SLE-15-SP1 (x86_64): claws-mail-3.17.8-bp151.3.6.1 claws-mail-devel-3.17.8-bp151.3.6.1 - openSUSE Backports SLE-15-SP1 (noarch): claws-mail-lang-3.17.8-bp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-15917.html https://bugzilla.suse.com/1157594 https://bugzilla.suse.com/1177967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1819-1: important: Security update for samba
by opensuse-security＠opensuse.org 02 Nov '20

02 Nov '20

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1819-1 Rating: important References: #1173902 #1173994 #1177613 Cross-References: CVE-2020-14318 CVE-2020-14323 CVE-2020-14383 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for samba fixes the following issues: Update to samba 4.11.14 - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613). - CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994). - CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902). - lib/util: Do not install /usr/bin/test_util - smbd: don't log success as error - idmap_ad does not deal properly with a RFC4511 section 4.4.1 response; - winbind: Fix a memleak - idmap_ad: Pass tldap debug messages on to DEBUG() - lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE - ctdb disable/enable can fail due to race condition This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1819=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ctdb-4.11.14+git.202.344b137b75d-lp152.3.16.1 ctdb-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 ctdb-pcp-pmda-4.11.14+git.202.344b137b75d-lp152.3.16.1 ctdb-pcp-pmda-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 ctdb-tests-4.11.14+git.202.344b137b75d-lp152.3.16.1 ctdb-tests-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-binding0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-binding0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-samr-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-samr0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-samr0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-krb5pac-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-krb5pac0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-krb5pac0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-nbt-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-nbt0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-nbt0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-standard-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-standard0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-standard0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-credentials-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-credentials0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-credentials0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-errors-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-errors0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-errors0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-hostconfig-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-hostconfig0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-hostconfig0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-passdb-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-passdb0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-passdb0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy-python3-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy0-python3-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy0-python3-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-util-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-util0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-util0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamdb-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamdb0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamdb0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbclient-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbclient0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbclient0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbconf-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbconf0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbconf0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbldap-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbldap2-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbldap2-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libtevent-util-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libtevent-util0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libtevent-util0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libwbclient-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 libwbclient0-4.11.14+git.202.344b137b75d-lp152.3.16.1 libwbclient0-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ad-dc-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ad-dc-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-client-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-client-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-core-devel-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-debugsource-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-dsdb-modules-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-dsdb-modules-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-python3-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-python3-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-python3-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-python3-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-test-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-test-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-winbind-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-winbind-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 - openSUSE Leap 15.2 (noarch): samba-doc-4.11.14+git.202.344b137b75d-lp152.3.16.1 - openSUSE Leap 15.2 (x86_64): libdcerpc-binding0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-binding0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-samr0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc-samr0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libdcerpc0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-krb5pac0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-krb5pac0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-nbt0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-nbt0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-standard0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr-standard0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libndr0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi-devel-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libnetapi0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-credentials0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-credentials0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-errors0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-errors0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-hostconfig0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-hostconfig0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-passdb0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-passdb0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy0-python3-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-policy0-python3-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-util0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamba-util0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamdb0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsamdb0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbclient0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbclient0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbconf0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbconf0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbldap2-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libsmbldap2-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libtevent-util0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libtevent-util0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 libwbclient0-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 libwbclient0-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ad-dc-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ad-dc-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ceph-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-ceph-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-client-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-client-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-python3-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-libs-python3-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-winbind-32bit-4.11.14+git.202.344b137b75d-lp152.3.16.1 samba-winbind-32bit-debuginfo-4.11.14+git.202.344b137b75d-lp152.3.16.1 References: https://www.suse.com/security/cve/CVE-2020-14318.html https://www.suse.com/security/cve/CVE-2020-14323.html https://www.suse.com/security/cve/CVE-2020-14383.html https://bugzilla.suse.com/1173902 https://bugzilla.suse.com/1173994 https://bugzilla.suse.com/1177613 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1812-1: important: Security update for lout
by opensuse-security＠opensuse.org 02 Nov '20

02 Nov '20

openSUSE Security Update: Security update for lout ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1812-1 Rating: important References: #1159713 #1159714 Cross-References: CVE-2019-19917 CVE-2019-19918 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for lout fixes the following issues: - CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713). - CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1812=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): lout-3.40-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-19917.html https://www.suse.com/security/cve/CVE-2019-19918.html https://bugzilla.suse.com/1159713 https://bugzilla.suse.com/1159714 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1813-1: important: Security update for lout
by opensuse-security＠opensuse.org 02 Nov '20

02 Nov '20

openSUSE Security Update: Security update for lout ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1813-1 Rating: important References: #1159713 #1159714 Cross-References: CVE-2019-19917 CVE-2019-19918 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for lout fixes the following issues: - CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713). - CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1813=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): lout-3.40-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-19917.html https://www.suse.com/security/cve/CVE-2019-19918.html https://bugzilla.suse.com/1159713 https://bugzilla.suse.com/1159714 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1814-1: important: Security update for singularity
by opensuse-security＠opensuse.org 02 Nov '20

02 Nov '20

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1814-1 Rating: important References: #1177901 Cross-References: CVE-2020-15229 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity fixes the following issues: Update to new version 3.6.4: - CVE-2020-15229: Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs, it is possible to overwrite/create files on the host filesystem during the extraction of a crafted squashfs filesystem (boo#1177901). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1814=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): singularity-3.6.4-bp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-15229.html https://bugzilla.suse.com/1177901 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1811-1: important: Security update for samba
by opensuse-security＠opensuse.org 02 Nov '20

02 Nov '20

