November 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1841-1: critical: Security update for tigervnc
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1841-1 Rating: critical References: #1176733 Cross-References: CVE-2020-26117 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tigervnc fixes the following issues: - CVE-2020-26117: Server certificates were stored as certiticate authorities, allowing malicious owners of these certificates to impersonate any server after a client had added an exception (bsc#1176733) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1841=1 Package List: - openSUSE Leap 15.1 (x86_64): libXvnc-devel-1.9.0-lp151.4.9.1 libXvnc1-1.9.0-lp151.4.9.1 libXvnc1-debuginfo-1.9.0-lp151.4.9.1 tigervnc-1.9.0-lp151.4.9.1 tigervnc-debuginfo-1.9.0-lp151.4.9.1 tigervnc-debugsource-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-debuginfo-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-module-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-module-debuginfo-1.9.0-lp151.4.9.1 - openSUSE Leap 15.1 (noarch): tigervnc-x11vnc-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-java-1.9.0-lp151.4.9.1 xorg-x11-Xvnc-novnc-1.9.0-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-26117.html https://bugzilla.suse.com/1176733 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1840-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1840-1 Rating: moderate References: #1146608 Cross-References: CVE-2019-14973 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tiff fixes the following issues: - CVE-2019-14973: Fixed an improper check which was depended on the compiler which could have led to integer overflow (bsc#1146608). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1840=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtiff-devel-4.0.9-lp151.10.3.1 libtiff5-4.0.9-lp151.10.3.1 libtiff5-debuginfo-4.0.9-lp151.10.3.1 tiff-4.0.9-lp151.10.3.1 tiff-debuginfo-4.0.9-lp151.10.3.1 tiff-debugsource-4.0.9-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): libtiff-devel-32bit-4.0.9-lp151.10.3.1 libtiff5-32bit-4.0.9-lp151.10.3.1 libtiff5-32bit-debuginfo-4.0.9-lp151.10.3.1 References: https://www.suse.com/security/cve/CVE-2019-14973.html https://bugzilla.suse.com/1146608 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1834-1: moderate: Security update for tmux
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1834-1 Rating: moderate References: #1037468 #1116887 #1120170 #1178263 Cross-References: CVE-2018-19387 CVE-2020-27347 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for tmux fixes the following issues: - Update to version 3.1c * Fix a stack overflow on colon-separated CSI parsing. boo#1178263 CVE-2020-27347 - tmux 3.1b: * Fix crash when allow-rename ison and an empty name is set - tmux 3.1a: * Do not close stdout prematurely in control mode since it is needed to print exit messages. Prevents hanging when detaching with iTerm2 - includes changes between 3.1-rc1 and 3.1: * Only search the visible part of the history when marking (highlighting) search terms. This is much faster than searching the whole history and solves problems with large histories. The count of matches shown is now the visible matches rather than all matches * Search using regular expressions in copy mode. search-forward and search-backward use regular expressions by default; the incremental versions do not * Turn off mouse mode 1003 as well as the rest when exiting * Add selection_active format for when the selection is present but not moving with the cursor * Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and C-MouseDragEnd1Pane now work * Add -a to list-keys to also list keys without notes with -N * Do not jump to next word end if already on a word end when selecting a word; fixes select-word with single character words and vi(1) keys * Fix top and bottom pane calculation with pane border status enabled - Update to v3.1-rc * Please see the included CHANGES file - Fix tmux completion - Update to v3.0a * A lot of changes since v2.9a, please see the included CHANGES file. - Update to v2.9a - Fix bugs in select-pane and the main-horizontal and main-vertical layouts. - Add trailing newline to tmpfiles.d/tmux.conf. On newer systems (such as Leap 15.1), the lack of a trailing newline appears to cause the directory to not be created. This is only evident on setups where /run is an actual tmpfs (on btrfs-root installs, /run is a btrfs subvolume and thus /run/tmux is persistent across reboots). - Update to version 2.9 * Add format variables for the default formats in the various modes (tree_mode_format and so on) and add a -a flag to display-message to list variables with values. * Add a -v flag to display-message to show verbose messages as the format is parsed, this allows formats to be debugged * Add support for HPA (\033[`). * Add support for origin mode (\033[?6h). * No longer clear history on RIS. * Extend the #[] style