December 2020

openSUSE-SU-2020:2367-1: moderate: Security update for groovy
by opensuse-security＠opensuse.org 31 Dec '20

31 Dec '20

openSUSE Security Update: Security update for groovy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2367-1 Rating: moderate References: #1179729 Cross-References: CVE-2020-17521 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2363-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 30 Dec '20

30 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2363-1 Rating: important References: #1177672 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for … [View More]

1 0

openSUSE-SU-2020:2361-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2361-1 Rating: important References: #1177672 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for … [View More]

1 0

openSUSE-SU-2020:2359-1: important: Security update for opera
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2359-1 Rating: important References: Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.1:NonFree … [View More]______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 73.0.3856.284 - CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88 - DNA-88454 Background of snap area above visible scrolled viewport is not captured - DNA-89749 Implement client_capabilities support for Flow / Sync - DNA-89810 Opera no longer autoselects full url/address bar when clicked - DNA-89923 [Snap] Emojis look grayed out - DNA-90060 Make gesture events work with search-in-tabs feature - DNA-90168 Display SD suggestions titles - DNA-90176 Player doesn��t show music service to choose on Welcome page - DNA-90343 [Mac] Cmd+C doesn��t copy snapshot - DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - The update to chromium 87.0.4280.88 fixes following issues: CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042 - Update to version 73.0.3856.257 - DNA-89918 #enable-force-dark flag doesn��t work anymore - DNA-90061 Clicking on video��s progress bar breaks autopausing - DNA-90079 [BigSur] Blank pages - DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-2359=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-73.0.3856.284-lp151.2.39.1 References: https://www.suse.com/security/cve/CVE-2020-16037.html https://www.suse.com/security/cve/CVE-2020-16038.html https://www.suse.com/security/cve/CVE-2020-16039.html https://www.suse.com/security/cve/CVE-2020-16040.html https://www.suse.com/security/cve/CVE-2020-16041.html https://www.suse.com/security/cve/CVE-2020-16042.html [View Less]

1 0

openSUSE-SU-2020:2360-1: important: Security update for opera
by opensuse-security＠opensuse.org 29 Dec '20

29 Dec '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2360-1 Rating: important References: Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.2:NonFree … [View More]______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 73.0.3856.284 - CHR-8225 Update chromium on desktop-stable-87-3856 to 87.0.4280.88 - DNA-88454 Background of snap area above visible scrolled viewport is not captured - DNA-89749 Implement client_capabilities support for Flow / Sync - DNA-89810 Opera no longer autoselects full url/address bar when clicked - DNA-89923 [Snap] Emojis look grayed out - DNA-90060 Make gesture events work with search-in-tabs feature - DNA-90168 Display SD suggestions titles - DNA-90176 Player doesn��t show music service to choose on Welcome page - DNA-90343 [Mac] Cmd+C doesn��t copy snapshot - DNA-90538 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - The update to chromium 87.0.4280.88 fixes following issues: CVE-2020-16037, CVE-2020-16038, CVE-2020-16039, CVE-2020-16040, CVE-2020-16041, CVE-2020-16042 - Update to version 73.0.3856.257 - DNA-89918 #enable-force-dark flag doesn��t work anymore - DNA-90061 Clicking on video��s progress bar breaks autopausing - DNA-90079 [BigSur] Blank pages - DNA-90154 Crash at extensions::CommandService:: GetExtensionActionCommand(std::__1::basic_string const&, extensions::ActionInfo::Type, extensions::CommandService:: QueryType, extensions::Command*, bool*) - Complete Opera 73.0 changelog at: https://blogs.opera.com/desktop/changelog-for-73/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-2360=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-73.0.3856.284-lp152.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-16037.html https://www.suse.com/security/cve/CVE-2020-16038.html https://www.suse.com/security/cve/CVE-2020-16039.html https://www.suse.com/security/cve/CVE-2020-16040.html https://www.suse.com/security/cve/CVE-2020-16041.html https://www.suse.com/security/cve/CVE-2020-16042.html [View Less]

1 0

openSUSE-SU-2020:2357-1: important: Security update for gimp
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2357-1 Rating: important References: #1073628 #1178726 Cross-References: CVE-2017-17787 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. … [View More]

1 0

openSUSE-SU-2020:2350-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2350-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2351-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 28 Dec '20

28 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2351-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three … [View More]

1 0

openSUSE-SU-2020:2349-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2349-1 Rating: moderate References: #1179879 Cross-References: CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three … [View More]

1 0

openSUSE-SU-2020:2348-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2348-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2344-1: Security update for PackageKit
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2344-1 Rating: low References: #1104313 #1176930 Cross-References: CVE-2020-16121 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. … [View More] Description: This update for PackageKit fixes the following issue: - CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930). - Update summary and description of gstreamer-plugin and gtk3-module. (bsc#1104313) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2344=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): PackageKit-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-debuginfo-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debugsource-1.1.13-lp152.3.15.1 PackageKit-devel-1.1.13-lp152.3.15.1 PackageKit-devel-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-1.1.13-lp152.3.15.1 typelib-1_0-PackageKitGlib-1_0-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (x86_64): libpackagekit-glib2-18-32bit-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-32bit-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): PackageKit-branding-upstream-1.1.13-lp152.3.15.1 PackageKit-lang-1.1.13-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-16121.html https://bugzilla.suse.com/1104313 https://bugzilla.suse.com/1176930 [View Less]

1 0

openSUSE-SU-2020:2336-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2336-1 Rating: moderate References: #1177789 Cross-References: CVE-2019-14584 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2337-1: moderate: Security update for blosc
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for blosc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2337-1 Rating: moderate References: #1174075 #1179914 Cross-References: CVE-2020-29367 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 … [View More]______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for blosc fixes the following issues: Update to version 1.20.1 boo#1179914 CVE-2020-29367: * More saftey checks have been implemented so that potential flaws discovered by new fuzzers in OSS-Fuzzer are fixed now * BloscLZ updated to 2.3.0. Expect better compression ratios for faster codecs. For details, see our new blog post: https://blosc.org/posts/beast-release/ * Fixed the _xgetbv() collision. Thanks to Micha�� G��rny (@mgorny). Update to version 1.19.0: * The length of automatic blocksizes for fast codecs (lz4, blosclz) has been incremented quite a bit (up to 256 KB) for better compression ratios. * The performance in modern CPUs (with at least 256 KB in L2 cache) should be better too (for older CPUs the performance should stay roughly the same). * For small buffers that cannot be compressed (typically < 128 bytes), blosc_compress() returns now a 0 (cannot compress) instead of a negative number (internal error). See #294. * blosclz codec updated to 2.1.0. Expect better compression ratios and performance in a wider variety of scenarios. * blosc_decompress_unsafe(), blosc_decompress_ctx_unsafe() and blosc_getitem_unsafe() have been removed because they are dangerous and after latest improvements, they should not be used in production. Update to version 1.18.1: * Fixed the copy of the leftovers of a chunk when its size is not a multiple of the typesize. Update to version 1.17.1: * BloscLZ codec updated to 2.0.0. Update to version 1.16.3: * Fix for building for clang with -march=haswell. See PR #262. * Fix all the known warnings for GCC/Clang. Still some work to do for MSVC in this front. * Due to some problems with several CI systems, the check for library symbols are deactivated now by default. If you want to enforce this check, use: cmake .. -DDEACTIVATE_SYMBOLS_CHECK=ON to re-activate it. * Correct the check for the compressed size when the buffer is memcpyed. This was a regression introduced in 1.16.0. Fixes #261. * Fixed a regression in 1.16.0 that prevented to compress empty buffers (see #260). * Now the functions that execute Blosc decompressions are safe by default for untrusted/possibly corrupted inputs. * The previous functions (with less safety) checks are still available with a '_unsafe' suffix. The complete list is: * Also, a new API function named blosc_cbuffer_validate(), for validating Blosc compressed data, has been added. * For details, see PR #258. Thanks to Jeremy Maitin-Shepard. * Fixed a bug in blosc_compress() that could lead to thread deadlock under some situations. See #251. Thanks to @wenjuno for the report and the fix. * Fix data race in shuffle.c host_implementation initialization. Fixes #253. Thanks to Jeremy Maitin-Shepard. * Add workaround for Visual Studio 2008's lack of a stdint.h file to blosclz.c. * Replaced //-comments with /**/-comments and other improvements for compatibility with quite old gcc compilers. See PR #243. Thanks to Andreas Martin. * Empty buffers can be compressed again (this was unadvertedly prevented while fixing #234). See #247. Thanks to Valentin Haenel. Update to version 1.14.4: * Added a new DEACTIVATE_SSE2 option for cmake that is useful for disabling SSE2 when doing cross-compilation (see #236). * New check for detecting output buffers smaller than BLOSC_MAX_OVERHEAD. * The complib and version parameters for blosc_get_complib_info() can be safely set to NULL now. This allows to call this function even if the user is not interested in these parameters (so no need to reserve memory for them). * In some situations that a supposedly blosc chunk is passed to blosc_decompress(), one might end with an Arithmetic exception. This is probably due to the chunk not being an actual blosc chunk, and divisions by zero might occur. A protection has been added for this. Update to version 1.14.3: * Fixed a bug that caused C-Blosc to crash on platforms requiring strict alignment. * Fixed a piece of code that was not C89 compliant. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2337=1 Package List: - openSUSE Leap 15.2 (x86_64): blosc-debugsource-1.20.1-lp152.4.3.1 blosc-devel-1.20.1-lp152.4.3.1 libblosc1-1.20.1-lp152.4.3.1 libblosc1-debuginfo-1.20.1-lp152.4.3.1 - openSUSE Leap 15.1 (x86_64): blosc-debugsource-1.20.1-lp151.3.3.1 blosc-devel-1.20.1-lp151.3.3.1 libblosc1-1.20.1-lp151.3.3.1 libblosc1-debuginfo-1.20.1-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): blosc-debugsource-1.20.1-bp152.4.3.1 blosc-devel-1.20.1-bp152.4.3.1 libblosc1-1.20.1-bp152.4.3.1 libblosc1-debuginfo-1.20.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): blosc-devel-1.20.1-bp151.4.3.1 libblosc1-1.20.1-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-29367.html https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1179914 [View Less]

1 0

openSUSE-SU-2020:2343-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2343-1 Rating: important References: #1177672 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde … [View More]

1 0

openSUSE-SU-2020:2334-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2334-1 Rating: important References: #1177672 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde … [View More]

1 0

openSUSE-SU-2020:2333-1: important: Security update for python3
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2333-1 Rating: important References: #1155094 #1174091 #1174571 #1174701 #1177211 #1178009 #1179193 #1179630 Cross-References: CVE-2019-16935 CVE-2019-18348 CVE-2019-20907 CVE-2019-5010 CVE-2020-14422 CVE-2020-26116 CVE-2020-27619 CVE-2020-8492 … [View More]Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for python3 fixes the following issues: - Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738) - add triplets for mips-r6 and riscv - RISC-V needs CTYPES_PASS_BY_REF_HACK Update to 3.6.12 (bsc#1179193) * Ensure python3.dll is loaded from correct locations when Python is embedded * The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address). * Prevent http header injection by rejecting control characters in http.client.putrequest(��). * Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing. * Avoid infinite loop when reading specially crafted TAR files using the tarfile module - This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091). Update to 3.6.11: - Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094) - CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2333=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython3_6m1_0-3.6.12-lp151.6.30.1 libpython3_6m1_0-debuginfo-3.6.12-lp151.6.30.1 python3-3.6.12-lp151.6.30.1 python3-base-3.6.12-lp151.6.30.1 python3-base-debuginfo-3.6.12-lp151.6.30.1 python3-core-debugsource-3.6.12-lp151.6.30.1 python3-curses-3.6.12-lp151.6.30.1 python3-curses-debuginfo-3.6.12-lp151.6.30.1 python3-dbm-3.6.12-lp151.6.30.1 python3-dbm-debuginfo-3.6.12-lp151.6.30.1 python3-debuginfo-3.6.12-lp151.6.30.1 python3-debugsource-3.6.12-lp151.6.30.1 python3-devel-3.6.12-lp151.6.30.1 python3-devel-debuginfo-3.6.12-lp151.6.30.1 python3-doc-3.6.12-lp151.6.30.1 python3-doc-devhelp-3.6.12-lp151.6.30.1 python3-idle-3.6.12-lp151.6.30.1 python3-testsuite-3.6.12-lp151.6.30.1 python3-testsuite-debuginfo-3.6.12-lp151.6.30.1 python3-tk-3.6.12-lp151.6.30.1 python3-tk-debuginfo-3.6.12-lp151.6.30.1 python3-tools-3.6.12-lp151.6.30.1 - openSUSE Leap 15.1 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp151.6.30.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp151.6.30.1 python3-32bit-3.6.12-lp151.6.30.1 python3-32bit-debuginfo-3.6.12-lp151.6.30.1 python3-base-32bit-3.6.12-lp151.6.30.1 python3-base-32bit-debuginfo-3.6.12-lp151.6.30.1 References: https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-20907.html https://www.suse.com/security/cve/CVE-2019-5010.html https://www.suse.com/security/cve/CVE-2020-14422.html https://www.suse.com/security/cve/CVE-2020-26116.html https://www.suse.com/security/cve/CVE-2020-27619.html https://www.suse.com/security/cve/CVE-2020-8492.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1174091 https://bugzilla.suse.com/1174571 https://bugzilla.suse.com/1174701 https://bugzilla.suse.com/1177211 https://bugzilla.suse.com/1178009 https://bugzilla.suse.com/1179193 https://bugzilla.suse.com/1179630 [View Less]

1 0

openSUSE-SU-2020:2332-1: important: Security update for python3
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2332-1 Rating: important References: #1155094 #1174091 #1174571 #1174701 #1177211 #1178009 #1179193 #1179630 Cross-References: CVE-2019-16935 CVE-2019-18348 CVE-2019-20907 CVE-2019-5010 CVE-2020-14422 CVE-2020-26116 CVE-2020-27619 CVE-2020-8492 … [View More]Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for python3 fixes the following issues: - Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738) - add triplets for mips-r6 and riscv - RISC-V needs CTYPES_PASS_BY_REF_HACK Update to 3.6.12 (bsc#1179193) * Ensure python3.dll is loaded from correct locations when Python is embedded * The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address). * Prevent http header injection by rejecting control characters in http.client.putrequest(��). * Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing. * Avoid infinite loop when reading specially crafted TAR files using the tarfile module - This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091). Update to 3.6.11: - Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094) - CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2332=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython3_6m1_0-3.6.12-lp152.4.12.2 libpython3_6m1_0-debuginfo-3.6.12-lp152.4.12.2 python3-3.6.12-lp152.4.12.2 python3-base-3.6.12-lp152.4.12.2 python3-base-debuginfo-3.6.12-lp152.4.12.2 python3-core-debugsource-3.6.12-lp152.4.12.2 python3-curses-3.6.12-lp152.4.12.2 python3-curses-debuginfo-3.6.12-lp152.4.12.2 python3-dbm-3.6.12-lp152.4.12.2 python3-dbm-debuginfo-3.6.12-lp152.4.12.2 python3-debuginfo-3.6.12-lp152.4.12.2 python3-debugsource-3.6.12-lp152.4.12.2 python3-devel-3.6.12-lp152.4.12.2 python3-devel-debuginfo-3.6.12-lp152.4.12.2 python3-doc-3.6.12-lp152.4.12.2 python3-doc-devhelp-3.6.12-lp152.4.12.2 python3-idle-3.6.12-lp152.4.12.2 python3-testsuite-3.6.12-lp152.4.12.2 python3-testsuite-debuginfo-3.6.12-lp152.4.12.2 python3-tk-3.6.12-lp152.4.12.2 python3-tk-debuginfo-3.6.12-lp152.4.12.2 python3-tools-3.6.12-lp152.4.12.2 - openSUSE Leap 15.2 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp152.4.12.2 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp152.4.12.2 python3-32bit-3.6.12-lp152.4.12.2 python3-32bit-debuginfo-3.6.12-lp152.4.12.2 python3-base-32bit-3.6.12-lp152.4.12.2 python3-base-32bit-debuginfo-3.6.12-lp152.4.12.2 References: https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-20907.html https://www.suse.com/security/cve/CVE-2019-5010.html https://www.suse.com/security/cve/CVE-2020-14422.html https://www.suse.com/security/cve/CVE-2020-26116.html https://www.suse.com/security/cve/CVE-2020-27619.html https://www.suse.com/security/cve/CVE-2020-8492.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1174091 https://bugzilla.suse.com/1174571 https://bugzilla.suse.com/1174701 https://bugzilla.suse.com/1177211 https://bugzilla.suse.com/1178009 https://bugzilla.suse.com/1179193 https://bugzilla.suse.com/1179630 [View Less]