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1811-1 Rating: important References: #1173902 #1173994 #1177613 Cross-References: CVE-2020-14318 CVE-2020-14323 CVE-2020-14383 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for samba fixes the following issues: - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613). - CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994). - CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1811=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ctdb-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 ctdb-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 ctdb-pcp-pmda-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 ctdb-pcp-pmda-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 ctdb-tests-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 ctdb-tests-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-binding0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-binding0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-samr-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-samr0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-samr0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-krb5pac-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-krb5pac0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-krb5pac0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-nbt-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-nbt0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-nbt0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-standard-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-standard0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-standard0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-credentials-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-credentials0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-credentials0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-errors-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-errors0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-errors0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-hostconfig-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-hostconfig0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-hostconfig0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-passdb-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-passdb0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-passdb0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy-python-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy-python3-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-python3-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-python3-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-util-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-util0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-util0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamdb-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamdb0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamdb0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbclient-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbclient0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbclient0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbconf-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbconf0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbconf0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbldap-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbldap2-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbldap2-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libtevent-util-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libtevent-util0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libtevent-util0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libwbclient-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libwbclient0-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libwbclient0-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ad-dc-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ad-dc-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-client-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-client-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-core-devel-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-debugsource-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-dsdb-modules-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-dsdb-modules-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python3-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python3-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-pidl-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-python-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-python-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-python3-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-python3-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-test-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-test-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-winbind-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-winbind-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 - openSUSE Leap 15.1 (noarch): samba-doc-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 - openSUSE Leap 15.1 (x86_64): libdcerpc-binding0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-binding0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-samr0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc-samr0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libdcerpc0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-krb5pac0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-krb5pac0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-nbt0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-nbt0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-standard0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr-standard0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libndr0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi-devel-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libnetapi0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-credentials0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-credentials0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-errors0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-errors0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-hostconfig0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-hostconfig0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-passdb0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-passdb0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-python3-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-policy0-python3-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-util0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamba-util0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamdb0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsamdb0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbclient0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbclient0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbconf0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbconf0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbldap2-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libsmbldap2-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libtevent-util0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libtevent-util0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libwbclient0-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 