syntax and use that together with previous format changes to allow the status line to be entirely configured with a single option. * Add E: and T: format modifiers to expand a format twice (useful to expand the value of an option). * The individual -fg, -bg and -attr options have been removed; they were superseded by -style options in tmux 1.9. * Add -b to display-panes like run-shell. * Handle UTF-8 in word-separators option. * New "terminal" colour allowing options to use the terminal default colour rather than inheriting the default from a parent option. * Do not move the cursor in copy mode when the mouse wheel is used. * Use the same working directory rules for jobs as new windows rather than always starting in the user's home. * Allow panes to be one line or column in size. * Go to last line when goto-line number is out of range in copy mode. * Yank previously cut text if any with C-y in the command prompt, only use the buffer if no text has been cut. * Add q: format modifier to quote shell special characters. * Add -Z to find-window. * Support for windows larger than the client. This adds two new options, window-size and default-size, and a new command, resize-window. The force-width and force-height options and the session_width and session_height formats have been removed. - update to 2.8 - move bash-completion to right place * Make display-panes block the client until a pane is chosen or it times out. * Clear history on RIS like most other terminals do. * Add an "Any" key to run a command if a key is pressed that is not bound in the current key table. * Expand formats in load-buffer and save-buffer. * Add a rectangle_toggle format. * Add set-hook -R to run a hook immediately. * Add pane focus hooks. * Allow any punctuation as separator for s/x/y not only /. * Improve resizing with the mouse (fix resizing the wrong pane in some layouts, and allow resizing multiple panes at the same time). * Allow , and } to be escaped in formats as #, and #}. * Add KRB5CCNAME to update-environment. * Change meaning of -c to display-message so the client is used if it matches the session given to -t. * Fixes to : form of SGR. * Add x and X to choose-tree to kill sessions, windows or panes. - Add bash completion for tmux - Update to 2.7 * Remove EVENT_* variables from environment on platforms where tmux uses them so they do not pass on to panes. * Fixed for hooks at server exit. * Remove SGR 10 (was equivalent to SGR 0 but no other terminal seems to do this). * Expand formats in window and session names. * Add -Z flag to choose-tree, choose-client, choose-buffer to automatically zoom the pane when the mode is entered and unzoom when it exits, assuming the pane is not already zoomed. This is now part of the default key bindings. * Add C-g to exit modes with emacs keys. * Add exit-empty option to exit server if no sessions (default = on) * Show if a filter is present in choose modes. * Add pipe-pane -I to to connect stdin of the child process. * Performance improvements for reflow. * Use RGB terminfo(5) capability to detect RGB colour terminals (the existing Tc extension remains unchanged). * Support for ISO colon-separated SGR sequences. * Add select-layout -E to spread panes out evenly (bound to E key). * Support wide characters properly when reflowing. * Pass PWD to new panes as a hint to shells, as well as calling chdir(). * Performance improvements for the various choose modes. * Only show first member of session groups in tree mode (-G flag to choose-tree to show all). * Support %else in config files to match %if * Fix "kind" terminfo(5) capability to be S-Down not S-Up. * Add a box around the preview label in tree mode. * Show exit status and time in the remain-on-exit pane text * Correctly use pane-base-index in tree mode. * Change the allow-rename option default to off. * Support for xterm(1) title stack escape sequences * Correctly remove padding cells to fix a UTF-8 display problem - build from release tarball instead of source (drops automake dep) - Bash completion is now removed and provided by - cleanup specfile directory with tmpfiles.d functionality in /run/tmux Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1834=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1834=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1834=1 Package List: - openSUSE Leap 15.2 (x86_64): tmux-3.1c-lp152.2.3.1 tmux-debuginfo-3.1c-lp152.2.3.1 tmux-debugsource-3.1c-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): tmux-3.1c-lp151.3.3.1 tmux-debuginfo-3.1c-lp151.3.3.1 tmux-debugsource-3.1c-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tmux-3.1c-bp152.2.3.1 tmux-debuginfo-3.1c-bp152.2.3.1 tmux-debugsource-3.1c-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): tmux-3.1c-bp151.4.