1 0

openSUSE-SU-2020:2331-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2331-1 Rating: moderate References: #1027519 #1176782 #1179496 #1179498 #1179501 #1179502 #1179506 #1179514 #1179516 Cross-References: CVE-2020-29480 CVE-2020-29481 CVE-2020-29483 CVE-2020-29484 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Affected … [View More]Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for xen fixes the following issues: - CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115). - CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322). - CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325). - CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324). - CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348). - CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358). - CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359). - Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782). - Multiple other bugs (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2331=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.2_06-lp152.2.21.1 xen-devel-4.13.2_06-lp152.2.21.1 xen-libs-4.13.2_06-lp152.2.21.1 xen-libs-debuginfo-4.13.2_06-lp152.2.21.1 xen-tools-domU-4.13.2_06-lp152.2.21.1 xen-tools-domU-debuginfo-4.13.2_06-lp152.2.21.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.2_06-lp152.2.21.1 xen-doc-html-4.13.2_06-lp152.2.21.1 xen-libs-32bit-4.13.2_06-lp152.2.21.1 xen-libs-32bit-debuginfo-4.13.2_06-lp152.2.21.1 xen-tools-4.13.2_06-lp152.2.21.1 xen-tools-debuginfo-4.13.2_06-lp152.2.21.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.2_06-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-29480.html https://www.suse.com/security/cve/CVE-2020-29481.html https://www.suse.com/security/cve/CVE-2020-29483.html https://www.suse.com/security/cve/CVE-2020-29484.html https://www.suse.com/security/cve/CVE-2020-29566.html https://www.suse.com/security/cve/CVE-2020-29570.html https://www.suse.com/security/cve/CVE-2020-29571.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176782 https://bugzilla.suse.com/1179496 https://bugzilla.suse.com/1179498 https://bugzilla.suse.com/1179501 https://bugzilla.suse.com/1179502 https://bugzilla.suse.com/1179506 https://bugzilla.suse.com/1179514 https://bugzilla.suse.com/1179516 [View Less]

1 0

openSUSE-SU-2020:2327-1: important: Security update for ceph
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2327-1 Rating: important References: #1178860 #1179016 #1179802 #1180107 #1180155 Cross-References: CVE-2020-27781 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one … [View More]vulnerability and has four fixes is now available. Description: This update for ceph fixes the following issues: Security issue fixed: - CVE-2020-27781: Fixed a privilege escalation via the ceph_volume_client Python interface (bsc#1180155, bsc#1179802). Non-security issues fixed: - Update to 15.2.8-80-g1f4b6229ca: + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55 * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/ - Update to 15.2.7-776-g343cd10fe5: + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05 * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1 + (bsc#1179016) rpm: require smartmontools on SUSE + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2327=1 Package List: - openSUSE Leap 15.2 (x86_64): ceph-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-base-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-base-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-common-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-common-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-debugsource-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-fuse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-fuse-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-immutable-object-cache-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-immutable-object-cache-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mds-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mds-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mon-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mon-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-osd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-osd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-radosgw-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-radosgw-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-debugsource-15.2.8.80+g1f4b6229ca-lp152.2.9.1 cephadm-15.2.8.80+g1f4b6229ca-lp152.2.9.1 cephfs-shell-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados-devel-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libradospp-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd1-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd1-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-ceph-argparse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-ceph-common-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-cephfs-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-cephfs-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rados-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rados-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rbd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rbd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rgw-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rgw-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rados-objclass-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-fuse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-fuse-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-mirror-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-mirror-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-nbd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-nbd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-cephadm-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-dashboard-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-diskprediction-cloud-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-diskprediction-local-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-k8sevents-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-modules-core-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-rook-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-prometheus-alerts-15.2.8.80+g1f4b6229ca-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-27781.html https://bugzilla.suse.com/1178860 https://bugzilla.suse.com/1179016 https://bugzilla.suse.com/1179802 https://bugzilla.suse.com/1180107 https://bugzilla.suse.com/1180155 [View Less]

1 0

openSUSE-SU-2020:2325-1: critical: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2325-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.1 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2325=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.6.0-lp151.2.82.1 MozillaFirefox-branding-upstream-78.6.0-lp151.2.82.1 MozillaFirefox-buildsymbols-78.6.0-lp151.2.82.1 MozillaFirefox-debuginfo-78.6.0-lp151.2.82.1 MozillaFirefox-debugsource-78.6.0-lp151.2.82.1 MozillaFirefox-devel-78.6.0-lp151.2.82.1 MozillaFirefox-translations-common-78.6.0-lp151.2.82.1 MozillaFirefox-translations-other-78.6.0-lp151.2.82.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

openSUSE-SU-2020:2324-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2324-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.1 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2324=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-78.6.0-lp151.2.63.1 MozillaThunderbird-debuginfo-78.6.0-lp151.2.63.1 MozillaThunderbird-debugsource-78.6.0-lp151.2.63.1 MozillaThunderbird-translations-common-78.6.0-lp151.2.63.1 MozillaThunderbird-translations-other-78.6.0-lp151.2.63.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

openSUSE-SU-2020:2317-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2317-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2317=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.0-lp152.2.23.1 MozillaThunderbird-debuginfo-78.6.0-lp152.2.23.1 MozillaThunderbird-debugsource-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-common-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-other-78.6.0-lp152.2.23.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

openSUSE-SU-2020:2318-1: critical: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2318-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2318=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.6.0-lp152.2.34.1 MozillaFirefox-branding-upstream-78.6.0-lp152.2.34.1 MozillaFirefox-buildsymbols-78.6.0-lp152.2.34.1 MozillaFirefox-debuginfo-78.6.0-lp152.2.34.1 MozillaFirefox-debugsource-78.6.0-lp152.2.34.1 MozillaFirefox-devel-78.6.0-lp152.2.34.1 MozillaFirefox-translations-common-78.6.0-lp152.2.34.1 MozillaFirefox-translations-other-78.6.0-lp152.2.34.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

openSUSE-SU-2020:2317-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2317-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2317=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.0-lp152.2.23.1 MozillaThunderbird-debuginfo-78.6.0-lp152.2.23.1 MozillaThunderbird-debugsource-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-common-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-other-78.6.0-lp152.2.23.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

openSUSE-SU-2020:2315-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2315-1 Rating: important References: #1178824 Cross-References: CVE-2020-15999 CVE-2020-16012 CVE-2020-26951 CVE-2020-26953 CVE-2020-26956 CVE-2020-26958 CVE-2020-26959 CVE-2020-26960 CVE-2020-26961 CVE-2020-26965 CVE-2020-26966 CVE-2020-… [View More]

1 0

openSUSE-SU-2020:2314-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2314-1 Rating: moderate References: #1177789 Cross-References: CVE-2019-14584 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2313-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 22 Dec '20

22 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2313-1 Rating: moderate References: #1027519 #1176782 #1179496 #1179498 #1179501 #1179502 #1179506 #1179514 #1179516 Cross-References: CVE-2020-29480 CVE-2020-29481 CVE-2020-29483 CVE-2020-29484 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Affected … [View More]Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for xen fixes the following issues: - CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115). - CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322). - CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325). - CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324). - CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348). - CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358). - CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359). - Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782). - Multiple other bugs (bsc#1027519) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2313=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.4_06-lp151.2.36.1 xen-devel-4.12.4_06-lp151.2.36.1 xen-libs-4.12.4_06-lp151.2.36.1 xen-libs-debuginfo-4.12.4_06-lp151.2.36.1 xen-tools-domU-4.12.4_06-lp151.2.36.1 xen-tools-domU-debuginfo-4.12.4_06-lp151.2.36.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.4_06-lp151.2.36.1 xen-doc-html-4.12.4_06-lp151.2.36.1 xen-libs-32bit-4.12.4_06-lp151.2.36.1 xen-libs-32bit-debuginfo-4.12.4_06-lp151.2.36.1 xen-tools-4.12.4_06-lp151.2.36.1 xen-tools-debuginfo-4.12.4_06-lp151.2.36.1 References: https://www.suse.com/security/cve/CVE-2020-29480.html https://www.suse.com/security/cve/CVE-2020-29481.html https://www.suse.com/security/cve/CVE-2020-29483.html https://www.suse.com/security/cve/CVE-2020-29484.html https://www.suse.com/security/cve/CVE-2020-29566.html https://www.suse.com/security/cve/CVE-2020-29570.html https://www.suse.com/security/cve/CVE-2020-29571.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176782 https://bugzilla.suse.com/1179496 https://bugzilla.suse.com/1179498 https://bugzilla.suse.com/1179501 https://bugzilla.suse.com/1179502 https://bugzilla.suse.com/1179506 https://bugzilla.suse.com/1179514 https://bugzilla.suse.com/1179516 [View Less]

1 0

openSUSE-SU-2020:2310-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 21 Dec '20

21 Dec '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2310-1 Rating: important References: #1171531 #1177087 #1179122 #1179451 Cross-References: CVE-2020-13543 CVE-2020-13584 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 Affected Products: openSUSE Leap 15.2 … [View More]______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451): - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution. - CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution. - Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531). - Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2310=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3 libjavascriptcoregtk-4_0-18-debuginfo-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-debuginfo-2.30.3-lp152.2.7.3 typelib-1_0-JavaScriptCore-4_0-2.30.3-lp152.2.7.3 typelib-1_0-WebKit2-4_0-2.30.3-lp152.2.7.3 typelib-1_0-WebKit2WebExtension-4_0-2.30.3-lp152.2.7.3 webkit-jsc-4-2.30.3-lp152.2.7.3 webkit-jsc-4-debuginfo-2.30.3-lp152.2.7.3 webkit2gtk-4_0-injected-bundles-2.30.3-lp152.2.7.3 webkit2gtk-4_0-injected-bundles-debuginfo-2.30.3-lp152.2.7.3 webkit2gtk3-debugsource-2.30.3-lp152.2.7.3 webkit2gtk3-devel-2.30.3-lp152.2.7.3 webkit2gtk3-minibrowser-2.30.3-lp152.2.7.3 webkit2gtk3-minibrowser-debuginfo-2.30.3-lp152.2.7.3 - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3 libwebkit2gtk-4_0-37-32bit-debuginfo-2.30.3-lp152.2.7.3 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.30.3-lp152.2.7.3 References: https://www.suse.com/security/cve/CVE-2020-13543.html https://www.suse.com/security/cve/CVE-2020-13584.html https://www.suse.com/security/cve/CVE-2020-9948.html https://www.suse.com/security/cve/CVE-2020-9951.html https://www.suse.com/security/cve/CVE-2020-9983.html https://bugzilla.suse.com/1171531 https://bugzilla.suse.com/1177087 https://bugzilla.suse.com/1179122 https://bugzilla.suse.com/1179451 [View Less]

1 0

openSUSE-SU-2020:2304-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 21 Dec '20

21 Dec '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2304-1 Rating: important References: #1171531 #1177087 #1179122 #1179451 Cross-References: CVE-2020-13543 CVE-2020-13584 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 Affected Products: openSUSE Leap 15.1 … [View More]______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451): - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution. - CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution. - Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531). - Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2304=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.30.3-lp151.2.28.2 libjavascriptcoregtk-4_0-18-debuginfo-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-debuginfo-2.30.3-lp151.2.28.2 typelib-1_0-JavaScriptCore-4_0-2.30.3-lp151.2.28.2 typelib-1_0-WebKit2-4_0-2.30.3-lp151.2.28.2 typelib-1_0-WebKit2WebExtension-4_0-2.30.3-lp151.2.28.2 webkit-jsc-4-2.30.3-lp151.2.28.2 webkit-jsc-4-debuginfo-2.30.3-lp151.2.28.2 webkit2gtk-4_0-injected-bundles-2.30.3-lp151.2.28.2 webkit2gtk-4_0-injected-bundles-debuginfo-2.30.3-lp151.2.28.2 webkit2gtk3-debugsource-2.30.3-lp151.2.28.2 webkit2gtk3-devel-2.30.3-lp151.2.28.2 webkit2gtk3-minibrowser-2.30.3-lp151.2.28.2 webkit2gtk3-minibrowser-debuginfo-2.30.3-lp151.2.28.2 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp151.2.28.2 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-32bit-2.30.3-lp151.2.28.2 libwebkit2gtk-4_0-37-32bit-debuginfo-2.30.3-lp151.2.28.2 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.30.3-lp151.2.28.2 References: https://www.suse.com/security/cve/CVE-2020-13543.html https://www.suse.com/security/cve/CVE-2020-13584.html https://www.suse.com/security/cve/CVE-2020-9948.html https://www.suse.com/security/cve/CVE-2020-9951.html https://www.suse.com/security/cve/CVE-2020-9983.html https://bugzilla.suse.com/1171531 https://bugzilla.suse.com/1177087 https://bugzilla.suse.com/1179122 https://bugzilla.suse.com/1179451 [View Less]

1 0

openSUSE-SU-2020:2300-1: moderate: Security update for gcc7
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2300-1 Rating: moderate References: #1150164 #1161913 #1167939 #1172798 #1178577 #1178614 #1178624 #1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An … [View More]update that solves one vulnerability and has 7 fixes is now available. Description: This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue (bsc#1172798) - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel. - Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. [jsc#SLE-12209, bsc#1167939] - Fixed 32bit libgnat.so link. [bsc#1178675] - Fixed memcpy miscompilation on aarch64. [bsc#1178624, bsc#1178577] - Fixed debug line info for try/catch. [bsc#1178614] - Remove -mbranch-protection=standard (aarch64 flag) when gcc7 is used to build gcc7 (ie when ada is enabled) - Fixed corruption of pass private ->aux via DF. [gcc#94148] - Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888] - Fixed binutils release date detection issue. - Fixed register allocation issue with exception handling code on s390x. [bsc#1161913] - Fixed miscompilation of some atomic code on aarch64. [bsc#1150164] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2300=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cpp7-7.5.0+r278197-lp151.2.15.1 cpp7-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-7.5.0+r278197-lp151.2.15.1 gcc7-ada-7.5.0+r278197-lp151.2.15.1 gcc7-ada-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-c++-7.5.0+r278197-lp151.2.15.1 gcc7-c++-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-debugsource-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-go-7.5.0+r278197-lp151.2.15.1 gcc7-go-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-locale-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-debuginfo-7.5.0+r278197-lp151.2.15.1 gcc7-objc-7.5.0+r278197-lp151.2.15.1 gcc7-objc-debuginfo-7.5.0+r278197-lp151.2.15.1 libada7-7.5.0+r278197-lp151.2.15.1 libada7-debuginfo-7.5.0+r278197-lp151.2.15.1 libasan4-7.5.0+r278197-lp151.2.15.1 libasan4-debuginfo-7.5.0+r278197-lp151.2.15.1 libcilkrts5-7.5.0+r278197-lp151.2.15.1 libcilkrts5-debuginfo-7.5.0+r278197-lp151.2.15.1 libgfortran4-7.5.0+r278197-lp151.2.15.1 libgfortran4-debuginfo-7.5.0+r278197-lp151.2.15.1 libgo11-7.5.0+r278197-lp151.2.15.1 libgo11-debuginfo-7.5.0+r278197-lp151.2.15.1 libstdc++6-devel-gcc7-7.5.0+r278197-lp151.2.15.1 libubsan0-7.5.0+r278197-lp151.2.15.1 libubsan0-debuginfo-7.5.0+r278197-lp151.2.15.1 - openSUSE Leap 15.1 (noarch): gcc7-info-7.5.0+r278197-lp151.2.15.1 - openSUSE Leap 15.1 (x86_64): gcc7-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-ada-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-c++-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-fortran-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-go-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-obj-c++-32bit-7.5.0+r278197-lp151.2.15.1 gcc7-objc-32bit-7.5.0+r278197-lp151.2.15.1 libada7-32bit-7.5.0+r278197-lp151.2.15.1 libada7-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libasan4-32bit-7.5.0+r278197-lp151.2.15.1 libasan4-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libcilkrts5-32bit-7.5.0+r278197-lp151.2.15.1 libcilkrts5-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libgfortran4-32bit-7.5.0+r278197-lp151.2.15.1 libgfortran4-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libgo11-32bit-7.5.0+r278197-lp151.2.15.1 libgo11-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 libstdc++6-devel-gcc7-32bit-7.5.0+r278197-lp151.2.15.1 libubsan0-32bit-7.5.0+r278197-lp151.2.15.1 libubsan0-32bit-debuginfo-7.5.0+r278197-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-13844.html https://bugzilla.suse.com/1150164 https://bugzilla.suse.com/1161913 https://bugzilla.suse.com/1167939 https://bugzilla.suse.com/1172798 https://bugzilla.suse.com/1178577 https://bugzilla.suse.com/1178614 https://bugzilla.suse.com/1178624 https://bugzilla.suse.com/1178675 [View Less]