libwbclient0-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ad-dc-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ad-dc-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ceph-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-ceph-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-client-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-client-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python3-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-libs-python3-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-winbind-32bit-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 samba-winbind-32bit-debuginfo-4.9.5+git.383.7b7f8f14df8-lp151.2.36.1 References: https://www.suse.com/security/cve/CVE-2020-14318.html https://www.suse.com/security/cve/CVE-2020-14323.html https://www.suse.com/security/cve/CVE-2020-14383.html https://bugzilla.suse.com/1173902 https://bugzilla.suse.com/1173994 https://bugzilla.suse.com/1177613 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1810-1: moderate: Security update for pagure
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for pagure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1810-1 Rating: moderate References: #1176987 Cross-References: CVE-2019-11556 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pagure fixes the following issues: - CVE-2019-11556: Fixed XSS via the templates/blame.html blame view (boo#1176987) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1810=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): pagure-5.5-bp151.2.3.1 pagure-ci-5.5-bp151.2.3.1 pagure-ev-5.5-bp151.2.3.1 pagure-loadjson-5.5-bp151.2.3.1 pagure-logcom-5.5-bp151.2.3.1 pagure-milters-5.5-bp151.2.3.1 pagure-mirror-5.5-bp151.2.3.1 pagure-theme-chameleon-5.5-bp151.2.3.1 pagure-theme-default-openSUSE-5.5-bp151.2.3.1 pagure-theme-default-upstream-5.5-bp151.2.3.1 pagure-theme-pagureio-5.5-bp151.2.3.1 pagure-theme-srcfpo-5.5-bp151.2.3.1 pagure-theme-upstream-5.5-bp151.2.3.1 pagure-webhook-5.5-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11556.html https://bugzilla.suse.com/1176987 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1806-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1806-1 Rating: important References: #1167335 #1167336 #1167337 #1177561 #1177562 #1177842 Cross-References: CVE-2020-10802 CVE-2020-10803 CVE-2020-10804 CVE-2020-26934 CVE-2020-26935 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions Update to 4.9.6: - Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5) - Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6) Update to 4.9.5: This is a security release containing several bug fixes. * CVE-2020-10804: SQL injection vulnerability in the user accounts page, particularly when changing a password (boo#1167335, PMASA-2020-2) * CVE-2020-10802: SQL injection vulnerability relating to the search feature (boo#1167336, PMASA-2020-3) * CVE-2020-10803: SQL injection and XSS having to do with displaying results (boo#1167337, PMASA-2020-4) * Removing of the "options" field for the external transformation. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1806=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1806=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-1806=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1806=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.7-lp151.2.24.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.7-bp151.3.24.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.7-bp150.43.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.7-52.1 References: https://www.suse.com/security/cve/CVE-2020-10802.html https://www.suse.com/security/cve/CVE-2020-10803.html https://www.suse.com/security/cve/CVE-2020-10804.html https://www.suse.com/security/cve/CVE-2020-26934.html https://www.suse.com/security/cve/CVE-2020-26935.html https://bugzilla.suse.com/1167335 https://bugzilla.suse.com/1167336 https://bugzilla.suse.com/1167337 https://bugzilla.suse.com/1177561 https://bugzilla.suse.com/1177562 https://bugzilla.suse.com/1177842 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1806-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1806-1 Rating: important References: #1167335 #1167336 #1167337 #1177561 #1177562 #1177842 Cross-References: CVE-2020-10802 CVE-2020-10803 CVE-2020-10804 CVE-2020-26934 CVE-2020-26935 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions Update to 4.9.6: - Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5) - Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6) Update to 4.9.5: This is a security release containing several bug fixes. * CVE-2020-10804: SQL injection vulnerability in the user accounts page, particularly when changing a password (boo#1167335, PMASA-2020-2) * CVE-2020-10802: SQL injection vulnerability relating to the search feature (boo#1167336, PMASA-2020-3) * CVE-2020-10803: SQL injection and XSS having to do with displaying results (boo#1167337, PMASA-2020-4) * Removing of the "options" field for the external transformation. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1806=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1806=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-1806=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.7-lp151.2.24.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.7-bp151.3.24.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.7-bp150.43.1 References: https://www.suse.com/security/cve/CVE-2020-10802.html https://www.suse.com/security/cve/CVE-2020-10803.html https://www.suse.com/security/cve/CVE-2020-10804.html https://www.suse.com/security/cve/CVE-2020-26934.html https://www.suse.com/security/cve/CVE-2020-26935.html https://bugzilla.suse.com/1167335 https://bugzilla.suse.com/1167336 https://bugzilla.suse.com/1167337 https://bugzilla.suse.com/1177561 https://bugzilla.suse.com/1177562 https://bugzilla.suse.com/1177842 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1804-1: moderate: Security update for binutils