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-3.1c-18.1 References: https://www.suse.com/security/cve/CVE-2018-19387.html https://www.suse.com/security/cve/CVE-2020-27347.html https://bugzilla.suse.com/1037468 https://bugzilla.suse.com/1116887 https://bugzilla.suse.com/1120170 https://bugzilla.suse.com/1178263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1842-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1842-1 Rating: moderate References: #1177582 Cross-References: CVE-2020-13943 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1842=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.36-lp151.3.33.1 tomcat-admin-webapps-9.0.36-lp151.3.33.1 tomcat-docs-webapp-9.0.36-lp151.3.33.1 tomcat-el-3_0-api-9.0.36-lp151.3.33.1 tomcat-embed-9.0.36-lp151.3.33.1 tomcat-javadoc-9.0.36-lp151.3.33.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.33.1 tomcat-jsvc-9.0.36-lp151.3.33.1 tomcat-lib-9.0.36-lp151.3.33.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.33.1 tomcat-webapps-9.0.36-lp151.3.33.1 References: https://www.suse.com/security/cve/CVE-2020-13943.html https://bugzilla.suse.com/1177582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1834-1: moderate: Security update for tmux
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1834-1 Rating: moderate References: #1037468 #1116887 #1120170 #1178263 Cross-References: CVE-2018-19387 CVE-2020-27347 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for tmux fixes the following issues: - Update to version 3.1c * Fix a stack overflow on colon-separated CSI parsing. boo#1178263 CVE-2020-27347 - tmux 3.1b: * Fix crash when allow-rename ison and an empty name is set - tmux 3.1a: * Do not close stdout prematurely in control mode since it is needed to print exit messages. Prevents hanging when detaching with iTerm2 - includes changes between 3.1-rc1 and 3.1: * Only search the visible part of the history when marking (highlighting) search terms. This is much faster than searching the whole history and solves problems with large histories. The count of matches shown is now the visible matches rather than all matches * Search using regular expressions in copy mode. search-forward and search-backward use regular expressions by default; the incremental versions do not * Turn off mouse mode 1003 as well as the rest when exiting * Add selection_active format for when the selection is present but not moving with the cursor * Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and C-MouseDragEnd1Pane now work * Add -a to list-keys to also list keys without notes with -N * Do not jump to next word end if already on a word end when selecting a word; fixes select-word with single character words and vi(1) keys * Fix top and bottom pane calculation with pane border status enabled - Update to v3.1-rc * Please see the included CHANGES file - Fix tmux completion - Update to v3.0a * A lot of changes since v2.9a, please see the included CHANGES file. - Update to v2.9a - Fix bugs in select-pane and the main-horizontal and main-vertical layouts. - Add trailing newline to tmpfiles.d/tmux.conf. On newer systems (such as Leap 15.1), the lack of a trailing newline appears to cause the directory to not be created. This is only evident on setups where /run is an actual tmpfs (on btrfs-root installs, /run is a btrfs subvolume and thus /run/tmux is persistent across reboots). - Update to version 2.9 * Add format variables for the default formats in the various modes (tree_mode_format and so on) and add a -a flag to display-message to list variables with values. * Add a -v flag to display-message to show verbose messages as the format is parsed, this allows formats to be debugged * Add support for HPA (\033[`). * Add support for origin mode (\033[?6h). * No longer clear history on RIS. * Extend the #[] style syntax and use that together with previous format changes to allow the status line to be entirely configured with a single option. * Add E: and T: format modifiers to expand a format twice (useful to expand the value of an option). * The individual -fg, -bg and -attr options have been removed; they were superseded by -style options in tmux 1.9. * Add -b to display-panes like run-shell. * Handle UTF-8 in word-separators option. * New "terminal" colour allowing options to use the terminal default colour rather than inheriting the default from a parent option. * Do not move the cursor in copy mode when the mouse wheel is used. * Use the same working directory rules for jobs as new windows rather than always starting in the user's home. * Allow panes to be one line or column in size. * Go to last line when goto-line number is out of range in copy mode. * Yank previously cut text if any with C-y in the command prompt, only use the buffer if no text has been cut. * Add q: format modifier to quote shell special characters. * Add -Z to find-window. * Support for windows larger than the client. This adds two new options, window-size and default-size, and a new command, resize-window. The force-width and force-height options and the session_width and session_height