1 0

openSUSE-SU-2020:2301-1: moderate: Security update for gcc7
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for gcc7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2301-1 Rating: moderate References: #1150164 #1161913 #1167939 #1172798 #1178577 #1178614 #1178624 #1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An … [View More]update that solves one vulnerability and has 7 fixes is now available. Description: This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue (bsc#1172798) - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel. - Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. [jsc#SLE-12209, bsc#1167939] - Fixed 32bit libgnat.so link. [bsc#1178675] - Fixed memcpy miscompilation on aarch64. [bsc#1178624, bsc#1178577] - Fixed debug line info for try/catch. [bsc#1178614] - Remove -mbranch-protection=standard (aarch64 flag) when gcc7 is used to build gcc7 (ie when ada is enabled) - Fixed corruption of pass private ->aux via DF. [gcc#94148] - Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888] - Fixed binutils release date detection issue. - Fixed register allocation issue with exception handling code on s390x. [bsc#1161913] - Fixed miscompilation of some atomic code on aarch64. [bsc#1150164] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2301=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cpp7-7.5.0+r278197-lp152.3.3.1 cpp7-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-7.5.0+r278197-lp152.3.3.1 gcc7-ada-7.5.0+r278197-lp152.3.3.1 gcc7-ada-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-c++-7.5.0+r278197-lp152.3.3.1 gcc7-c++-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-debugsource-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-go-7.5.0+r278197-lp152.3.3.1 gcc7-go-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-locale-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-debuginfo-7.5.0+r278197-lp152.3.3.1 gcc7-objc-7.5.0+r278197-lp152.3.3.1 gcc7-objc-debuginfo-7.5.0+r278197-lp152.3.3.1 libada7-7.5.0+r278197-lp152.3.3.1 libada7-debuginfo-7.5.0+r278197-lp152.3.3.1 libasan4-7.5.0+r278197-lp152.3.3.1 libasan4-debuginfo-7.5.0+r278197-lp152.3.3.1 libcilkrts5-7.5.0+r278197-lp152.3.3.1 libcilkrts5-debuginfo-7.5.0+r278197-lp152.3.3.1 libgfortran4-7.5.0+r278197-lp152.3.3.1 libgfortran4-debuginfo-7.5.0+r278197-lp152.3.3.1 libgo11-7.5.0+r278197-lp152.3.3.1 libgo11-debuginfo-7.5.0+r278197-lp152.3.3.1 libstdc++6-devel-gcc7-7.5.0+r278197-lp152.3.3.1 libubsan0-7.5.0+r278197-lp152.3.3.1 libubsan0-debuginfo-7.5.0+r278197-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): gcc7-info-7.5.0+r278197-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): gcc7-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-ada-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-c++-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-fortran-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-go-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-obj-c++-32bit-7.5.0+r278197-lp152.3.3.1 gcc7-objc-32bit-7.5.0+r278197-lp152.3.3.1 libada7-32bit-7.5.0+r278197-lp152.3.3.1 libada7-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libasan4-32bit-7.5.0+r278197-lp152.3.3.1 libasan4-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libcilkrts5-32bit-7.5.0+r278197-lp152.3.3.1 libcilkrts5-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libgfortran4-32bit-7.5.0+r278197-lp152.3.3.1 libgfortran4-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libgo11-32bit-7.5.0+r278197-lp152.3.3.1 libgo11-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 libstdc++6-devel-gcc7-32bit-7.5.0+r278197-lp152.3.3.1 libubsan0-32bit-7.5.0+r278197-lp152.3.3.1 libubsan0-32bit-debuginfo-7.5.0+r278197-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13844.html https://bugzilla.suse.com/1150164 https://bugzilla.suse.com/1161913 https://bugzilla.suse.com/1167939 https://bugzilla.suse.com/1172798 https://bugzilla.suse.com/1178577 https://bugzilla.suse.com/1178614 https://bugzilla.suse.com/1178624 https://bugzilla.suse.com/1178675 [View Less]

1 0

openSUSE-SU-2020:2298-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2298-1 Rating: moderate References: #1115550 #1139398 #1142000 #1148566 #1173513 #1174162 Cross-References: CVE-2020-14145 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that … [View More]

1 0

openSUSE-SU-2020:2292-1: moderate: Security update for PackageKit
by opensuse-security＠opensuse.org 20 Dec '20

20 Dec '20

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2292-1 Rating: moderate References: #1169739 #1176930 Cross-References: CVE-2020-16121 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now … [View More]

1 0

openSUSE-SU-2020:2286-1: important: Security update for slurm_18_08
by opensuse-security＠opensuse.org 19 Dec '20

19 Dec '20

openSUSE Security Update: Security update for slurm_18_08 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2286-1 Rating: important References: #1178890 #1178891 Cross-References: CVE-2020-27745 CVE-2020-27746 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available.… [View More] Description: This update for slurm_18_08 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem (bsc#1178890). - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command (bsc#1178891). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2286=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.9-lp151.6.1 libpmi0-debuginfo-18.08.9-lp151.6.1 libslurm33-18.08.9-lp151.6.1 libslurm33-debuginfo-18.08.9-lp151.6.1 perl-slurm-18.08.9-lp151.6.1 perl-slurm-debuginfo-18.08.9-lp151.6.1 slurm-18.08.9-lp151.6.1 slurm-auth-none-18.08.9-lp151.6.1 slurm-auth-none-debuginfo-18.08.9-lp151.6.1 slurm-config-18.08.9-lp151.6.1 slurm-config-man-18.08.9-lp151.6.1 slurm-cray-18.08.9-lp151.6.1 slurm-cray-debuginfo-18.08.9-lp151.6.1 slurm-debuginfo-18.08.9-lp151.6.1 slurm-debugsource-18.08.9-lp151.6.1 slurm-devel-18.08.9-lp151.6.1 slurm-doc-18.08.9-lp151.6.1 slurm-hdf5-18.08.9-lp151.6.1 slurm-hdf5-debuginfo-18.08.9-lp151.6.1 slurm-lua-18.08.9-lp151.6.1 slurm-lua-debuginfo-18.08.9-lp151.6.1 slurm-munge-18.08.9-lp151.6.1 slurm-munge-debuginfo-18.08.9-lp151.6.1 slurm-node-18.08.9-lp151.6.1 slurm-node-debuginfo-18.08.9-lp151.6.1 slurm-openlava-18.08.9-lp151.6.1 slurm-pam_slurm-18.08.9-lp151.6.1 slurm-pam_slurm-debuginfo-18.08.9-lp151.6.1 slurm-plugins-18.08.9-lp151.6.1 slurm-plugins-debuginfo-18.08.9-lp151.6.1 slurm-seff-18.08.9-lp151.6.1 slurm-sjstat-18.08.9-lp151.6.1 slurm-slurmdbd-18.08.9-lp151.6.1 slurm-slurmdbd-debuginfo-18.08.9-lp151.6.1 slurm-sql-18.08.9-lp151.6.1 slurm-sql-debuginfo-18.08.9-lp151.6.1 slurm-sview-18.08.9-lp151.6.1 slurm-sview-debuginfo-18.08.9-lp151.6.1 slurm-torque-18.08.9-lp151.6.1 slurm-torque-debuginfo-18.08.9-lp151.6.1 slurm-webdoc-18.08.9-lp151.6.1 References: https://www.suse.com/security/cve/CVE-2020-27745.html https://www.suse.com/security/cve/CVE-2020-27746.html https://bugzilla.suse.com/1178890 https://bugzilla.suse.com/1178891 [View Less]

1 0

openSUSE-SU-2020:2282-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 18 Dec '20

18 Dec '20

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2282-1 Rating: moderate References: #1177120 Cross-References: CVE-2020-26137 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2276-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 18 Dec '20

18 Dec '20

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2276-1 Rating: moderate References: #1104457 #1118459 #1130721 #1144504 #1149458 #1157763 Cross-References: CVE-2019-12625 CVE-2019-12900 CVE-2019-15961 CVE-2019-1785 CVE-2019-1786 CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 CVE-2019-1798 … [View More] CVE-2020-3123 CVE-2020-3327 CVE-2020-3341 CVE-2020-3350 CVE-2020-3481 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for clamav fixes the following issues: clamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459) Note that libclamav was changed incompatible, if you have a 3rd party application that uses libclamav, it needs to be rebuilt. Update to 0.103.0 * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Fix clamav-milter.service (requires clamd.service to run) Update to 0.102.4 * CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue. * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. Update to 0.102.3 * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. * Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents. * Fix a couple of minor memory leaks. * Updated libclamunrar to UnRAR 5.9.2. Update to 0.102.2: * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. - The freshclam.service should not be started before the network is online (it checks for updates immediately upon service start) Update to 0.102.1: * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. Update to 0.102.0: * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 Update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504) Update to version 0.101.3: * bsc#1144504: ZIP bomb causes extreme CPU spikes Update to version 0.101.2 (bsc#1130721) * CVE-2019-1787: An out-of-bounds heap read condition may occur when scanning PDF documents. The defect is a failure to correctly keep track of the number of bytes remaining in a buffer when indexing file data. * CVE-2019-1789: An out-of-bounds heap read condition may occur when scanning PE files (i.e. Windows EXE and DLL files) that have been packed using Aspack as a result of inadequate bound-checking. * CVE-2019-1788: An out-of-bounds heap write condition may occur when scanning OLE2 files such as Microsoft Office 97-2003 documents. The invalid write happens when an invalid pointer is mistakenly used to initialize a 32bit integer to zero. This is likely to crash the application. * CVE-2019-1786: An out-of-bounds heap read condition may occur when scanning malformed PDF documents as a result of improper bounds-checking. * CVE-2019-1785: A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives. * CVE-2019-1798: A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2276=1 Package List: - openSUSE Leap 15.2 (x86_64): clamav-0.103.0-lp152.6.3.1 clamav-debuginfo-0.103.0-lp152.6.3.1 clamav-debugsource-0.103.0-lp152.6.3.1 clamav-devel-0.103.0-lp152.6.3.1 libclamav9-0.103.0-lp152.6.3.1 libclamav9-debuginfo-0.103.0-lp152.6.3.1 libfreshclam2-0.103.0-lp152.6.3.1 libfreshclam2-debuginfo-0.103.0-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://www.suse.com/security/cve/CVE-2019-15961.html https://www.suse.com/security/cve/CVE-2019-1785.html https://www.suse.com/security/cve/CVE-2019-1786.html https://www.suse.com/security/cve/CVE-2019-1787.html https://www.suse.com/security/cve/CVE-2019-1788.html https://www.suse.com/security/cve/CVE-2019-1789.html https://www.suse.com/security/cve/CVE-2019-1798.html https://www.suse.com/security/cve/CVE-2020-3123.html https://www.suse.com/security/cve/CVE-2020-3327.html https://www.suse.com/security/cve/CVE-2020-3341.html https://www.suse.com/security/cve/CVE-2020-3350.html https://www.suse.com/security/cve/CVE-2020-3481.html https://bugzilla.suse.com/1104457 https://bugzilla.suse.com/1118459 https://bugzilla.suse.com/1130721 https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1157763 [View Less]

1 0

openSUSE-SU-2020:2269-1: important: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 17 Dec '20

17 Dec '20

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2269-1 Rating: important References: #1155346 #1176029 #1177479 #1177575 #1177673 #1177793 #1179491 Cross-References: CVE-2020-1971 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An … [View More]update that solves one vulnerability and has 6 fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2020-1971: Fixed a null pointer dereference in EDIPARTYNAME (bsc#1179491). - Initialized dh->nid to NID_undef in DH_new_method() (bsc#1177673). - Fixed a test failure in apache_ssl in fips mode (bsc#1177793). - Renamed BN_get_rfc3526_prime_* functions back to get_rfc3526_prime_* (bsc#1177575). - Restored private key check in EC_KEY_check_key (bsc#1177479). - Added shared secret KAT to FIPS DH selftest (bsc#1176029). - Included ECDH/DH Requirements from SP800-56Arev3 (bsc#1176029). - Used SHA-2 in the RSA pairwise consistency check (bsc#1155346) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2269=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp151.5.20.1 libopenssl10-1.0.2p-lp151.5.20.1 libopenssl10-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-1.0.2p-lp151.5.20.1 libopenssl1_0_0-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-hmac-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-1.0.2p-lp151.5.20.1 openssl-1_0_0-cavs-1.0.2p-lp151.5.20.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-debuginfo-1.0.2p-lp151.5.20.1 openssl-1_0_0-debugsource-1.0.2p-lp151.5.20.1 - openSUSE Leap 15.1 (noarch): openssl-1_0_0-doc-1.0.2p-lp151.5.20.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp151.5.20.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp151.5.20.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp151.5.20.1 References: https://www.suse.com/security/cve/CVE-2020-1971.html https://bugzilla.suse.com/1155346 https://bugzilla.suse.com/1176029 https://bugzilla.suse.com/1177479 https://bugzilla.suse.com/1177575 https://bugzilla.suse.com/1177673 https://bugzilla.suse.com/1177793 https://bugzilla.suse.com/1179491 [View Less]

1 0

openSUSE-SU-2020:2268-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 17 Dec '20

17 Dec '20

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2268-1 Rating: moderate References: #1104457 #1118459 #1130721 #1144504 #1149458 #1157763 Cross-References: CVE-2019-12625 CVE-2019-12900 CVE-2019-15961 CVE-2019-1785 CVE-2019-1786 CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 CVE-2019-1798 … [View More] CVE-2020-3123 CVE-2020-3327 CVE-2020-3341 CVE-2020-3350 CVE-2020-3481 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for clamav fixes the following issues: clamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459) Note that libclamav was changed incompatible, if you have a 3rd party application that uses libclamav, it needs to be rebuilt. Update to 0.103.0 * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Fix clamav-milter.service (requires clamd.service to run) Update to 0.102.4 * CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue. * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. Update to 0.102.3 * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. * Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents. * Fix a couple of minor memory leaks. * Updated libclamunrar to UnRAR 5.9.2. Update to 0.102.2: * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. - The freshclam.service should not be started before the network is online (it checks for updates immediately upon service start) Update to 0.102.1: * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. Update to 0.102.0: * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 Update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504) Update to version 0.101.3: * bsc#1144504: ZIP bomb causes extreme CPU spikes Update to version 0.101.2 (bsc#1130721) * CVE-2019-1787: An out-of-bounds heap read condition may occur when scanning PDF documents. The defect is a failure to correctly keep track of the number of bytes remaining in a buffer when indexing file data. * CVE-2019-1789: An out-of-bounds heap read condition may occur when scanning PE files (i.e. Windows EXE and DLL files) that have been packed using Aspack as a result of inadequate bound-checking. * CVE-2019-1788: An out-of-bounds heap write condition may occur when scanning OLE2 files such as Microsoft Office 97-2003 documents. The invalid write happens when an invalid pointer is mistakenly used to initialize a 32bit integer to zero. This is likely to crash the application. * CVE-2019-1786: An out-of-bounds heap read condition may occur when scanning malformed PDF documents as a result of improper bounds-checking. * CVE-2019-1785: A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives. * CVE-2019-1798: A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2268=1 Package List: - openSUSE Leap 15.1 (x86_64): clamav-0.103.0-lp151.2.12.1 clamav-debuginfo-0.103.0-lp151.2.12.1 clamav-debugsource-0.103.0-lp151.2.12.1 clamav-devel-0.103.0-lp151.2.12.1 libclamav9-0.103.0-lp151.2.12.1 libclamav9-debuginfo-0.103.0-lp151.2.12.1 libfreshclam2-0.103.0-lp151.2.12.1 libfreshclam2-debuginfo-0.103.0-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://www.suse.com/security/cve/CVE-2019-15961.html https://www.suse.com/security/cve/CVE-2019-1785.html https://www.suse.com/security/cve/CVE-2019-1786.html https://www.suse.com/security/cve/CVE-2019-1787.html https://www.suse.com/security/cve/CVE-2019-1788.html https://www.suse.com/security/cve/CVE-2019-1789.html https://www.suse.com/security/cve/CVE-2019-1798.html https://www.suse.com/security/cve/CVE-2020-3123.html https://www.suse.com/security/cve/CVE-2020-3327.html https://www.suse.com/security/cve/CVE-2020-3341.html https://www.suse.com/security/cve/CVE-2020-3350.html https://www.suse.com/security/cve/CVE-2020-3481.html https://bugzilla.suse.com/1104457 https://bugzilla.suse.com/1118459 https://bugzilla.suse.com/1130721 https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1157763 [View Less]

1 0

openSUSE-SU-2020:2261-1: moderate: Security update for audacity
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for audacity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2261-1 Rating: moderate References: #1179449 Cross-References: CVE-2020-11867 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 … [View More]

1 0

openSUSE-SU-2020:2264-1: important: Security update for gdm
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2264-1 Rating: important References: #1178150 Cross-References: CVE-2020-16125 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2260-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2260-1 Rating: important References: #1149032 #1152489 #1153274 #1154353 #1155518 #1160634 #1166146 #1166166 #1167030 #1167773 #1170139 #1171073 #1171558 #1172873 #1173504 #1174852 #1175306 #1175918 #1176109 #1176180 … [View More]

1 0

openSUSE-SU-2020:2254-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 15 Dec '20

15 Dec '20

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2254-1 Rating: important References: #1177472 #1178428 Cross-References: CVE-2020-14765 CVE-2020-14776 CVE-2020-14789 CVE-2020-14812 CVE-2020-15180 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ … [View More]

1 0

openSUSE-SU-2020:2249-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 14 Dec '20

14 Dec '20

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2249-1 Rating: moderate References: #1179398 #1179399 #1179593 Cross-References: CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes … [View More]

1 0

openSUSE-SU-2020:2245-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 14 Dec '20

14 Dec '20

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2245-1 Rating: important References: #1179491 Cross-References: CVE-2020-1971 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2238-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 13 Dec '20

13 Dec '20

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2238-1 Rating: moderate References: #1179398 #1179399 #1179593 Cross-References: CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes … [View More]

1 0

openSUSE-SU-2020:2237-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 13 Dec '20

13 Dec '20

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2237-1 Rating: moderate References: #1177120 Cross-References: CVE-2020-26137 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2240-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 13 Dec '20

13 Dec '20

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2240-1 Rating: moderate References: #1173513 Cross-References: CVE-2020-14145 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2236-1: important: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 12 Dec '20