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for binutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1804-1 Rating: moderate References: #1126826 #1126829 #1126831 #1140126 #1142649 #1143609 #1153768 #1153770 #1157755 #1160254 #1160590 #1163333 #1163744 Cross-References: CVE-2019-12972 CVE-2019-14250 CVE-2019-14444 CVE-2019-17450 CVE-2019-17451 CVE-2019-9074 CVE-2019-9075 CVE-2019-9077 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 5 fixes is now available. Description: This update for binutils fixes the following issues: binutils was updated to version 2.35. (jsc#ECO-2373) Update to binutils 2.35: * The assembler can now produce DWARF-5 format line number tables. * Readelf now has a "lint" mode to enable extra checks of the files it is processing. * Readelf will now display "[...]" when it has to truncate a symbol name. The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option. * The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler. - fix DT_NEEDED order with -flto [bsc#1163744] Update to binutils 2.34: * The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions. * The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing. * The assembler and linker now support the generation of ELF format files for the Z80 architecture. - Add new subpackages for libctf and libctf-nobfd. - Disable LTO due to bsc#1163333. - Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078 - fix various build fails on aarch64 (PR25210, bsc#1157755). Update to binutils 2.33.1: * Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions. * Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors. * Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals. * For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to "no". * The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details. * Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker. * Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI. * Add -z pac-plt for AArch64 to pick PAC enabled PLTs. * Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly. * Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments. * Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format. * The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info files to also be displayed. In addition when combined with --disassemble the --dwarf= follow-links option will ensure that any symbol tables in the linked files are read and used when disassembling code in the main file. * Add support for dumping types encoded in the Compact Type Format to objdump and readelf. - Includes fixes for these CVEs: bsc#1126826 aka CVE-2019-9077 aka PR1126826 bsc#1126829 aka CVE-2019-9075 aka PR1126829 bsc#1126831 aka CVE-2019-9074 aka PR24235 bsc#1140126 aka CVE-2019-12972 aka PR23405 bsc#1143609 aka CVE-2019-14444 aka PR24829 bsc#1142649 aka CVE-2019-14250 aka PR90924 * Add xBPF target * Fix various problems with DWARF 5 support in gas * fix nm -B for objects compiled with -flto and -fcommon. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1804=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): binutils-2.35-lp152.4.3.1 binutils-debuginfo-2.35-lp152.4.3.1 binutils-debugsource-2.35-lp152.4.3.1 binutils-devel-2.35-lp152.4.3.1 binutils-gold-2.35-lp152.4.3.1 binutils-gold-debuginfo-2.35-lp152.4.3.1 libctf-nobfd0-2.35-lp152.4.3.1 libctf-nobfd0-debuginfo-2.35-lp152.4.3.1 libctf0-2.35-lp152.4.3.1 libctf0-debuginfo-2.35-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): binutils-devel-32bit-2.35-lp152.4.3.1 cross-aarch64-binutils-2.35-lp152.4.3.1 cross-aarch64-binutils-debuginfo-2.35-lp152.4.3.1 cross-aarch64-binutils-debugsource-2.35-lp152.4.3.1 cross-arm-binutils-2.35-lp152.4.3.1 cross-arm-binutils-debuginfo-2.35-lp152.4.3.1 cross-arm-binutils-debugsource-2.35-lp152.4.3.1 cross-avr-binutils-2.35-lp152.4.3.1 cross-avr-binutils-debuginfo-2.35-lp152.4.3.1 cross-avr-binutils-debugsource-2.35-lp152.4.3.1 cross-epiphany-binutils-2.35-lp152.4.3.1 cross-epiphany-binutils-debuginfo-2.35-lp152.4.3.1 cross-epiphany-binutils-debugsource-2.35-lp152.4.3.1 cross-hppa-binutils-2.35-lp152.4.3.1 cross-hppa-binutils-debuginfo-2.35-lp152.4.3.1 cross-hppa-binutils-debugsource-2.35-lp152.4.3.1 cross-hppa64-binutils-2.35-lp152.4.3.1 cross-hppa64-binutils-debuginfo-2.35-lp152.4.3.1 cross-hppa64-binutils-debugsource-2.35-lp152.4.3.1 cross-i386-binutils-2.35-lp152.4.3.1 cross-i386-binutils-debuginfo-2.35-lp152.4.3.1 cross-i386-binutils-debugsource-2.35-lp152.4.3.1 cross-ia64-binutils-2.35-lp152.4.3.1 cross-ia64-binutils-debuginfo-2.35-lp152.4.3.1 cross-ia64-binutils-debugsource-2.35-lp152.4.3.1 cross-m68k-binutils-2.35-lp152.4.3.1 cross-m68k-binutils-debuginfo-2.35-lp152.4.3.1 cross-m68k-binutils-debugsource-2.35-lp152.4.3.1 cross-mips-binutils-2.35-lp152.4.3.1 cross-mips-binutils-debuginfo-2.35-lp152.4.3.1 cross-mips-binutils-debugsource-2.35-lp152.4.3.1 cross-ppc-binutils-2.35-lp152.4.3.1 cross-ppc-binutils-debuginfo-2.35-lp152.4.3.1 cross-ppc-binutils-debugsource-2.35-lp152.4.3.1 cross-ppc64-binutils-2.35-lp152.4.3.1 cross-ppc64-binutils-debuginfo-2.35-lp152.4.3.1 cross-ppc64-binutils-debugsource-2.35-lp152.4.3.1 cross-ppc64le-binutils-2.35-lp152.4.3.1 cross-ppc64le-binutils-debuginfo-2.35-lp152.4.3.1 cross-ppc64le-binutils-debugsource-2.35-lp152.4.3.1 cross-riscv64-binutils-2.35-lp152.4.3.1 cross-riscv64-binutils-debuginfo-2.35-lp152.4.3.1 cross-riscv64-binutils-debugsource-2.35-lp152.4.3.1 cross-rx-binutils-2.35-lp152.4.3.1 cross-rx-binutils-debuginfo-2.35-lp152.4.3.1 