formats have been removed. - update to 2.8 - move bash-completion to right place * Make display-panes block the client until a pane is chosen or it times out. * Clear history on RIS like most other terminals do. * Add an "Any" key to run a command if a key is pressed that is not bound in the current key table. * Expand formats in load-buffer and save-buffer. * Add a rectangle_toggle format. * Add set-hook -R to run a hook immediately. * Add pane focus hooks. * Allow any punctuation as separator for s/x/y not only /. * Improve resizing with the mouse (fix resizing the wrong pane in some layouts, and allow resizing multiple panes at the same time). * Allow , and } to be escaped in formats as #, and #}. * Add KRB5CCNAME to update-environment. * Change meaning of -c to display-message so the client is used if it matches the session given to -t. * Fixes to : form of SGR. * Add x and X to choose-tree to kill sessions, windows or panes. - Add bash completion for tmux - Update to 2.7 * Remove EVENT_* variables from environment on platforms where tmux uses them so they do not pass on to panes. * Fixed for hooks at server exit. * Remove SGR 10 (was equivalent to SGR 0 but no other terminal seems to do this). * Expand formats in window and session names. * Add -Z flag to choose-tree, choose-client, choose-buffer to automatically zoom the pane when the mode is entered and unzoom when it exits, assuming the pane is not already zoomed. This is now part of the default key bindings. * Add C-g to exit modes with emacs keys. * Add exit-empty option to exit server if no sessions (default = on) * Show if a filter is present in choose modes. * Add pipe-pane -I to to connect stdin of the child process. * Performance improvements for reflow. * Use RGB terminfo(5) capability to detect RGB colour terminals (the existing Tc extension remains unchanged). * Support for ISO colon-separated SGR sequences. * Add select-layout -E to spread panes out evenly (bound to E key). * Support wide characters properly when reflowing. * Pass PWD to new panes as a hint to shells, as well as calling chdir(). * Performance improvements for the various choose modes. * Only show first member of session groups in tree mode (-G flag to choose-tree to show all). * Support %else in config files to match %if * Fix "kind" terminfo(5) capability to be S-Down not S-Up. * Add a box around the preview label in tree mode. * Show exit status and time in the remain-on-exit pane text * Correctly use pane-base-index in tree mode. * Change the allow-rename option default to off. * Support for xterm(1) title stack escape sequences * Correctly remove padding cells to fix a UTF-8 display problem - build from release tarball instead of source (drops automake dep) - Bash completion is now removed and provided by - cleanup specfile directory with tmpfiles.d functionality in /run/tmux Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1834=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-3.1c-18.1 References: https://www.suse.com/security/cve/CVE-2018-19387.html https://www.suse.com/security/cve/CVE-2020-27347.html https://bugzilla.suse.com/1037468 https://bugzilla.suse.com/1116887 https://bugzilla.suse.com/1120170 https://bugzilla.suse.com/1178263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1843-1: moderate: Security update for transfig
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1843-1 Rating: moderate References: #1143650 Cross-References: CVE-2019-14275 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for transfig fixes the following issues: Security issue fixed: - CVE-2019-14275: Fixed stack-based buffer overflow in the calc_arrow function (bsc#1143650). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1843=1 Package List: - openSUSE Leap 15.1 (x86_64): transfig-3.2.6a-lp151.4.9.1 transfig-debuginfo-3.2.6a-lp151.4.9.1 transfig-debugsource-3.2.6a-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-14275.html https://bugzilla.suse.com/1143650 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1833-1: critical: Security update for salt
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1833-1 Rating: critical References: #1159670 #1175987 #1176024 #1176294 #1176397 #1177867 #1178319 #1178361 #1178362 Cross-References: CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for salt fixes the following issues: - Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846) - Fix disk.blkid to avoid unexpected keyword argument '__pub_user'. (bsc#1177867) - Ensure virt.update stop_on_reboot is updated with its default value. - Do not break package building for systemd OSes. - Drop wrong mock from chroot unit test. - Support systemd versions with dot. (bsc#1176294) - Fix for grains.test_core unit test. - Fix file/directory user and group ownership containing UTF-8 characters. (bsc#1176024) - Several changes to virtualization: * Fix virt update when cpu and memory are changed. * Memory Tuning GSoC. * Properly fix memory setting regression in virt.update. * Expose libvirt on_reboot in virt states. - Support transactional systems (MicroOS). - zypperpkg module ignores retcode 104 for search(). (bsc#1159670) - Xen disk fixes. No longer generates volumes for Xen disks, but the corresponding file or block disk. (bsc#1175987) - Invalidate file list cache when cache file modified time is in the future. (bsc#1176397) - Prevent import errors when running test_btrfs unit tests. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1833=1 Package List: - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.15.1 python3-salt-3000-lp152.3.15.1 salt-3000-lp152.3.15.1 salt-api-3000-lp152.3.15.1 salt-cloud-3000-lp152.3.15.1 salt-doc-3000-lp152.3.15.1 salt-master-3000-lp152.3.15.1 salt-minion-3000-lp152.3.15.1 salt-proxy-3000-lp152.3.15.1 salt-ssh-3000-lp152.3.15.1 salt-standalone-formulas-configuration-3000-lp152.3.15.1 salt-syndic-3000-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.15.1 salt-fish-completion-3000-lp152.3.15.1 salt-zsh-completion-3000-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-16846.html https://www.suse.com/security/cve/CVE-2020-17490.html https://www.suse.com/security/cve/CVE-2020-25592.html https://bugzilla.suse.com/1159670 https://bugzilla.suse.com/1175987 https://bugzilla.suse.com/1176024 https://bugzilla.suse.com/1176294 https://bugzilla.suse.com/1176397 https://bugzilla.suse.com/1177867 https://bugzilla.suse.com/1178319 https://bugzilla.suse.com/1178361 https://bugzilla.suse.com/1178362 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1831-1: important: Security update for chromium
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1831-1 Rating: important References: #1178375 Cross-References: CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 CVE-2020-16011 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1831=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1831=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1831=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-86.0.4240.183-lp152.2.45.1 chromedriver-debuginfo-86.0.4240.183-lp152.2.45.1 chromium-86.0.4240.183-lp152.2.45.1 chromium-debuginfo-86.0.4240.183-lp152.2.45.1 - openSUSE Leap 15.1 (x86_64): chromedriver-86.0.4240.183-lp151.2.150.1 chromedriver-debuginfo-86.0.4240.183-lp151.2.150.1 chromium-86.0.4240.183-lp151.2.150.1 chromium-debuginfo-86.0.4240.183-lp151.2.150.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-86.0.4240.183-bp151.3.119.1 chromium-86.0.4240.183-bp151.3.119.1 References: https://www.suse.com/security/cve/CVE-2020-16004.html https://www.suse.com/security/cve/CVE-2020-16005.html https://www.suse.com/security/cve/CVE-2020-16006.html https://www.suse.com/security/cve/CVE-2020-16007.html https://www.suse.com/security/cve/CVE-2020-16008.html https://www.suse.com/security/cve/CVE-2020-16009.html https://www.suse.com/security/cve/CVE-2020-16011.html https://bugzilla.suse.com/1178375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1829-1: important: Security update for chromium, gn
by opensuse-security＠opensuse.org 05 Nov '20

05 Nov '20

openSUSE Security Update: Security update for chromium, gn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1829-1 Rating: important References: #1177408 #1177936 #1178375 Cross-References: CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 CVE-2020-16011 CVE-2020-6557 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 39 vulnerabilities is now available. Description: This update for chromium, gn fixes the following issues: chromium was updated to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. - chromium-86-f_seal.patch: F_SEAL* definitions added for leap 15.1 and 15.2 - Remove vdpau->vaapi bridge as it breaks a lot: (fixes welcome by someone else than me) - Fix cookiemonster: Update to 86.0.4240.75 boo#1177408: * CVE-2020-15967: Use after free in payments. * CVE-2020-15968: Use after free in Blink. * CVE-2020-15969: Use after free in WebRTC. * CVE-2020-15970: Use after free in NFC. * CVE-2020-15971: Use after free in printing. * CVE-2020-15972: Use after free in audio. * CVE-2020-15990: Use after free in autofill. * CVE-2020-15991: Use after free in password manager. * CVE-2020-15973: Insufficient policy enforcement in extensions. * CVE-2020-15974: Integer overflow in Blink. * CVE-2020-15975: Integer overflow in SwiftShader. * CVE-2020-15976: Use after free in WebXR. * CVE-2020-6557: Inappropriate implementation in networking. * CVE-2020-15977: Insufficient data validation in dialogs. * CVE-2020-15978: Insufficient data validation in navigation. * CVE-2020-15979: Inappropriate implementation in V8. * CVE-2020-15980: Insufficient policy enforcement in Intents. * CVE-2020-15981: Out of bounds read in audio. * CVE-2020-15982: Side-channel information leakage in cache. * CVE-2020-15983: Insufficient data validation in webUI. * CVE-2020-15984: Insufficient policy