12 Dec '20

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2236-1 Rating: important References: #1155346 #1176029 #1177479 #1177575 #1177673 #1177793 #1179491 Cross-References: CVE-2020-1971 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An … [View More]update that solves one vulnerability and has 6 fixes is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2020-1971: Fixed a null pointer dereference in EDIPARTYNAME (bsc#1179491). - Initialized dh->nid to NID_undef in DH_new_method() (bsc#1177673). - Fixed a test failure in apache_ssl in fips mode (bsc#1177793). - Renamed BN_get_rfc3526_prime_* functions back to get_rfc3526_prime_* (bsc#1177575). - Restored private key check in EC_KEY_check_key (bsc#1177479). - Added shared secret KAT to FIPS DH selftest (bsc#1176029). - Included ECDH/DH Requirements from SP800-56Arev3 (bsc#1176029). - Used SHA-2 in the RSA pairwise consistency check (bsc#1155346) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2236=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp152.8.9.1 libopenssl10-1.0.2p-lp152.8.9.1 libopenssl10-debuginfo-1.0.2p-lp152.8.9.1 libopenssl1_0_0-1.0.2p-lp152.8.9.1 libopenssl1_0_0-debuginfo-1.0.2p-lp152.8.9.1 libopenssl1_0_0-hmac-1.0.2p-lp152.8.9.1 libopenssl1_0_0-steam-1.0.2p-lp152.8.9.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp152.8.9.1 openssl-1_0_0-1.0.2p-lp152.8.9.1 openssl-1_0_0-cavs-1.0.2p-lp152.8.9.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp152.8.9.1 openssl-1_0_0-debuginfo-1.0.2p-lp152.8.9.1 openssl-1_0_0-debugsource-1.0.2p-lp152.8.9.1 - openSUSE Leap 15.2 (noarch): openssl-1_0_0-doc-1.0.2p-lp152.8.9.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp152.8.9.1 libopenssl1_0_0-32bit-1.0.2p-lp152.8.9.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp152.8.9.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp152.8.9.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp152.8.9.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp152.8.9.1 References: https://www.suse.com/security/cve/CVE-2020-1971.html https://bugzilla.suse.com/1155346 https://bugzilla.suse.com/1176029 https://bugzilla.suse.com/1177479 https://bugzilla.suse.com/1177575 https://bugzilla.suse.com/1177673 https://bugzilla.suse.com/1177793 https://bugzilla.suse.com/1179491 [View Less]

1 0

openSUSE-SU-2020:2232-1: moderate: Security update for rpmlint
by opensuse-security＠opensuse.org 11 Dec '20

11 Dec '20

openSUSE Security Update: Security update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2232-1 Rating: moderate References: #1169614 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for rpmlint fixes … [View More]

1 0

openSUSE-SU-2020:2229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 Dec '20

11 Dec '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2229-1 Rating: important References: #1179576 Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Backports SLE-15-SP1 … [View More]

1 0

openSUSE-SU-2020:2227-1: moderate: Security update for pngcheck
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for pngcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2227-1 Rating: moderate References: #1179528 Cross-References: CVE-2020-27818 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]

1 0

openSUSE-SU-2020:2226-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2226-1 Rating: moderate References: #1179447 Cross-References: CVE-2020-12695 CVE-2020-28926 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2222-1: moderate: Security update for nsd
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for nsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2222-1 Rating: moderate References: #1157331 #1179191 Cross-References: CVE-2019-13207 CVE-2020-28935 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 … [View More] SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nsd fixes the following issues: nsd was updated to the new upstream release 4.3.4 FEATURES: - Merge PR #141: ZONEMD RR type. BUG FIXES: - Fix that symlink does not interfere with chown of pidfile (boo#1179191, CVE-2020-28935) - Fix #128: Fix that the invalid port number is logged for sendmmsg failed: Invalid argument. - Fix #133: fix 0-init of local ( stack ) buffer. - Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN. - Fix to add missing closest encloser NSEC3 for wildcard nodata type DS answer. - Fix #138: NSD returns non-EDNS answer when QUESTION is empty. - Fix #142: NODATA answers missin SOA in authority section after CNAME chain. New upstream release 4.3.3: FEATURES: - Follow DNS flag day 2020 advice and set default EDNS message size to 1232. - Merged PR #113 with fixes. Instead of listing an IP-address to listen on, an interface name can be specified in nsd.conf, with ip-address: eth0. The IP-addresses for that interface are then used. - New upstream release 4.3.2 FEATURES: - Fix #96: log-only-syslog: yes sets to only use syslog, fixes that the default configuration and systemd results in duplicate log messages. - Fix #107: nsd -v shows configure line, openssl version and libevent version. - Fix #103 with #110: min-expire-time option. To provide a lower bound for expire period. Expressed in number of seconds or refresh+retry+1. BUG FIXES: - Fix to omit the listen-on lines from log at startup, unless verbose. - Fix #97: EDNS unknown version: query not in response. - Fix #99: Fix copying of socket properties with reuseport enabled. - Document default value for tcp-timeout. - Merge PR#102 from and0x000: add missing default in documentation for drop-updates. - Fix unlink of pidfile warning if not possible due to permissions, nsd can display the message at high verbosity levels. - Removed contrib/nsd.service, example is too complicated and not useful. - Merge #108 from Nomis: Make the max-retry-time description clearer. - Retry when udp send buffer is full to wait until buffer space is available. - Remove errno reset behaviour from sendmmsg and recvmmsg replacement functions. - Fix unit test for different nsd-control-setup -h exit code. - Merge #112 from jaredmauch: log old and new serials when NSD rejects an IXFR due to an old serial number. - Fix #106: Adhere better to xfrd bounds. Refresh and retry times. - Fix #105: Clearing hash_tree means just emptying the tree. New upstream release 4.3.1 BUG FIXES: - Merge PR #91 by gearnode: nsd-control-setup recreate certificates. The '-r' option recreates certificates. Without it it creates them if they do not exist, and does not modify them otherwise. New upstream release 4.3.0 FEATURES: - Fix to use getrandom() for randomness, if available. - Fix #56: Drop sparse TSIG signing support in NSD. Sign every axfr packet with TSIG, according to the latest draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1. - Merge pull request #59 from buddyns: add FreeBSD support for conf key ip-transparent. - Add feature to pin server processes to specific cpus. - Add feature to pin IP addresses to selected server processes. - Set process title to identify individual processes. - Merge PR#22: minimise-any: prefer polular and not large RRset, from Daisuke Higashi. - Add support for SO_BINDTODEVICE on Linux. - Add feature to drop queries with opcode UPDATE. BUG FIXES: - Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters. - use-systemd is ignored in nsd.conf, when NSD is compiled with libsystemd it always signals readiness, if possible. - Note that use-systemd is not necessary and ignored in man page. - Fix responses for IXFR so that the authority section is not echoed in the response. - Fix that the retry wait does not exceed one day for zone transfers. - Update keyring as per https://nlnetlabs.nl/people/ New upstream release 4.2.3: * confine-to-zone configures NSD to not return out-of-zone additional information. * pidfile "" allows to run NSD without a pidfile * adds support for readiness notification with READY_FD * fix excessive logging of ixfr failures, it stops the log when fallback to axfr is possible. log is enabled at high verbosity. * The nsd.conf includes are sorted ascending, for include statements with a '*' from glob. * Fix log address and failure reason with tls handshake errors, squelches (the same as unbound) some unless high verbosity is used. * Number of different UDP handlers has been reduced to one. recvmmsg and sendmmsg implementations are now used on all platforms. * Socket options are now set in designated functions for easy reuse. * Socket setup has been simplified for easy reuse. * Configuration parser is now aware of the context in which an option was specified. * document that remote-control is a top-level nsd.conf attribute. - Remove legacy upgrade of nsd users in %post (boo#1157331) New upstream release 4.2.2: * Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the dname_concatenate() function. Reported by Frederic Cambus. It causes the zone parser to crash on a malformed zone file, with assertions enabled, an assertion catches it. * Fix #19: Out-of-bounds read caused by improper validation of array index. Reported by Frederic Cambus. The zone parser fails on type SIG because of mismatched definition with RRSIG. * PR #23: Fix typo in nsd.conf man-page. * Fix that NSD warns for wrong length of the hash in SSHFP records. * Fix #25: NSD doesn't refresh zones after extended downtime, it refreshes the old zones. * Set no renegotiation on the SSL context to stop client session renegotiation. * Fix #29: SSHFP check NULL pointer dereference. * Fix #30: SSHFP check failure due to missing domain name. * Fix to timeval_add in minievent for remaining second in microseconds. * PR #31: nsd-control: Add missing stdio header. * PR #32: tsig: Fix compilation without HAVE_SSL. * Cleanup tls context on xfrd exit. * Fix #33: Fix segfault in service of remaining streams on exit. * Fix error message for out of zone data to have more information. New upstream release 4.2.1: * FEATURES: - Added num.tls and num.tls6 stat counters. - PR #12: send-buffer-size, receive-buffer-size, tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek. - Fix #14, tcp connections have 1/10 to be active and have to work every second, and then they get time to complete during a reload, this is a process that lingers with the old version during a version update. * BUG FIXES: - Fix #13: Stray dot at the end of some log entries, removes dot after updated serial number in log entry. - Fix TLS cipher selection, the previous was redundant, prefers CHACHA20-POLY1305 over AESGCM and was not as readable as it could be. - Fix #15: crash in SSL library, initialize variables for TCP access when TLS is configured. - Fix tls handshake event callback function mistake, reported by Mykhailo Danylenko. - Fix output of nsd-checkconf -h. New upstream release 4.2.0: * Implement TCP fast open * Added DNS over TLS * TLS OCSP stapling support with the tls-service-ocsp option * New option hide-identity can be used in nsd.conf to stop NSD from responding with the hostname for probe queries that elicit the chaos class response, this is conform RFC4892 * Disable TLS1.0, TLS1.1 and weak ciphers, enable CIPHER_SERVER_PREFERENCE Update to upstream release 4.1.27: * FEATURES: - Deny ANY with only one RR in response, by default. Patch from Daisuke Higashi. The deny-any statement in nsd.conf sets ANY queries over UDP to be further moved to TCP as well. Also no additional section processig for type ANY, reducing the response size. - Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig and del_tsig. These changes are gone after reload, edit the config file (or a file included from it) to make changes that last after restart. * BUG FIXES: Update to upstream release 4.1.26: * FEATURES: - DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf. - Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes option in nsd.conf. - Added nsd-control changezone. nsd-control changezone name pattern allows the change of a zone pattern option without downtime for the zone, in one operation. * BUG FIXES: - Fix #4194: Zone file parser derailed by non-FQDN names in RHS of DNSSEC RRs. - Fix #4202: nsd-control delzone incorrect exit code on error. - Fix to not set GLOB_NOSORT so the nsd.conf include: files are sorted and in a predictable order. - Fix #3433: document that reconfig does not change per-zone stats. Update to upstream release 4.1.25: * FEATURES: - nsd-control prints neater errors for file failures. * BUG FIXES: - Fix that nsec3 precompile deletion happens before the RRs of the zone are deleted. - Fix printout of accepted remote control connection for unix sockets. - Fix use_systemd typo/leftover in remote.c. - Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu. - append_trailing_slash has one implementation and is not repeated differently. - Fix coding style in nsd.c - Fix to combine the same error function into one, from Xiaobo Liu. - Fix initialisation in remote.c. - please clang analyzer and fix parse of IPSECKEY with bad gateway. - Fix nsd-checkconf fail on bad zone name. - Annotate exit functions with noreturn. - Remove unused if clause during server service startup. - Fix #4156: Fix systemd service manager state change notification When it is compiled, systemd readiness signalling is enabled. The option in nsd.conf is not used, it is ignored when read. Update to upstream release 4.1.24: - Features * #4102: control interface via local socket * configure --enable-systemd (needs pkg-config and libsystemd) can be used to then use-systemd: yes in nsd.conf and have readiness signalling with systemd. * RFC8162 support, for record type SMIMEA. - Bug Fixes * Patch to fix openwrt for mac os build darwin detection in configure. * Fix that first control-interface determines if TLS is used. Warn when IP address interfaces are used without TLS. * #4106: Fix that stats printed from nsd-control are recast from unsigned long to unsigned (remote.c). * Fix that type CAA (and URI) in the zone file can contain dots when not in quotes. * #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM chain, NSD leniently attempts to find a working NSEC3PARAM. Update to upstream release 4.1.23: - Fix NSD time sensitive TSIG compare vulnerability. Update to upstream release 4.1.22: - Features: * refuse-any sends truncation (+TC) in reply to ANY queries over UDP, and allows TCP queries like normal. * Use accept4 to speed up answer of TCP queries - Bug fixes: * Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones. * Fix to use same condition for nsec3 hash allocation and free. - Changes in version 4.1.21: - Features: * --enable-memclean cleans up memory for use with memory checkers, eg. valgrind. * refuse-any nsd.conf option that refuses queries of type ANY. * lower memory usage for tcp connections, so tcp-count can be higher. - Bug fixes: * Fix spelling error in xfr-inspect. * Fix buffer size warnings from compiler on filename lengths. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2222=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-2222=1 Package List: - openSUSE Leap 15.2 (x86_64): nsd-4.3.4-lp152.2.3.1 nsd-debuginfo-4.3.4-lp152.2.3.1 nsd-debugsource-4.3.4-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): nsd-4.1.27-lp151.2.3.1 nsd-debuginfo-4.1.27-lp151.2.3.1 nsd-debugsource-4.1.27-lp151.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): nsd-4.3.4-bp152.2.3.1 nsd-debuginfo-4.3.4-bp152.2.3.1 nsd-debugsource-4.3.4-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): nsd-4.1.27-bp151.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nsd-4.3.4-8.1 References: https://www.suse.com/security/cve/CVE-2019-13207.html https://www.suse.com/security/cve/CVE-2020-28935.html https://bugzilla.suse.com/1157331 https://bugzilla.suse.com/1179191 [View Less]