cross-rx-binutils-debugsource-2.35-lp152.4.3.1 cross-s390-binutils-2.35-lp152.4.3.1 cross-s390-binutils-debuginfo-2.35-lp152.4.3.1 cross-s390-binutils-debugsource-2.35-lp152.4.3.1 cross-s390x-binutils-2.35-lp152.4.3.1 cross-s390x-binutils-debuginfo-2.35-lp152.4.3.1 cross-s390x-binutils-debugsource-2.35-lp152.4.3.1 cross-sparc-binutils-2.35-lp152.4.3.1 cross-sparc-binutils-debuginfo-2.35-lp152.4.3.1 cross-sparc-binutils-debugsource-2.35-lp152.4.3.1 cross-sparc64-binutils-2.35-lp152.4.3.1 cross-sparc64-binutils-debuginfo-2.35-lp152.4.3.1 cross-sparc64-binutils-debugsource-2.35-lp152.4.3.1 cross-spu-binutils-2.35-lp152.4.3.1 cross-spu-binutils-debuginfo-2.35-lp152.4.3.1 cross-spu-binutils-debugsource-2.35-lp152.4.3.1 cross-xtensa-binutils-2.35-lp152.4.3.1 cross-xtensa-binutils-debuginfo-2.35-lp152.4.3.1 cross-xtensa-binutils-debugsource-2.35-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-12972.html https://www.suse.com/security/cve/CVE-2019-14250.html https://www.suse.com/security/cve/CVE-2019-14444.html https://www.suse.com/security/cve/CVE-2019-17450.html https://www.suse.com/security/cve/CVE-2019-17451.html https://www.suse.com/security/cve/CVE-2019-9074.html https://www.suse.com/security/cve/CVE-2019-9075.html https://www.suse.com/security/cve/CVE-2019-9077.html https://bugzilla.suse.com/1126826 https://bugzilla.suse.com/1126829 https://bugzilla.suse.com/1126831 https://bugzilla.suse.com/1140126 https://bugzilla.suse.com/1142649 https://bugzilla.suse.com/1143609 https://bugzilla.suse.com/1153768 https://bugzilla.suse.com/1153770 https://bugzilla.suse.com/1157755 https://bugzilla.suse.com/1160254 https://bugzilla.suse.com/1160590 https://bugzilla.suse.com/1163333 https://bugzilla.suse.com/1163744 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1798-1: important: Security update for sane-backends
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for sane-backends ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1798-1 Rating: important References: #1172524 Cross-References: CVE-2020-12861 CVE-2020-12862 CVE-2020-12863 CVE-2020-12864 CVE-2020-12865 CVE-2020-12866 CVE-2020-12867 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for sane-backends fixes the following issues: sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues: - CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524) - CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524) - CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524) The upstream changelogs can be found here: - https://gitlab.com/sane-project/backends/-/releases/1.0.28 - https://gitlab.com/sane-project/backends/-/releases/1.0.29 - https://gitlab.com/sane-project/backends/-/releases/1.0.30 - https://gitlab.com/sane-project/backends/-/releases/1.0.31 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1798=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): sane-backends-1.0.31-lp152.7.3.1 sane-backends-autoconfig-1.0.31-lp152.7.3.1 sane-backends-debuginfo-1.0.31-lp152.7.3.1 sane-backends-debugsource-1.0.31-lp152.7.3.1 sane-backends-devel-1.0.31-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): sane-backends-32bit-1.0.31-lp152.7.3.1 sane-backends-32bit-debuginfo-1.0.31-lp152.7.3.1 sane-backends-devel-32bit-1.0.31-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-12861.html https://www.suse.com/security/cve/CVE-2020-12862.html https://www.suse.com/security/cve/CVE-2020-12863.html https://www.suse.com/security/cve/CVE-2020-12864.html https://www.suse.com/security/cve/CVE-2020-12865.html https://www.suse.com/security/cve/CVE-2020-12866.html https://www.suse.com/security/cve/CVE-2020-12867.html https://bugzilla.suse.com/1172524 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1799-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1799-1 Rating: moderate References: #1177582 Cross-References: CVE-2020-13943 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1799=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.10.1 tomcat-admin-webapps-9.0.36-lp152.2.10.1 tomcat-docs-webapp-9.0.36-lp152.2.10.1 tomcat-el-3_0-api-9.0.36-lp152.2.10.1 tomcat-embed-9.0.36-lp152.2.10.1 tomcat-javadoc-9.0.36-lp152.2.10.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.10.1 tomcat-jsvc-9.0.36-lp152.2.10.1 tomcat-lib-9.0.36-lp152.2.10.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.10.1 tomcat-webapps-9.0.36-lp152.2.10.1 References: https://www.suse.com/security/cve/CVE-2020-13943.html https://bugzilla.suse.com/1177582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1802-1: moderate: Security update for spice
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1802-1 Rating: moderate References: #1177158 Cross-References: CVE-2020-14355 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1802=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libspice-server-devel-0.14.2-lp152.2.3.1 libspice-server1-0.14.2-lp152.2.3.1 libspice-server1-debuginfo-0.14.2-lp152.2.3.1 spice-debugsource-0.14.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14355.html https://bugzilla.suse.com/1177158 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1803-1: moderate: Security update for spice-gtk
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1803-1 Rating: moderate References: #1177158 Cross-References: CVE-2020-14355 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice-gtk fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1803=1 Package List: - openSUSE Leap 15.2 (noarch): spice-gtk-lang-0.37-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libspice-client-glib-2_0-8-0.37-lp152.2.3.1 libspice-client-glib-2_0-8-debuginfo-0.37-lp152.2.3.1 libspice-client-glib-helper-0.37-lp152.2.3.1 libspice-client-glib-helper-debuginfo-0.37-lp152.2.3.1 libspice-client-gtk-3_0-5-0.37-lp152.2.3.1 libspice-client-gtk-3_0-5-debuginfo-0.37-lp152.2.3.1 spice-gtk-0.37-lp152.2.3.1 spice-gtk-debuginfo-0.37-lp152.2.3.1 spice-gtk-debugsource-0.37-lp152.2.3.1 spice-gtk-devel-0.37-lp152.2.3.1 typelib-1_0-SpiceClientGlib-2_0-0.37-lp152.2.3.1 typelib-1_0-SpiceClientGtk-3_0-0.37-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14355.html https://bugzilla.suse.com/1177158 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0