enforcement in Omnibox. * CVE-2020-15985: Inappropriate implementation in Blink. * CVE-2020-15986: Integer overflow in media. * CVE-2020-15987: Use after free in WebRTC. * CVE-2020-15992: Insufficient policy enforcement in networking. * CVE-2020-15988: Insufficient policy enforcement in downloads. * CVE-2020-15989: Uninitialized Use in PDFium. - Update to 0.1807: * no upstream changelog Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1829=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): gn-0.1807-bp152.2.3.4 gn-debuginfo-0.1807-bp152.2.3.4 gn-debugsource-0.1807-bp152.2.3.4 - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-86.0.4240.183-bp152.2.26.1 chromium-86.0.4240.183-bp152.2.26.1 References: https://www.suse.com/security/cve/CVE-2020-15967.html https://www.suse.com/security/cve/CVE-2020-15968.html https://www.suse.com/security/cve/CVE-2020-15969.html https://www.suse.com/security/cve/CVE-2020-15970.html https://www.suse.com/security/cve/CVE-2020-15971.html https://www.suse.com/security/cve/CVE-2020-15972.html https://www.suse.com/security/cve/CVE-2020-15973.html https://www.suse.com/security/cve/CVE-2020-15974.html https://www.suse.com/security/cve/CVE-2020-15975.html https://www.suse.com/security/cve/CVE-2020-15976.html https://www.suse.com/security/cve/CVE-2020-15977.html https://www.suse.com/security/cve/CVE-2020-15978.html https://www.suse.com/security/cve/CVE-2020-15979.html https://www.suse.com/security/cve/CVE-2020-15980.html https://www.suse.com/security/cve/CVE-2020-15981.html https://www.suse.com/security/cve/CVE-2020-15982.html https://www.suse.com/security/cve/CVE-2020-15983.html https://www.suse.com/security/cve/CVE-2020-15984.html https://www.suse.com/security/cve/CVE-2020-15985.html https://www.suse.com/security/cve/CVE-2020-15986.html https://www.suse.com/security/cve/CVE-2020-15987.html https://www.suse.com/security/cve/CVE-2020-15988.html https://www.suse.com/security/cve/CVE-2020-15989.html https://www.suse.com/security/cve/CVE-2020-15990.html https://www.suse.com/security/cve/CVE-2020-15991.html https://www.suse.com/security/cve/CVE-2020-15992.html https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://www.suse.com/security/cve/CVE-2020-16004.html https://www.suse.com/security/cve/CVE-2020-16005.html https://www.suse.com/security/cve/CVE-2020-16006.html https://www.suse.com/security/cve/CVE-2020-16007.html https://www.suse.com/security/cve/CVE-2020-16008.html https://www.suse.com/security/cve/CVE-2020-16009.html https://www.suse.com/security/cve/CVE-2020-16011.html https://www.suse.com/security/cve/CVE-2020-6557.html https://bugzilla.suse.com/1177408 https://bugzilla.suse.com/1177936 https://bugzilla.suse.com/1178375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1825-1: important: Security update for pacemaker
by opensuse-security＠opensuse.org 04 Nov '20

04 Nov '20

openSUSE Security Update: Security update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1825-1 Rating: important References: #1167171 #1173668 #1175557 #1177916 Cross-References: CVE-2020-25654 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for pacemaker fixes the following issues: - executor: restrict certain IPC requests to Pacemaker daemons (CVE-2020-25654, bsc#1177916) - extra: add vim modelines to agents - extra: quote shell variables in agent code where appropriate (bsc#1175557) - extra: remove trailing whitespace from agent code - extra: update agent boilerplate (copyright/license notices) - extra: use 4-space indents in resource agent code - extra: use ":=" where appropriate in agent code - fencer: restrict certain IPC requests to privileged users (CVE-2020-25654, bsc#1177916) - move bcond_with/without up front for e.g. pcmk_release - pacemakerd: ignore shutdown requests from unprivileged users (CVE-2020-25654, bsc#1177916) - rpm: add spec option for enabling CIB secrets - rpm: put user-configurable items at top of spec - rpm: use the user/group ID 90 for haclient/hacluster to be consistent with cluster-glue (bsc#1167171) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1825=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpacemaker-devel-2.0.1+20190417.13d370ca9-lp151.2.16.4 libpacemaker3-2.0.1+20190417.13d370ca9-lp151.2.16.4 libpacemaker3-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-cli-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-cli-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-debugsource-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-remote-2.0.1+20190417.13d370ca9-lp151.2.16.4 pacemaker-remote-debuginfo-2.0.1+20190417.13d370ca9-lp151.2.16.4 - openSUSE Leap 15.1 (noarch): pacemaker-cts-2.0.1+20190417.13d370ca9-lp151.2.16.4 References: https://www.suse.com/security/cve/CVE-2020-25654.html https://bugzilla.suse.com/1167171 https://bugzilla.suse.com/1173668 https://bugzilla.suse.com/1175557 https://bugzilla.suse.com/1177916 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0