1 0

openSUSE-SU-2020:2222-1: moderate: Security update for nsd
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for nsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2222-1 Rating: moderate References: #1157331 #1179191 Cross-References: CVE-2019-13207 CVE-2020-28935 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 … [View More]______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nsd fixes the following issues: nsd was updated to the new upstream release 4.3.4 FEATURES: - Merge PR #141: ZONEMD RR type. BUG FIXES: - Fix that symlink does not interfere with chown of pidfile (boo#1179191, CVE-2020-28935) - Fix #128: Fix that the invalid port number is logged for sendmmsg failed: Invalid argument. - Fix #133: fix 0-init of local ( stack ) buffer. - Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN. - Fix to add missing closest encloser NSEC3 for wildcard nodata type DS answer. - Fix #138: NSD returns non-EDNS answer when QUESTION is empty. - Fix #142: NODATA answers missin SOA in authority section after CNAME chain. New upstream release 4.3.3: FEATURES: - Follow DNS flag day 2020 advice and set default EDNS message size to 1232. - Merged PR #113 with fixes. Instead of listing an IP-address to listen on, an interface name can be specified in nsd.conf, with ip-address: eth0. The IP-addresses for that interface are then used. - New upstream release 4.3.2 FEATURES: - Fix #96: log-only-syslog: yes sets to only use syslog, fixes that the default configuration and systemd results in duplicate log messages. - Fix #107: nsd -v shows configure line, openssl version and libevent version. - Fix #103 with #110: min-expire-time option. To provide a lower bound for expire period. Expressed in number of seconds or refresh+retry+1. BUG FIXES: - Fix to omit the listen-on lines from log at startup, unless verbose. - Fix #97: EDNS unknown version: query not in response. - Fix #99: Fix copying of socket properties with reuseport enabled. - Document default value for tcp-timeout. - Merge PR#102 from and0x000: add missing default in documentation for drop-updates. - Fix unlink of pidfile warning if not possible due to permissions, nsd can display the message at high verbosity levels. - Removed contrib/nsd.service, example is too complicated and not useful. - Merge #108 from Nomis: Make the max-retry-time description clearer. - Retry when udp send buffer is full to wait until buffer space is available. - Remove errno reset behaviour from sendmmsg and recvmmsg replacement functions. - Fix unit test for different nsd-control-setup -h exit code. - Merge #112 from jaredmauch: log old and new serials when NSD rejects an IXFR due to an old serial number. - Fix #106: Adhere better to xfrd bounds. Refresh and retry times. - Fix #105: Clearing hash_tree means just emptying the tree. New upstream release 4.3.1 BUG FIXES: - Merge PR #91 by gearnode: nsd-control-setup recreate certificates. The '-r' option recreates certificates. Without it it creates them if they do not exist, and does not modify them otherwise. New upstream release 4.3.0 FEATURES: - Fix to use getrandom() for randomness, if available. - Fix #56: Drop sparse TSIG signing support in NSD. Sign every axfr packet with TSIG, according to the latest draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1. - Merge pull request #59 from buddyns: add FreeBSD support for conf key ip-transparent. - Add feature to pin server processes to specific cpus. - Add feature to pin IP addresses to selected server processes. - Set process title to identify individual processes. - Merge PR#22: minimise-any: prefer polular and not large RRset, from Daisuke Higashi. - Add support for SO_BINDTODEVICE on Linux. - Add feature to drop queries with opcode UPDATE. BUG FIXES: - Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters. - use-systemd is ignored in nsd.conf, when NSD is compiled with libsystemd it always signals readiness, if possible. - Note that use-systemd is not necessary and ignored in man page. - Fix responses for IXFR so that the authority section is not echoed in the response. - Fix that the retry wait does not exceed one day for zone transfers. - Update keyring as per https://nlnetlabs.nl/people/ New upstream release 4.2.3: * confine-to-zone configures NSD to not return out-of-zone additional information. * pidfile "" allows to run NSD without a pidfile * adds support for readiness notification with READY_FD * fix excessive logging of ixfr failures, it stops the log when fallback to axfr is possible. log is enabled at high verbosity. * The nsd.conf includes are sorted ascending, for include statements with a '*' from glob. * Fix log address and failure reason with tls handshake errors, squelches (the same as unbound) some unless high verbosity is used. * Number of different UDP handlers has been reduced to one. recvmmsg and sendmmsg implementations are now used on all platforms. * Socket options are now set in designated functions for easy reuse. * Socket setup has been simplified for easy reuse. * Configuration parser is now aware of the context in which an option was specified. * document that remote-control is a top-level nsd.conf attribute. - Remove legacy upgrade of nsd users in %post (boo#1157331) New upstream release 4.2.2: * Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the dname_concatenate() function. Reported by Frederic Cambus. It causes the zone parser to crash on a malformed zone file, with assertions enabled, an assertion catches it. * Fix #19: Out-of-bounds read caused by improper validation of array index. Reported by Frederic Cambus. The zone parser fails on type SIG because of mismatched definition with RRSIG. * PR #23: Fix typo in nsd.conf man-page. * Fix that NSD warns for wrong length of the hash in SSHFP records. * Fix #25: NSD doesn't refresh zones after extended downtime, it refreshes the old zones. * Set no renegotiation on the SSL context to stop client session renegotiation. * Fix #29: SSHFP check NULL pointer dereference. * Fix #30: SSHFP check failure due to missing domain name. * Fix to timeval_add in minievent for remaining second in microseconds. * PR #31: nsd-control: Add missing stdio header. * PR #32: tsig: Fix compilation without HAVE_SSL. * Cleanup tls context on xfrd exit. * Fix #33: Fix segfault in service of remaining streams on exit. * Fix error message for out of zone data to have more information. New upstream release 4.2.1: * FEATURES: - Added num.tls and num.tls6 stat counters. - PR #12: send-buffer-size, receive-buffer-size, tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek. - Fix #14, tcp connections have 1/10 to be active and have to work every second, and then they get time to complete during a reload, this is a process that lingers with the old version during a version update. * BUG FIXES: - Fix #13: Stray dot at the end of some log entries, removes dot after updated serial number in log entry. - Fix TLS cipher selection, the previous was redundant, prefers CHACHA20-POLY1305 over AESGCM and was not as readable as it could be. - Fix #15: crash in SSL library, initialize variables for TCP access when TLS is configured. - Fix tls handshake event callback function mistake, reported by Mykhailo Danylenko. - Fix output of nsd-checkconf -h. New upstream release 4.2.0: * Implement TCP fast open * Added DNS over TLS * TLS OCSP stapling support with the tls-service-ocsp option * New option hide-identity can be used in nsd.conf to stop NSD from responding with the hostname for probe queries that elicit the chaos class response, this is conform RFC4892 * Disable TLS1.0, TLS1.1 and weak ciphers, enable CIPHER_SERVER_PREFERENCE Update to upstream release 4.1.27: * FEATURES: - Deny ANY with only one RR in response, by default. Patch from Daisuke Higashi. The deny-any statement in nsd.conf sets ANY queries over UDP to be further moved to TCP as well. Also no additional section processig for type ANY, reducing the response size. - Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig and del_tsig. These changes are gone after reload, edit the config file (or a file included from it) to make changes that last after restart. * BUG FIXES: Update to upstream release 4.1.26: * FEATURES: - DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf. - Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes option in nsd.conf. - Added nsd-control changezone. nsd-control changezone name pattern allows the change of a zone pattern option without downtime for the zone, in one operation. * BUG FIXES: - Fix #4194: Zone file parser derailed by non-FQDN names in RHS of DNSSEC RRs. - Fix #4202: nsd-control delzone incorrect exit code on error. - Fix to not set GLOB_NOSORT so the nsd.conf include: files are sorted and in a predictable order. - Fix #3433: document that reconfig does not change per-zone stats. Update to upstream release 4.1.25: * FEATURES: - nsd-control prints neater errors for file failures. * BUG FIXES: - Fix that nsec3 precompile deletion happens before the RRs of the zone are deleted. - Fix printout of accepted remote control connection for unix sockets. - Fix use_systemd typo/leftover in remote.c. - Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu. - append_trailing_slash has one implementation and is not repeated differently. - Fix coding style in nsd.c - Fix to combine the same error function into one, from Xiaobo Liu. - Fix initialisation in remote.c. - please clang analyzer and fix parse of IPSECKEY with bad gateway. - Fix nsd-checkconf fail on bad zone name. - Annotate exit functions with noreturn. - Remove unused if clause during server service startup. - Fix #4156: Fix systemd service manager state change notification When it is compiled, systemd readiness signalling is enabled. The option in nsd.conf is not used, it is ignored when read. Update to upstream release 4.1.24: - Features * #4102: control interface via local socket * configure --enable-systemd (needs pkg-config and libsystemd) can be used to then use-systemd: yes in nsd.conf and have readiness signalling with systemd. * RFC8162 support, for record type SMIMEA. - Bug Fixes * Patch to fix openwrt for mac os build darwin detection in configure. * Fix that first control-interface determines if TLS is used. Warn when IP address interfaces are used without TLS. * #4106: Fix that stats printed from nsd-control are recast from unsigned long to unsigned (remote.c). * Fix that type CAA (and URI) in the zone file can contain dots when not in quotes. * #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM chain, NSD leniently attempts to find a working NSEC3PARAM. Update to upstream release 4.1.23: - Fix NSD time sensitive TSIG compare vulnerability. Update to upstream release 4.1.22: - Features: * refuse-any sends truncation (+TC) in reply to ANY queries over UDP, and allows TCP queries like normal. * Use accept4 to speed up answer of TCP queries - Bug fixes: * Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones. * Fix to use same condition for nsec3 hash allocation and free. - Changes in version 4.1.21: - Features: * --enable-memclean cleans up memory for use with memory checkers, eg. valgrind. * refuse-any nsd.conf option that refuses queries of type ANY. * lower memory usage for tcp connections, so tcp-count can be higher. - Bug fixes: * Fix spelling error in xfr-inspect. * Fix buffer size warnings from compiler on filename lengths. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2222=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2222=1 Package List: - openSUSE Leap 15.2 (x86_64): nsd-4.3.4-lp152.2.3.1 nsd-debuginfo-4.3.4-lp152.2.3.1 nsd-debugsource-4.3.4-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): nsd-4.1.27-lp151.2.3.1 nsd-debuginfo-4.1.27-lp151.2.3.1 nsd-debugsource-4.1.27-lp151.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): nsd-4.3.4-bp152.2.3.1 nsd-debuginfo-4.3.4-bp152.2.3.1 nsd-debugsource-4.3.4-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): nsd-4.1.27-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13207.html https://www.suse.com/security/cve/CVE-2020-28935.html https://bugzilla.suse.com/1157331 https://bugzilla.suse.com/1179191 [View Less]

1 0

openSUSE-SU-2020:2223-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2223-1 Rating: important References: #1179491 Cross-References: CVE-2020-1971 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2220-1: moderate: Security update for pngcheck
by opensuse-security＠opensuse.org 10 Dec '20

10 Dec '20

openSUSE Security Update: Security update for pngcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2220-1 Rating: moderate References: #1179528 Cross-References: CVE-2020-27818 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]

1 0

openSUSE-SU-2020:2216-1: important: Security update for chromium
by opensuse-security＠opensuse.org 09 Dec '20

09 Dec '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2216-1 Rating: important References: #1179576 Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.1 … [View More]

1 0

openSUSE-SU-2020:2213-1: important: Security update for chromium
by opensuse-security＠opensuse.org 09 Dec '20

09 Dec '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2213-1 Rating: important References: #1179576 Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Backports SLE-15-SP2 … [View More]

1 0

openSUSE-SU-2020:2211-1: important: Security update for python
by opensuse-security＠opensuse.org 09 Dec '20

09 Dec '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2211-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2205-1: moderate: Security update for rpmlint
by opensuse-security＠opensuse.org 08 Dec '20

08 Dec '20

openSUSE Security Update: Security update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2205-1 Rating: moderate References: #1169614 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the … [View More]

1 0

openSUSE-SU-2020:2204-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 08 Dec '20

08 Dec '20

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2204-1 Rating: moderate References: #1179447 Cross-References: CVE-2020-12695 CVE-2020-28926 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2192-1: important: Security update for xen
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2192-1 Rating: important References: #1177409 #1177412 #1177413 #1177414 #1178591 #1178963 Cross-References: CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27674 CVE-2020-28368 Affected Products: openSUSE Leap 15.1 … [View More]

1 0

openSUSE-SU-2020:2188-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2188-1 Rating: important References: #1179441 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for java-1_8_0-… [View More]

1 0

openSUSE-SU-2020:2198-1: moderate: Security update for pngcheck
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for pngcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2198-1 Rating: moderate References: #1179528 Cross-References: CVE-2020-27818 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2184-1: important: Security update for python-pip
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2184-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2185-1: important: Security update for python-setuptools
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for python-setuptools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2185-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]

1 0

openSUSE-SU-2020:2190-1: important: Security update for python3
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2190-1 Rating: important References: #1176262 #1179193 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now … [View More]available. Description: This update for python3 fixes the following issues: Update to 3.6.12 (bsc#1179193), including: - Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2190=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython3_6m1_0-3.6.12-lp151.6.27.1 libpython3_6m1_0-debuginfo-3.6.12-lp151.6.27.1 python3-3.6.12-lp151.6.27.1 python3-base-3.6.12-lp151.6.27.1 python3-base-debuginfo-3.6.12-lp151.6.27.1 python3-base-debugsource-3.6.12-lp151.6.27.1 python3-curses-3.6.12-lp151.6.27.1 python3-curses-debuginfo-3.6.12-lp151.6.27.1 python3-dbm-3.6.12-lp151.6.27.1 python3-dbm-debuginfo-3.6.12-lp151.6.27.1 python3-debuginfo-3.6.12-lp151.6.27.1 python3-debugsource-3.6.12-lp151.6.27.1 python3-devel-3.6.12-lp151.6.27.1 python3-devel-debuginfo-3.6.12-lp151.6.27.1 python3-idle-3.6.12-lp151.6.27.1 python3-testsuite-3.6.12-lp151.6.27.1 python3-testsuite-debuginfo-3.6.12-lp151.6.27.1 python3-tk-3.6.12-lp151.6.27.1 python3-tk-debuginfo-3.6.12-lp151.6.27.1 python3-tools-3.6.12-lp151.6.27.1 - openSUSE Leap 15.1 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp151.6.27.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp151.6.27.1 python3-32bit-3.6.12-lp151.6.27.1 python3-32bit-debuginfo-3.6.12-lp151.6.27.1 python3-base-32bit-3.6.12-lp151.6.27.1 python3-base-32bit-debuginfo-3.6.12-lp151.6.27.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1179193 [View Less]

1 0

openSUSE-SU-2020:2194-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2194-1 Rating: moderate References: #1179447 Cross-References: CVE-2020-12695 CVE-2020-28926 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2193-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2193-1 Rating: important References: #1050242 #1050536 #1050545 #1056653 #1056657 #1056787 #1064802 #1066129 #1103990 #1103992 #1104389 #1104393 #1109837 #1110096 #1111666 #1112178 #1112374 #1118657 #1122971 #1136460 … [View More]

1 0

openSUSE-SU-2020:2189-1: important: Security update for python
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2189-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2186-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2186-1 Rating: important References: #1174908 #1177596 Cross-References: CVE-2020-14360 CVE-2020-25712 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now … [View More]

1 0

openSUSE-SU-2020:2187-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2187-1 Rating: important References: #1178894 Cross-References: CVE-2020-15999 CVE-2020-16012 CVE-2020-26951 CVE-2020-26953 CVE-2020-26956 CVE-2020-26958 CVE-2020-26959 CVE-2020-26960 CVE-2020-26961 CVE-2020-26965 CVE-2020-26966 CVE-… [View More]2020-26968 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: TODO - Mozilla Thunderbird 78.5.0 * new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950) * new: MailExtensions: "compose_attachments" context added to Menus API (bmo#1670822) * new: MailExtensions: Menus API now available on displayed messages (bmo#1670825) * changed: MailExtensions: browser.tabs.create will now wait for "mail-delayed-startup-finished" event (bmo#1674407) * fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851) * fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285) * fixed: Chat: New chat contact menu item did not function (bmo#1663321) * fixed: Various theme and usability improvements (bmo#1673861) * fixed: Various security fixes MFSA 2020-52 (bsc#1178894) * CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code * CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls * CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI * CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API) * CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions * CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService * CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray * CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype * CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses * CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords * CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5 - Mozilla Thunderbird 78.4.3 * fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282) * fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2187=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-78.5.0-lp151.2.59.1 MozillaThunderbird-debuginfo-78.5.0-lp151.2.59.1 MozillaThunderbird-debugsource-78.5.0-lp151.2.59.1 MozillaThunderbird-translations-common-78.5.0-lp151.2.59.1 MozillaThunderbird-translations-other-78.5.0-lp151.2.59.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16012.html https://www.suse.com/security/cve/CVE-2020-26951.html https://www.suse.com/security/cve/CVE-2020-26953.html https://www.suse.com/security/cve/CVE-2020-26956.html https://www.suse.com/security/cve/CVE-2020-26958.html https://www.suse.com/security/cve/CVE-2020-26959.html https://www.suse.com/security/cve/CVE-2020-26960.html https://www.suse.com/security/cve/CVE-2020-26961.html https://www.suse.com/security/cve/CVE-2020-26965.html https://www.suse.com/security/cve/CVE-2020-26966.html https://www.suse.com/security/cve/CVE-2020-26968.html https://bugzilla.suse.com/1178894 [View Less]

1 0

openSUSE-SU-2020:2181-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Dec '20

07 Dec '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2181-1 Rating: important References: #1179576 Cross-References: CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Affected Products: openSUSE Leap 15.2 … [View More]

1 0

openSUSE-SU-2020:2177-1: moderate: Security update for pngcheck
by opensuse-security＠opensuse.org 06 Dec '20

06 Dec '20

openSUSE Security Update: Security update for pngcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2177-1 Rating: moderate References: #1179528 Cross-References: CVE-2020-27818 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2178-1: important: Security update for opera
by opensuse-security＠opensuse.org 06 Dec '20

06 Dec '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2178-1 Rating: important References: Cross-References: CVE-2020-16013 CVE-2020-16017 Affected Products: openSUSE Leap 15.2:NonFree openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes two … [View More]vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 72.0.3815.400 - DNA-88996 [Mac] Vertical spacing of sidebar items incorrect - DNA-89698 [Mac] text on bookmark bar not visible when application is not focused - DNA-89746 Add product-name switch to Opera launcher and installer - DNA-89779 Implement multi-window behavior for pinned Player - DNA-89924 Music continue to play after the disabling Player from Sidebar - DNA-89994 Fix progress bar shape and color - DNA-89995 Fix font sizes, weights and colors of text in control panel - DNA-90010 Payment Methods in Settings mention Google account - DNA-90022 [Mac][BigSur] Crash at -[BrowserWindowController window:willPositionSheet:usingRect:] - DNA-90025 Player stays in the autopause after reloading panel �� part 2 - DNA-90096 Sidebar click stat not collected for Player - DNA-90143 Adding a stat for Player sidebar clicks to the Avro schema - Update to version 72.0.3815.378 - CHR-8192 Update chromium on desktop-stable-86-3815 to 86.0.4240.198 - DNA-86550 XHRUint8Array test time out - DNA-88631 Unintended volume drop - DNA-88708 [Snap] Inproper area snapped - DNA-88726 [Mac] Overlay ��pause�� icon when Opera auto-pauses the Player - DNA-88903 Detach video button should not be visible - DNA-88938 Make home page reflect service configuration - DNA-88943 Learn more link on home page doesnt work - DNA-88944 Apple Music service slow to open - DNA-88948 Fetch audio focus request id from MediaSession - DNA-88949 Detach video button missing - DNA-88966 No accessiblity titles for services icons in home page - DNA-88967 Investigate creating a single BrowserSidebarModel instance - DNA-88995 Overlay ��pause�� is displayed when it shouldn��t - DNA-89017 Error when signing out of YouTube Music - DNA-89054 Audio is not resumed when muting audio in tab - DNA-89094 DCHECK when pressing Reload button - DNA-89095 Manage service data through PlayerService - DNA-89100 [Player] Crash �� many scenarios - DNA-89187 Reload button doesn��t work properly - DNA-89189 Update icons and buttons - DNA-89217 Enable #player-service on developer stream - DNA-89220 SidebarCarouselTests.* failing - DNA-89230 Crash at v8::Context::Enter() - DNA-89244 Define default widths per service - DNA-89245 Improve Spotify logo layout in home page buttons - DNA-89248 Crash at opera::WebPageBrowserSidebarItemContentViewViews ::UpdatePlayerService() - DNA-89278 [Sidebar] No notification for downloads and workspaces - DNA-89285 [Engine] Unable to launch skype with Opera - DNA-89292 Do not block page loads waiting for sitecheck data - DNA-89316 Should be able to navigate directly to playerServices section in settings - DNA-89339 Make popup appear with tooltip-like behavior - DNA-89340 Implement control panel looks in light and dark mode - DNA-89341 Make the control panel buttons work - DNA-89342 Add support for the DNA to the rollout system - DNA-89344 Show Music Service icon in the control panel - DNA-89360 Make ��Settings�� menu entry go to settings - DNA-89366 Make opera://feedback/babe attachable by the webdriver - DNA-89419 Crash at base::Value::GetAsDictionary (base::DictionaryValue const**) const - DNA-89469 Autopause does not work - DNA-89477 Do not wait with starting the player if the interrupting session is short - DNA-89480 Crash when hovering player panel - DNA-89484 Crash at base::internal::CheckedObserverAdapter ::IsMarkedForRemoval() - DNA-89489 Put control panel behind feature flag - DNA-89514 Implement feedback button for Player - DNA-89516 Do not auto-pause the Player when there is no sound - DNA-89553 Make the control panel show current song - DNA-89557 No accessibility title for rating and close buttons inside feedback dialog - DNA-89561 Make the control panel show artwork that represents current track - DNA-89575 Handle longer track and artist names - DNA-89577 Make progress bar work correctly - DNA-89630 Controler pop-up is too high (and service logo too) - DNA-89634 Panel width is reset when it shouldn��t - DNA-89654 Request higher resolution images for HiDPI - DNA-89655 Enable #player-service-control-panel on Developer stream - DNA-89671 No accessiblity titles for control panel elements - DNA-89672 String change ��A world of music�� - DNA-89679 Player �� don��t show control panel when Player in sidebar is opened - DNA-89722 Album cover arts are not visible - DNA-89766 Address bar does not respond to actions - DNA-89776 Control panel does not disappear after hovering elsewhere - DNA-89778 Implement multi-window behavior when no Player is pinned - DNA-89795 Player is enable after Opera restart (when in Settings was turned off) - DNA-89803 Artwork is cropped to the right - DNA-89812 Sidebar panel should hide when toggle between windows - DNA-89820 Incorrect music services for Philippines - DNA-89846 Do not show the control panel if there is nothing to show - DNA-89878 Clarify notification dot for messengers - DNA-89901 [Mac][Player] Zombie crash at exit - DNA-89952 Crash at opera::BrowserSidebarPlayerItemContentViewViews ::LoadPlayerServiceURL() - DNA-89964 Player stays in the autopause after reloading panel - DNA-89971 Multi window behaviour is not respected anymore - DNA-89976 Disallow docking for Player - DNA-89986 Enable #player-service and #player-service-control-panel on all streams - DNA-90006 Change services order in RU/UA/BY - The update to chromium 86.0.4240.198 fixes following issues: CVE-2020-16013, CVE-2020-16017 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-2178=1 - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-2178=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-72.0.3815.400-lp152.2.24.1 - openSUSE Leap 15.1:NonFree (x86_64): opera-72.0.3815.400-lp151.2.36.1 References: https://www.suse.com/security/cve/CVE-2020-16013.html https://www.suse.com/security/cve/CVE-2020-16017.html [View Less]

1 0

openSUSE-SU-2020:2173-1: moderate: Security update for python-cryptography
by opensuse-security＠opensuse.org 06 Dec '20

06 Dec '20

openSUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2173-1 Rating: moderate References: #1178168 Cross-References: CVE-2020-25659 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]

1 0

openSUSE-SU-2020:2169-1: important: Security update for python-pip
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2169-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This … [View More]

1 0

openSUSE-SU-2020:2170-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2170-1 Rating: important References: #1179441 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for java-1_8_0-… [View More]

1 0

openSUSE-SU-2020:2168-1: moderate: Security update for rclone
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for rclone ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2168-1 Rating: moderate References: #1179005 Cross-References: CVE-2020-28924 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]This update for rclone fixes the following issues: rclone was updated to version 1.53.3: * Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood) - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone * VFS - Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood) * Sharefile - Fix backend due to API swapping integers for strings (Nick Craig-Wood) Update to 1.53.2: * Bug Fixes - accounting + Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood) + Stabilize display order of transfers on Windows (Nick Craig-Wood) - operations + Fix use of --suffix without --backup-dir (Nick Craig-Wood) + Fix spurious "--checksum is in use but the source and destination have no hashes in common" (Nick Craig-Wood) - build + Work around GitHub actions brew problem (Nick Craig-Wood) + Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood) * Mount - mount2: Fix the swapped UID / GID values (Russell Cattelan) * VFS - Detect and recover from a file being removed externally from the cache (Nick Craig-Wood) - Fix a deadlock vulnerability in downloaders.Close (Leo Luan) - Fix a race condition in retryFailedResets (Leo Luan) - Fix missed concurrency control between some item operations and reset (Leo Luan) - Add exponential backoff during ENOSPC retries (Leo Luan) - Add a missed update of used cache space (Leo Luan) - Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood) * Local - Fix sizes and syncing with --links option on Windows (Nick Craig-Wood) * Chunker - Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev) - Fix upload over crypt (Ivan Andreev) * Fichier - Increase maximum file size from 100GB to 300GB (gyutw) * Jottacloud - Remove clientSecret from config when upgrading to token based authentication (buengese) - Avoid double url escaping of device/mountpoint (albertony) - Remove DirMove workaround as it's not required anymore - also (buengese) * Mailru - Fix uploads after recent changes on server (Ivan Andreev) - Fix range requests after june changes on server (Ivan Andreev) - Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev) * Onedrive - Fix disk usage for sharepoint (Nick Craig-Wood) * S3 - Add missing regions for AWS (Anagh Kumar Baranwal) * Seafile - Fix accessing libraries > 2GB on 32 bit systems (Muffin King) * SFTP - Always convert the checksum to lower case (buengese) * Union - Create root directories if none exist (Nick Craig-Wood) Update to version 1.53.1: * Bug Fixes - accounting: Remove new line from end of --stats-one-line display * VFS - Fix spurious error "vfs cache: failed to _ensure cache EOF" - Log an ERROR if we fail to set the file to be sparse * Local - Log an ERROR if we fail to set the file to be sparse * Drive - Re-adds special oauth help text * Opendrive - Do not retry 400 errors Update to version 1.53.0 * New Features - The VFS layer was heavily reworked for this release - see below for more details - Interactive mode -i/--interactive for destructive operations (fishbullet) - Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood) - Transfers are sorted by start time in the stats and progress output (Max Sum) - Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood) - Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood) - rclone check + Add reporting of filenames for same/missing/changed (Nick Craig-Wood) + Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood) + Make check do --checkers files concurrently (Nick Craig-Wood) + Retry downloads if they fail when using the --download flag (Nick Craig-Wood) + Make it show stats by default (Nick Craig-Wood) - rclone config + Set RCLONE_CONFIG_DIR for use in config files and subprocesses (Nick Craig-Wood) + Reject remote names starting with a dash. (jtagcat) - rclone cryptcheck: Add reporting of filenames for same/missing/changed (Nick Craig-Wood) - rclone dedupe: Make it obey the --size-only flag for duplicate detection (Nick Craig-Wood) - rclone link: Add --expire and --unlink flags (Roman Kredentser) - rclone mkdir: Warn when using mkdir on remotes which can't have empty directories (Nick Craig-Wood) - rclone rc: Allow JSON parameters to simplify command line usage (Nick Craig-Wood) - rclone serve ftp + Don't compile on < go1.13 after dependency update (Nick Craig-Wood) + Add error message if auth proxy fails (Nick Craig-Wood) + Use refactored goftp.io/server library for binary shrink (Nick Craig-Wood) - rclone serve restic: Expose interfaces so that rclone can be used as a library from within restic (Jack) - rclone sync: Add --track-renames-strategy leaf (Nick Craig-Wood) - rclone touch: Add ability to set nanosecond resolution times (Nick Craig-Wood) - rclone tree: Remove -i shorthand for --noindent as it conflicts with -i/--interactive (Nick Craig-Wood) * Bug Fixes * Mount - rc interface + Add call for unmount all (Chaitanya Bankanhal) + Make mount/mount remote control take vfsOpt option (Nick Craig-Wood) + Add mountOpt to mount/mount (Nick Craig-Wood) + Add VFS and Mount options to mount/listmounts (Nick Craig-Wood) - Catch panics in cgofuse initialization and turn into error messages (Nick Craig-Wood) - Always supply stat information in Readdir (Nick Craig-Wood) - Add support for reading unknown length files using direct IO (Windows) (Nick Craig-Wood) - Fix On Windows don't add -o uid/gid=-1 if user supplies -o uid/gid. (Nick Craig-Wood) - Fix volume name broken in recent refactor (Nick Craig-Wood) * VFS - Implement partial reads for --vfs-cache-mode full (Nick Craig-Wood) - Add --vfs-writeback option to delay writes back to cloud storage (Nick Craig-Wood) - Add --vfs-read-ahead parameter for use with --vfs-cache-mode full (Nick Craig-Wood) - Restart pending uploads on restart of the cache (Nick Craig-Wood) - Support synchronous cache space recovery upon ENOSPC (Leo Luan) - Allow ReadAt and WriteAt to run concurrently with themselves (Nick Craig-Wood) - Change modtime of file before upload to current (Rob Calistri) - Recommend --vfs-cache-modes writes on backends which can't stream (Nick Craig-Wood) - Add an optional fs parameter to vfs rc methods (Nick Craig-Wood) - Fix errors when using > 260 char files in the cache in Windows (Nick Craig-Wood) - Fix renaming of items while they are being uploaded (Nick Craig-Wood) - Fix very high load caused by slow directory listings (Nick Craig-Wood) - Fix renamed files not being uploaded with --vfs-cache-mode minimal (Nick Craig-Wood) - Fix directory locking caused by slow directory listings (Nick Craig-Wood) - Fix saving from chrome without --vfs-cache-mode writes (Nick Craig-Wood) * Crypt Add --crypt-server-side-across-configs flag (Nick Craig-Wood) Make any created backends be cached to fix rc problems (Nick Craig-Wood) * Azure Blob Don't compile on < go1.13 after dependency update (Nick Craig-Wood) * B2 Implement server side copy for files > 5GB (Nick Craig-Wood) Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) Note that b2's encoding now allows \ but rclone's hasn't changed (Nick Craig-Wood) Fix transfers when using download_url (Nick Craig-Wood) * Box - Implement rclone cleanup (buengese) - Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) - Allow authentication with access token (David) * Chunker - Make any created backends be cached to fix rc problems (Nick Craig-Wood) * Drive - Add rclone backend drives to list shared drives (teamdrives) (Nick Craig-Wood) - Implement rclone backend untrash (Nick Craig-Wood) - Work around drive bug which didn't set modtime of copied docs (Nick Craig-Wood) - Added --drive-starred-only to only show starred files (Jay McEntire) - Deprecate --drive-alternate-export as it is no longer needed (themylogin) - Fix duplication of Google docs on server side copy (Nick Craig-Wood) - Fix "panic: send on closed channel" when recycling dir entries (Nick Craig-Wood) * Dropbox - Add copyright detector info in limitations section in the docs (Alex Guerrero) - Fix rclone link by removing expires parameter (Nick Craig-Wood) * Fichier - Detect Flood detected: IP Locked error and sleep for 30s (Nick Craig-Wood) * FTP - Add explicit TLS support (Heiko Bornholdt) - Add support for --dump bodies and --dump auth for debugging (Nick Craig-Wood) - Fix interoperation with pure-ftpd (Nick Craig-Wood) * Google Cloud Storage - Add support for anonymous access (Kai L��ke) * Jottacloud - Bring back legacy authentification for use with whitelabel versions (buengese) - Switch to new api root - also implement a very ugly workaround for the DirMove failures (buengese) * Onedrive - Rework cancel of multipart uploads on rclone exit (Nick Craig-Wood) - Implement rclone cleanup (Nick Craig-Wood) - Add --onedrive-no-versions flag to remove old versions (Nick Craig-Wood) * Pcloud - Implement rclone link for public link creation (buengese) * Qingstor - Cancel in progress multipart uploads on rclone exit (Nick Craig-Wood) * S3 - Preserve metadata when doing multipart copy (Nick Craig-Wood) - Cancel in progress multipart uploads and copies on rclone exit (Nick Craig-Wood) - Add rclone link for public link sharing (Roman Kredentser) - Add rclone backend restore command to restore objects from GLACIER (Nick Craig-Wood) - Add rclone cleanup and rclone backend cleanup to clean unfinished multipart uploads (Nick Craig-Wood) - Add rclone backend list-multipart-uploads to list unfinished multipart uploads (Nick Craig-Wood) - Add --s3-max-upload-parts support (Kamil Trzci��ski) - Add --s3-no-check-bucket for minimising rclone transactions and perms (Nick Craig-Wood) - Add --s3-profile and --s3-shared-credentials-file options (Nick Craig-Wood) - Use regional s3 us-east-1 endpoint (David) - Add Scaleway provider (Vincent Feltz) - Update IBM COS endpoints (Egor Margineanu) - Reduce the default --s3-copy-cutoff to < 5GB for Backblaze S3 compatibility (Nick Craig-Wood) - Fix detection of bucket existing (Nick Craig-Wood) * SFTP - Use the absolute path instead of the relative path for listing for improved compatibility (Nick Craig-Wood) - Add --sftp-subsystem and --sftp-server-command options (aus) * Swift - Fix dangling large objects breaking the listing (Nick Craig-Wood) - Fix purge not deleting directory markers (Nick Craig-Wood) - Fix update multipart object removing all of its own parts (Nick Craig-Wood) - Fix missing hash from object returned from upload (Nick Craig-Wood) * Tardigrade - Upgrade to uplink v1.2.0 (Kaloyan Raev) * Union - Fix writing with the all policy (Nick Craig-Wood) * WebDAV - Fix directory creation with 4shared (Nick Craig-Wood) - Update to version 1.52.3 * Bug Fixes - docs + Disable smart typography (eg en-dash) in MANUAL.* and man page (Nick Craig-Wood) + Update install.md to reflect minimum Go version (Evan Harris) + Update install from source instructions (Nick Craig-Wood) + make_manual: Support SOURCE_DATE_EPOCH (Morten Linderud) - log: Fix --use-json-log going to stderr not --log-file on Windows (Nick Craig-Wood) - serve dlna: Fix file list on Samsung Series 6+ TVs (Matteo Pietro Dazzi) - sync: Fix deadlock with --track-renames-strategy modtime (Nick Craig-Wood) * Cache - Fix moveto/copyto remote:file remote:file2 (Nick Craig-Wood) * Drive - Stop using root_folder_id as a cache (Nick Craig-Wood) - Make dangling shortcuts appear in listings (Nick Craig-Wood) - Drop "Disabling ListR" messages down to debug (Nick Craig-Wood) - Workaround and policy for Google Drive API (Dmitry Ustalov) * FTP - Add note to docs about home vs root directory selection (Nick Craig-Wood) * Onedrive - Fix reverting to Copy when Move would have worked (Nick Craig-Wood) - Avoid comma rendered in URL in onedrive.md (Kevin) * Pcloud - Fix oauth on European region "eapi.pcloud.com" (Nick Craig-Wood) * S3 - Fix bucket Region auto detection when Region unset in config (Nick Craig-Wood) - Update to version 1.52.2 * Bug Fixes - build + Fix docker release build action (Nick Craig-Wood) + Fix custom timezone in Docker image (NoLooseEnds) - check: Fix misleading message which printed errors instead of differences (Nick Craig-Wood) - errors: Add WSAECONNREFUSED and more to the list of retriable Windows errors (Nick Craig-Wood) - rcd: Fix incorrect prometheus metrics (Gary Kim) - serve restic: Fix flags so they use environment variables (Nick Craig-Wood) - serve webdav: Fix flags so they use environment variables (Nick Craig-Wood) - sync: Fix --track-renames-strategy modtime (Nick Craig-Wood) * Drive - Fix not being able to delete a directory with a trashed shortcut (Nick Craig-Wood) - Fix creating a directory inside a shortcut (Nick Craig-Wood) - Fix --drive-impersonate with cached root_folder_id (Nick Craig-Wood) * SFTP - Fix SSH key PEM loading (Zac Rubin) * Swift - Speed up deletes by not retrying segment container deletes (Nick Craig-Wood) * Tardigrade - Upgrade to uplink v1.1.1 (Caleb Case) * WebDAV - Fix free/used display for rclone about/df for certain backends (Nick Craig-Wood) - Update to version 1.52.1 * VFS - Fix OS vs Unix path confusion - fixes ChangeNotify on Windows (Nick Craig-Wood) * Drive - Fix missing items when listing using --fast-list / ListR (Nick Craig-Wood) * Putio - Fix panic on Object.Open (Cenk Alti) * S3 - Fix upload of single files into buckets without create permission (Nick Craig-Wood) - Fix --header-upload (Nick Craig-Wood) * Tardigrade - Fix listing bug by upgrading to v1.0.7 - Set UserAgent to rclone (Caleb Case) - Update to version 1.52.0 * New backends - Tardigrade backend for use with storj.io (Caleb Case) - Union re-write to have multiple writable remotes (Max Sum) - Seafile for Seafile server (Fred @creativeprojects) * New commands - backend: command for backend specific commands (see backends) (Nick Craig-Wood) - cachestats: Deprecate in favour of rclone backend stats cache: (Nick Craig-Wood) - dbhashsum: Deprecate in favour of rclone hashsum DropboxHash (Nick Craig-Wood) * New Features - Add --header-download and --header-upload flags for setting HTTP headers when uploading/downloading (Tim Gallant) - Add --header flag to add HTTP headers to every HTTP transaction (Nick Craig-Wood) - Add --check-first to do all checking before starting transfers (Nick Craig-Wood) - Add --track-renames-strategy for configurable matching criteria for --track-renames (Bernd Schoolmann) - Add --cutoff-mode hard,soft,catious (Shing Kit Chan & Franklyn Tackitt) - Filter flags (eg --files-from -) can read from stdin (fishbullet) - Add --error-on-no-transfer option (Jon Fautley) - Implement --order-by xxx,mixed for copying some small and some big files (Nick Craig-Wood) - Allow --max-backlog to be negative meaning as large as possible (Nick Craig-Wood) - Added --no-unicode-normalization flag to allow Unicode filenames to remain unique (Ben Zenker) - Allow --min-age/--max-age to take a date as well as a duration (Nick Craig-Wood) - Add rename statistics for file and directory renames (Nick Craig-Wood) - Add statistics output to JSON log (reddi) - Make stats be printed on non-zero exit code (Nick Craig-Wood) - When running --password-command allow use of stdin (S��bastien Gross) - Stop empty strings being a valid remote path (Nick Craig-Wood) - accounting: support WriterTo for less memory copying (Nick Craig-Wood) - build + Update to use go1.14 for the build (Nick Craig-Wood) + Add -trimpath to release build for reproduceable builds (Nick Craig-Wood) + Remove GOOS and GOARCH from Dockerfile (Brandon Philips) - config + Fsync the config file after writing to save more reliably (Nick Craig-Wood) + Add --obscure and --no-obscure flags to config create/update (Nick Craig-Wood) + Make config show take remote: as well as remote (Nick Craig-Wood) - copyurl: Add --no-clobber flag (Denis) - delete: Added --rmdirs flag to delete directories as well (Kush) - filter: Added --files-from-raw flag (Ankur Gupta) - genautocomplete: Add support for fish shell (Matan Rosenberg) - log: Add support for syslog LOCAL facilities (Patryk Jakuszew) - lsjson: Add --hash-type parameter and use it in lsf to speed up hashing (Nick Craig-Wood) - rc + Add -o/--opt and -a/--arg for more structured input (Nick Craig-Wood) + Implement backend/command for running backend specific commands remotely (Nick Craig-Wood) + Add mount/mount command for starting rclone mount via the API (Chaitanya) - rcd: Add Prometheus metrics support (Gary Kim) - serve http + Added a --template flag for user defined markup (calistri) + Add Last-Modified headers to files and directories (Nick Craig-Wood) - serve sftp: Add support for multiple host keys by repeating --key flag (Maxime Suret) - touch: Add --localtime flag to make --timestamp localtime not UTC (Nick Craig-Wood) * Bug Fixes - accounting + Restore "Max number of stats groups reached" log line (Micha�� Matczuk) + Correct exitcode on Transfer Limit Exceeded flag. (Anuar Serdaliyev) + Reset bytes read during copy retry (Ankur Gupta) + Fix race clearing stats (Nick Craig-Wood) - copy: Only create empty directories when they don't exist on the remote (Ishuah Kariuki) - dedupe: Stop dedupe deleting files with identical IDs (Nick Craig-Wood) - oauth + Use custom http client so that --no-check-certificate is honored by oauth token fetch (Mark Spieth) + Replace deprecated oauth2.NoContext (Lars Lehtonen) - operations + Fix setting the timestamp on Windows for multithread copy (Nick Craig-Wood) + Make rcat obey --ignore-checksum (Nick Craig-Wood) + Make --max-transfer more accurate (Nick Craig-Wood) - rc + Fix dropped error (Lars Lehtonen) + Fix misplaced http server config (Xiaoxing Ye) + Disable duplicate log (ElonH) - serve dlna + Cds: don't specify childCount at all when unknown (Dan Walters) + Cds: use modification time as date in dlna metadata (Dan Walters) - serve restic: Fix tests after restic project removed vendoring (Nick Craig-Wood) - sync + Fix incorrect "nothing to transfer" message using --delete-before (Nick Craig-Wood) + Only create empty directories when they don't exist on the remote (Ishuah Kariuki) * Mount - Add --async-read flag to disable asynchronous reads (Nick Craig-Wood) - Ignore --allow-root flag with a warning as it has been removed upstream (Nick Craig-Wood) - Warn if --allow-non-empty used on Windows and clarify docs (Nick Craig-Wood) - Constrain to go1.13 or above otherwise bazil.org/fuse fails to compile (Nick Craig-Wood) - Fix fail because of too long volume name (evileye) - Report 1PB free for unknown disk sizes (Nick Craig-Wood) - Map more rclone errors into file systems errors (Nick Craig-Wood) - Fix disappearing cwd problem (Nick Craig-Wood) - Use ReaddirPlus on Windows to improve directory listing performance (Nick Craig-Wood) - Send a hint as to whether the filesystem is case insensitive or not (Nick Craig-Wood) - Add rc command mount/types (Nick Craig-Wood) - Change maximum leaf name length to 1024 bytes (Nick Craig-Wood) * VFS - Add --vfs-read-wait and --vfs-write-wait flags to control time waiting for a sequential read/write (Nick Craig-Wood) - Change default --vfs-read-wait to 20ms (it was 5ms and not configurable) (Nick Craig-Wood) - Make df output more consistent on a rclone mount. (Yves G) - Report 1PB free for unknown disk sizes (Nick Craig-Wood) - Fix race condition caused by unlocked reading of Dir.path (Nick Craig-Wood) - Make File lock and Dir lock not overlap to avoid deadlock (Nick Craig-Wood) - Implement lock ordering between File and Dir to eliminate deadlocks (Nick Craig-Wood) - Factor the vfs cache into its own package (Nick Craig-Wood) - Pin the Fs in use in the Fs cache (Nick Craig-Wood) - Add SetSys() methods to Node to allow caching stuff on a node (Nick Craig-Wood) - Ignore file not found errors from Hash in Read.Release (Nick Craig-Wood) - Fix hang in read wait code (Nick Craig-Wood) * Local - Speed up multi thread downloads by using sparse files on Windows (Nick Craig-Wood) - Implement --local-no-sparse flag for disabling sparse files (Nick Craig-Wood) - Implement rclone backend noop for testing purposes (Nick Craig-Wood) - Fix "file not found" errors on post transfer Hash calculation (Nick Craig-Wood) * Cache - Implement rclone backend stats command (Nick Craig-Wood) - Fix Server Side Copy with Temp Upload (Brandon McNama) - Remove Unused Functions (Lars Lehtonen) - Disable race tests until bbolt is fixed (Nick Craig-Wood) - Move methods used for testing into test file (greatroar) - Add Pin and Unpin and canonicalised lookup (Nick Craig-Wood) - Use proper import path go.etcd.io/bbolt (Robert-Andr�� Mauchin) * Crypt - Calculate hashes for uploads from local disk (Nick Craig-Wood) + This allows crypted Jottacloud uploads without using local disk + This means crypted s3/b2 uploads will now have hashes - Added rclone backend decode/encode commands to replicate functionality of cryptdecode (Anagh Kumar Baranwal) - Get rid of the unused Cipher interface as it obfuscated the code (Nick Craig-Wood) * Azure Blob - Implement streaming of unknown sized files so rcat is now supported (Nick Craig-Wood) - Implement memory pooling to control memory use (Nick Craig-Wood) - Add --azureblob-disable-checksum flag (Nick Craig-Wood) - Retry InvalidBlobOrBlock error as it may indicate block concurrency problems (Nick Craig-Wood) - Remove unused Object.parseTimeString() (Lars Lehtonen) - Fix permission error on SAS URL limited to container (Nick Craig-Wood) * B2 - Add support for --header-upload and --header-download (Tim Gallant) - Ignore directory markers at the root also (Nick Craig-Wood) - Force the case of the SHA1 to lowercase (Nick Craig-Wood) - Remove unused largeUpload.clearUploadURL() (Lars Lehtonen) * Box - Add support for --header-upload and --header-download (Tim Gallant) - Implement About to read size used (Nick Craig-Wood) - Add token renew function for jwt auth (David Bramwell) - Added support for interchangeable root folder for Box backend (Sunil Patra) - Remove unnecessary iat from jws claims (David) * Drive - Follow shortcuts by default, skip with --drive-skip-shortcuts (Nick Craig-Wood) - Implement rclone backend shortcut command for creating shortcuts (Nick Craig-Wood) - Added rclone backend command to change service_account_file and chunk_size (Anagh Kumar Baranwal) - Fix missing files when using --fast-list and --drive-shared-with-me (Nick Craig-Wood) - Fix duplicate items when using --drive-shared-with-me (Nick Craig-Wood) - Extend --drive-stop-on-upload-limit to respond to teamDriveFileLimitExceeded. (harry) - Don't delete files with multiple parents to avoid data loss (Nick Craig-Wood) - Server side copy docs use default description if empty (Nick Craig-Wood) * Dropbox - Make error insufficient space to be fatal (harry) - Add info about required redirect url (Elan Ruusam��e) * Fichier - Add support for --header-upload and --header-download (Tim Gallant) - Implement custom pacer to deal with the new rate limiting (buengese) * FTP - Fix lockup when using concurrency limit on failed connections (Nick Craig-Wood) - Fix lockup on failed upload when using concurrency limit (Nick Craig-Wood) - Fix lockup on Close failures when using concurrency limit (Nick Craig-Wood) - Work around pureftp sending spurious 150 messages (Nick Craig-Wood) * Google Cloud Storage - Add support for --header-upload and --header-download (Nick Craig-Wood) - Add ARCHIVE storage class to help (Adam Stroud) - Ignore directory markers at the root (Nick Craig-Wood) * Googlephotos - Make the start year configurable (Daven) - Add support for --header-upload and --header-download (Tim Gallant) - Create feature/favorites directory (Brandon Philips) - Fix "concurrent map write" error (Nick Craig-Wood) - Don't put an image in error message (Nick Craig-Wood) * HTTP - Improved directory listing with new template from Caddy project (calisro) * Jottacloud - Implement --jottacloud-trashed-only (buengese) - Add support for --header-upload and --header-download (Tim Gallant) - Use RawURLEncoding when decoding base64 encoded login token (buengese) - Implement cleanup (buengese) - Update docs regarding cleanup, removed remains from old auth, and added warning about special mountpoints. (albertony) * Mailru - Describe 2FA requirements (valery1707) * Onedrive - Implement --onedrive-server-side-across-configs (Nick Craig-Wood) - Add support for --header-upload and --header-download (Tim Gallant) - Fix occasional 416 errors on multipart uploads (Nick Craig-Wood) - Added maximum chunk size limit warning in the docs (Harry) - Fix missing drive on config (Nick Craig-Wood) - Make error quotaLimitReached to be fatal (harry) * Opendrive - Add support for --header-upload and --header-download (Tim Gallant) * Pcloud - Added support for interchangeable root folder for pCloud backend (Sunil Patra) - Add support for --header-upload and --header-download (Tim Gallant) - Fix initial config "Auth state doesn't match" message (Nick Craig-Wood) * Premiumizeme - Add support for --header-upload and --header-download (Tim Gallant) - Prune unused functions (Lars Lehtonen) * Putio - Add support for --header-upload and --header-download (Nick Craig-Wood) - Make downloading files use the rclone http Client (Nick Craig-Wood) - Fix parsing of remotes with leading and trailing / (Nick Craig-Wood) * Qingstor - Make rclone cleanup remove pending multipart uploads older than 24h (Nick Craig-Wood) - Try harder to cancel failed multipart uploads (Nick Craig-Wood) - Prune multiUploader.list() (Lars Lehtonen) - Lint fix (Lars Lehtonen) * S3 - Add support for --header-upload and --header-download (Tim Gallant) - Use memory pool for buffer allocations (Maciej Zimnoch) - Add SSE-C support for AWS, Ceph, and MinIO (Jack Anderson) - Fail fast multipart upload (Micha�� Matczuk) - Report errors on bucket creation (mkdir) correctly (Nick Craig-Wood) - Specify that Minio supports URL encoding in listings (Nick Craig-Wood) - Added 500 as retryErrorCode (Micha�� Matczuk) - Use --low-level-retries as the number of SDK retries (Aleksandar Jankovi��) - Fix multipart abort context (Aleksandar Jankovic) - Replace deprecated session.New() with session.NewSession() (Lars Lehtonen) - Use the provided size parameter when allocating a new memory pool (Joachim Brandon LeBlanc) - Use rclone's low level retries instead of AWS SDK to fix listing retries (Nick Craig-Wood) - Ignore directory markers at the root also (Nick Craig-Wood) - Use single memory pool (Micha�� Matczuk) - Do not resize buf on put to memBuf (Micha�� Matczuk) - Improve docs for --s3-disable-checksum (Nick Craig-Wood) - Don't leak memory or tokens in edge cases for multipart upload (Nick Craig-Wood) * Seafile - Implement 2FA (Fred) * SFTP - Added --sftp-pem-key to support inline key files (calisro) - Fix post transfer copies failing with 0 size when using set_modtime=false (Nick Craig-Wood) * Sharefile - Add support for --header-upload and --header-download (Tim Gallant) * Sugarsync - Add support for --header-upload and --header-download (Tim Gallant) * Swift - Add support for --header-upload and --header-download (Nick Craig-Wood) - Fix cosmetic issue in error message (Martin Michlmayr) * Union - Implement multiple writable remotes (Max Sum) - Fix server-side copy (Max Sum) - Implement ListR (Max Sum) - Enable ListR when upstreams contain local (Max Sum) * WebDAV - Add support for --header-upload and --header-download (Tim Gallant) - Fix X-OC-Mtime header for Transip compatibility (Nick Craig-Wood) - Report full and consistent usage with about (Yves G) * Yandex - Add support for --header-upload and --header-download (Tim Gallant) - Update to version 1.51.0 * See https://rclone.org/changelog/#v1-51-0-2020-02-01 for the complete changelog. - Update to version 1.50.2 * Bug Fixes - accounting: Fix memory leak on retries operations (Nick Craig-Wood) * Drive - Fix listing of the root directory with drive.files scope (Nick Craig-Wood) - Fix --drive-root-folder-id with team/shared drives (Nick Craig-Wood) - Update to version 1.50.1 * Bug Fixes - hash: Fix accidentally changed hash names for DropboxHash and CRC-32 (Nick Craig-Wood) - fshttp: Fix error reporting on tpslimit token bucket errors (Nick Craig-Wood) - fshttp: Don��t print token bucket errors on context cancelled (Nick Craig-Wood) * Local - Fix listings of . on Windows (Nick Craig-Wood) * Onedrive - Fix DirMove/Move after Onedrive change (Xiaoxing Ye) - Update to version 1.50.0 * New backends - Citrix Sharefile (Nick Craig-Wood) - Chunker - an overlay backend to split files into smaller parts (Ivan Andreev) - Mail.ru Cloud (Ivan Andreev) * New Features - encodings (Fabian M��ller & Nick Craig-Wood) + All backends now use file name encoding to ensure any file name can be written to any backend. + See the restricted file name docs for more info and the local backend docs. + Some file names may look different in rclone if you are using any control characters in names or unicode FULLWIDTH symbols. - build + Update to use go1.13 for the build (Nick Craig-Wood) + Drop support for go1.9 (Nick Craig-Wood) + Build rclone with GitHub actions (Nick Craig-Wood) + Convert python scripts to python3 (Nick Craig-Wood) + Swap Azure/go-ansiterm for mattn/go-colorable (Nick Craig-Wood) + Dockerfile fixes (Matei David) + Add plugin support for backends and commands (Richard Patel) - config + Use alternating Red/Green in config to make more obvious (Nick Craig-Wood) - contrib + Add sample DLNA server Docker Compose manifest. (pataquets) + Add sample WebDAV server Docker Compose manifest. (pataquets) - copyurl + Add --auto-filename flag for using file name from URL in destination path (Denis) - serve dlna: + Many compatability improvements (Dan Walters) + Support for external srt subtitles (Dan Walters) - rc + Added command core/quit (Saksham Khanna) * Bug Fixes - sync + Make --update/-u not transfer files that haven��t changed (Nick Craig-Wood) + Free objects after they come out of the transfer pipe to save memory (Nick Craig-Wood) + Fix --files-from without --no-traverse doing a recursive scan (Nick Craig-Wood) - operations + Fix accounting for server side copies (Nick Craig-Wood) + Display ��All duplicates removed�� only if dedupe successful (Sezal Agrawal) + Display ��Deleted X extra copies�� only if dedupe successful (Sezal Agrawal) - accounting + Only allow up to 100 completed transfers in the accounting list to save memory (Nick Craig-Wood) + Cull the old time ranges when possible to save memory (Nick Craig-Wood) + Fix panic due to server-side copy fallback (Ivan Andreev) + Fix memory leak noticeable for transfers of large numbers of objects (Nick Craig-Wood) + Fix total duration calculation (Nick Craig-Wood) - cmd + Fix environment variables not setting command line flags (Nick Craig-Wood) + Make autocomplete compatible with bash��s posix mode for macOS (Danil Semelenov) + Make --progress work in git bash on Windows (Nick Craig-Wood) + Fix ��compopt: command not found�� on autocomplete on macOS (Danil Semelenov) - config + Fix setting of non top level flags from environment variables (Nick Craig-Wood) + Check config names more carefully and report errors (Nick Craig-Wood) + Remove error: can��t use --size-only and --ignore-size together. (Nick Craig-Wood) + filter: Prevent mixing options when --files-from is in use (Michele Caci) + serve sftp: Fix crash on unsupported operations (eg Readlink) (Nick Craig-Wood) * Mount - Allow files of unkown size to be read properly (Nick Craig-Wood) - Skip tests on <= 2 CPUs to avoid lockup (Nick Craig-Wood) - Fix panic on File.Open (Nick Craig-Wood) - Fix ��mount_fusefs: -o timeout=: option not supported�� on FreeBSD (Nick Craig-Wood) - Don��t pass huge filenames (>4k) to FUSE as it can��t cope (Nick Craig-Wood) * VFS - Add flag --vfs-case-insensitive for windows/macOS mounts (Ivan Andreev) - Make objects of unknown size readable through the VFS (Nick Craig-Wood) - Move writeback of dirty data out of close() method into its own method (FlushWrites) and remove close() call from Flush() (Brett Dutro) - Stop empty dirs disappearing when renamed on bucket based remotes (Nick Craig-Wood) - Stop change notify polling clearing so much of the directory cache (Nick Craig-Wood) * Azure Blob - Disable logging to the Windows event log (Nick Craig-Wood) * B2 - Remove unverified: prefix on sha1 to improve interop (eg with CyberDuck) (Nick Craig-Wood) * Box - Add options to get access token via JWT auth (David) * Drive - Disable HTTP/2 by default to work around INTERNAL_ERROR problems (Nick Craig-Wood) - Make sure that drive root ID is always canonical (Nick Craig-Wood) - Fix --drive-shared-with-me from the root with lsand --fast-list (Nick Craig-Wood) - Fix ChangeNotify polling for shared drives (Nick Craig-Wood) - Fix change notify polling when using appDataFolder (Nick Craig-Wood) * Dropbox - Make disallowed filenames errors not retry (Nick Craig-Wood) - Fix nil pointer exception on restricted files (Nick Craig-Wood) * Fichier - Fix accessing files > 2GB on 32 bit systems (Nick Craig-Wood) * FTP - Allow disabling EPSV mode (Jon Fautley) * HTTP - HEAD directory entries in parallel to speedup (Nick Craig-Wood) - Add --http-no-head to stop rclone doing HEAD in listings (Nick Craig-Wood) * Putio - Add ability to resume uploads (Cenk Alti) * S3 - Fix signature v2_auth headers (Anthony Rusdi) - Fix encoding for control characters (Nick Craig-Wood) - Only ask for URL encoded directory listings if we need them on Ceph (Nick Craig-Wood) - Add option for multipart failiure behaviour (Aleksandar Jankovic) - Support for multipart copy (��) - Fix nil pointer reference if no metadata returned for object (Nick Craig-Wood) * SFTP - Fix --sftp-ask-password trying to contact the ssh agent (Nick Craig-Wood) - Fix hashes of files with backslashes (Nick Craig-Wood) - Include more ciphers with --sftp-use-insecure-cipher (Carlos Ferreyra) * WebDAV - Parse and return Sharepoint error response (Henning Surmeier) - Update to version 1.49.4 * Bug Fixes - cmd/rcd: Address ZipSlip vulnerability (Richard Patel) - accounting: Fix file handle leak on errors (Nick Craig-Wood) - oauthutil: Fix security problem when running with two users on the same machine (Nick Craig-Wood) * FTP - Fix listing of an empty root returning: error dir not found (Nick Craig-Wood) * S3 - Fix SetModTime on GLACIER/ARCHIVE objects and implement set/get tier (Nick Craig-Wood) - Update to version 1.49.3 * Bug Fixes - accounting + Fix total duration calculation (Aleksandar Jankovic) + Fix ��file already closed�� on transfer retries (Nick Craig-Wood) - Update to version 1.49.2 * New Features - build: Add Docker workflow support (Alfonso Montero) * Bug Fixes - accounting: Fix locking in Transfer to avoid deadlock with --progress (Nick Craig-Wood) - docs: Fix template argument for mktemp in install.sh (Cnly) - operations: Fix -u/--update with google photos / files of unknown size (Nick Craig-Wood) - rc: Fix docs for config/create /update /password (Nick Craig-Wood) * Google Cloud Storage - Fix need for elevated permissions on SetModTime (Nick Craig-Wood) - Update to version 1.49.1 * Bug Fixes - config: Fix generated passwords being stored as empty password (Nick Craig-Wood) - rcd: Added missing parameter for web-gui info logs. (Chaitanya) * Googlephotos - Fix crash on error response (Nick Craig-Wood) * Onedrive - Fix crash on error response (Nick Craig-Wood) - Update to version 1.49.0 * New backends - 1fichier (Laura Hausmann) - Google Photos (Nick Craig-Wood) - Putio (Cenk Alti) - premiumize.me (Nick Craig-Wood) * New Features - Experimental web GUI (Chaitanya Bankanhal) - Implement --compare-dest & --copy-dest (yparitcher) - Implement --suffix without --backup-dir for backup to current dir (yparitcher) - config reconnect to re-login (re-run the oauth login) for the backend. (Nick Craig-Wood) - config userinfo to discover which user you are logged in as. (Nick Craig-Wood) - config disconnect to disconnect you (log out) from the backend. (Nick Craig-Wood) - Add --use-json-log for JSON logging (justinalin) - Add context propagation to rclone (Aleksandar Jankovic) - Reworking internal statistics interfaces so they work with rc jobs (Aleksandar Jankovic) - Add Higher units for ETA (AbelThar) - Update rclone logos to new design (Andreas Chlupka) - hash: Add CRC-32 support (Cenk Alti) - help showbackend: Fixed advanced option category when there are no standard options (buengese) - ncdu: Display/Copy to Clipboard Current Path (Gary Kim) - operations: + Run hashing operations in parallel (Nick Craig-Wood) + Don��t calculate checksums when using --ignore-checksum (Nick Craig-Wood) + Check transfer hashes when using --size-only mode (Nick Craig-Wood) + Disable multi thread copy for local to local copies (Nick Craig-Wood) + Debug successful hashes as well as failures (Nick Craig-Wood) - rc + Add ability to stop async jobs (Aleksandar Jankovic) + Return current settings if core/bwlimit called without parameters (Nick Craig-Wood) + Rclone-WebUI integration with rclone (Chaitanya Bankanhal) + Added command line parameter to control the cross origin resource sharing (CORS) in the rcd. (Security Improvement) (Chaitanya Bankanhal) + Add anchor tags to the docs so links are consistent (Nick Craig-Wood) + Remove _async key from input parameters after parsing so later operations won��t get confused (buengese) + Add call to clear stats (Aleksandar Jankovic) - rcd + Auto-login for web-gui (Chaitanya Bankanhal) + Implement --baseurl for rcd and web-gui (Chaitanya Bankanhal) - serve dlna + Only select interfaces which can multicast for SSDP (Nick Craig-Wood) + Add more builtin mime types to cover standard audio/video (Nick Craig-Wood) + Fix missing mime types on Android causing missing videos (Nick Craig-Wood) - serve ftp + Refactor to bring into line with other serve commands (Nick Craig-Wood) + Implement --auth-proxy (Nick Craig-Wood) - serve http: Implement --baseurl (Nick Craig-Wood) - serve restic: Implement --baseurl (Nick Craig-Wood) - serve sftp + Implement auth proxy (Nick Craig-Wood) + Fix detection of whether server is authorized (Nick Craig-Wood) - serve webdav + Implement --baseurl (Nick Craig-Wood) + Support --auth-proxy (Nick Craig-Wood) * Bug Fixes - Make ��bad record MAC�� a retriable error (Nick Craig-Wood) - copyurl: Fix copying files that return HTTP errors (Nick Craig-Wood) - march: Fix checking sub-directories when using --no-traverse (buengese) - rc + Fix unmarshalable http.AuthFn in options and put in test for marshalability (Nick Craig-Wood) + Move job expire flags to rc to fix initalization problem (Nick Craig-Wood) + Fix --loopback with rc/list and others (Nick Craig-Wood) - rcat: Fix slowdown on systems with multiple hashes (Nick Craig-Wood) - rcd: Fix permissions problems on cache directory with web gui download (Nick Craig-Wood) * Mount - Default --deamon-timout to 15 minutes on macOS and FreeBSD (Nick Craig-Wood) - Update docs to show mounting from root OK for bucket based (Nick Craig-Wood) - Remove nonseekable flag from write files (Nick Craig-Wood) * VFS - Make write without cache more efficient (Nick Craig-Wood) - Fix --vfs-cache-mode minimal and writes ignoring cached files (Nick Craig-Wood) * Local - Add --local-case-sensitive and --local-case-insensitive (Nick Craig-Wood) - Avoid polluting page cache when uploading local files to remote backends (Micha�� Matczuk) - Don��t calculate any hashes by default (Nick Craig-Wood) - Fadvise run syscall on a dedicated go routine (Micha�� Matczuk) * Azure Blob - Azure Storage Emulator support (Sandeep) - Updated config help details to remove connection string references (Sandeep) - Make all operations work from the root (Nick Craig-Wood) * B2 - Implement link sharing (yparitcher) - Enable server side copy to copy between buckets (Nick Craig-Wood) - Make all operations work from the root (Nick Craig-Wood) * Drive - Fix server side copy of big files (Nick Craig-Wood) - Update API for teamdrive use (Nick Craig-Wood) - Add error for purge with --drive-trashed-only (ginvine) * Fichier - Make FolderID int and adjust related code (buengese) * Google Cloud Storage - Reduce oauth scope requested as suggested by Google (Nick Craig-Wood) - Make all operations work from the root (Nick Craig-Wood) * HTTP - Add --http-headers flag for setting arbitrary headers (Nick Craig-Wood) * Jottacloud - Use new api for retrieving internal username (buengese) - Refactor configuration and minor cleanup (buengese) * Koofr - Support setting modification times on Koofr backend. (jaKa) * Opendrive - Refactor to use existing lib/rest facilities for uploads (Nick Craig-Wood) * Qingstor - Upgrade to v3 SDK and fix listing loop (Nick Craig-Wood) - Make all operations work from the root (Nick Craig-Wood) * S3 - Add INTELLIGENT_TIERING storage class (Matti Niemenmaa) - Make all operations work from the root (Nick Craig-Wood) * SFTP - Add missing interface check and fix About (Nick Craig-Wood) - Completely ignore all modtime checks if SetModTime=false (Jon Fautley) - Support md5/sha1 with rsync.net (Nick Craig-Wood) - Save the md5/sha1 command in use to the config file for efficiency (Nick Craig-Wood) - Opt-in support for diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 (Yi FU) * Swift - Use FixRangeOption to fix 0 length files via the VFS (Nick Craig-Wood) - Fix upload when using no_chunk to return the correct size (Nick Craig-Wood) - Make all operations work from the root (Nick Craig-Wood) - Fix segments leak during failed large file uploads. (nguyenhuuluan434) * WebDAV - Add --webdav-bearer-token-command (Nick Craig-Wood) - Refresh token when it expires with --webdav-bearer-token-command (Nick Craig-Wood) - Add docs for using bearer_token_command with oidc-agent (Paul Millar) - Fix executable permission - Update to version 1.48.0 * New commands - serve sftp: Serve an rclone remote over SFTP (Nick Craig-Wood) * New Features - Multi threaded downloads to local storage (Nick Craig-Wood) controlled with --multi-thread-cutoff and --multi-thread-streams - Use rclone.conf from rclone executable directory to enable portable use (albertony) - Allow sync of a file and a directory with the same name (forgems) this is common on bucket based remotes, eg s3, gcs - Add --ignore-case-sync for forced case insensitivity (garry415) - Implement --stats-one-line-date and --stats-one-line-date-format (Peter Berbec) - Log an ERROR for all commands which exit with non-zero status (Nick Craig-Wood) - Use go-homedir to read the home directory more reliably (Nick Craig-Wood) - Enable creating encrypted config through external script invocation (Wojciech Smigielski) - build: Drop support for go1.8 (Nick Craig-Wood) - config: Make config create/update encrypt passwords where necessary (Nick Craig-Wood) - copyurl: Honor --no-check-certificate (Stefan Breunig) - install: Linux skip man pages if no mandb (didil) - lsf: Support showing the Tier of the object (Nick Craig-Wood) - lsjson + Added EncryptedPath to output (calisro) + Support showing the Tier of the object (Nick Craig-Wood) + Add IsBucket field for bucket based remote listing of the root (Nick Craig-Wood) - rc + Add --loopback flag to run commands directly without a server (Nick Craig-Wood) + Add operations/fsinfo: Return information about the remote (Nick Craig-Wood) + Skip auth for OPTIONS request (Nick Craig-Wood) + cmd/providers: Add DefaultStr, ValueStr and Type fields (Nick Craig-Wood) + jobs: Make job expiry timeouts configurable (Aleksandar Jankovic) - serve dlna reworked and improved (Dan Walters) - serve ftp: add --ftp-public-ip flag to specify public IP (calistri) - serve restic: Add support for --private-repos in serve restic (Florian Apolloner) - serve webdav: Combine serve webdav and serve http (Gary Kim) - size: Ignore negative sizes when calculating total (Garry McNulty) * Bug Fixes - Make move and copy individual files obey --backup-dir (Nick Craig-Wood) - If --ignore-checksum is in effect, don��t calculate checksum (Nick Craig-Wood) - moveto: Fix case-insensitive same remote move (Gary Kim) - rc: Fix serving bucket based objects with --rc-serve (Nick Craig-Wood) - serve webdav: Fix serveDir not being updated with changes from webdav (Gary Kim) * Mount - Fix poll interval documentation (Animosity022) * VFS - Make WriteAt for non cached files work with non-sequential writes (Nick Craig-Wood) * Local - Only calculate the required hashes for big speedup (Nick Craig-Wood) - Log errors when listing instead of returning an error (Nick Craig-Wood) - Fix preallocate warning on Linux with ZFS (Nick Craig-Wood) * Crypt - Make rclone dedupe work through crypt (Nick Craig-Wood) - Fix wrapping of ChangeNotify to decrypt directories properly (Nick Craig-Wood) - Support PublicLink (rclone link) of underlying backend (Nick Craig-Wood) - Implement Optional methods SetTier, GetTier (Nick Craig-Wood) * B2 - Implement server side copy (Nick Craig-Wood) - Implement SetModTime (Nick Craig-Wood) * Drive - Fix move and copy from TeamDrive to GDrive (Fionera) - Add notes that cleanup works in the background on drive (Nick Craig-Wood) - Add --drive-server-side-across-configs to default back to old server side copy semantics by default (Nick Craig-Wood) - Add --drive-size-as-quota to show storage quota usage for file size (Garry McNulty) * FTP - Add FTP List timeout (Jeff Quinn) - Add FTP over TLS support (Gary Kim) - Add --ftp-no-check-certificate option for FTPS (Gary Kim) * Google Cloud Storage - Fix upload errors when uploading pre 1970 files (Nick Craig-Wood) * Jottacloud - Add support for selecting device and mountpoint. (buengese) * Mega - Add cleanup support (Gary Kim) * Onedrive - More accurately check if root is found (Cnly) * S3 - Suppport S3 Accelerated endpoints with --s3-use-accelerate-endpoint (Nick Craig-Wood) - Add config info for Wasabi��s EU Central endpoint (Robert Marko) - Make SetModTime work for GLACIER while syncing (Philip Harvey) * SFTP - Add About support (Gary Kim) - Fix about parsing of df results so it can cope with -ve results (Nick Craig-Wood) - Send custom client version and debug server version (Nick Craig-Wood) * WebDAV - Retry on 423 Locked errors (Nick Craig-Wood) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2168=1 Package List: - openSUSE Backports SLE-15-SP1 (ppc64le s390x x86_64): rclone-1.53.3-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): rclone-bash-completion-1.53.3-bp151.4.6.1 rclone-zsh-completion-1.53.3-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-28924.html https://bugzilla.suse.com/1179005 [View Less]

1 0

openSUSE-SU-2020:2161-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2161-1 Rating: important References: #1149032 #1152489 #1153274 #1154353 #1155518 #1160634 #1167773 #1170139 #1171073 #1171558 #1172873 #1173504 #1174852 #1175721 #1175918 #1176109 #1176180 #1176200 #1176481 #1176586 … [View More]

1 0

openSUSE-SU-2020:2162-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2162-1 Rating: important References: #1177409 #1177412 #1177413 #1177414 #1178591 #1178963 Cross-References: CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27674 CVE-2020-28368 Affected Products: openSUSE Leap 15.2 … [View More]

1 0

openSUSE-SU-2020:2160-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2160-1 Rating: moderate References: #1179447 Cross-References: CVE-2020-12695 CVE-2020-28926 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. … [View More]

1 0

openSUSE-SU-2020:2158-1: moderate: Security update for neomutt
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for neomutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2158-1 Rating: moderate References: #1172906 #1172935 #1173197 #1179035 #1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP2 … [View More]______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for neomutt fixes the following issues: Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896. * Security - imap: close connection on all failures * Features - alias: add function to Alias/Query dialogs - config: add validators for {imap,smtp,pop}_authenticators - config: warn when signature file is missing or not readable - smtp: support for native SMTP LOGIN auth mech - notmuch: show originating folder in index * Bug Fixes - sidebar: prevent the divider colour bleeding out - sidebar: fix <sidebar-{next,prev}-new> - notmuch: fix query for current email - restore shutdown-hook functionality - crash in reply-to - user-after-free in folder-hook - fix some leaks - fix application of limits to modified mailboxes - write Date header when postponing * Translations - 100% Lithuanian - 100% Czech - 70% Turkish * Docs - Document that $sort_alias affects the query menu * Build - improve ASAN flags - add SASL and S/MIME to --everything - fix contrib (un)install * Code - my_hdr compose screen notifications - add contracts to the MXAPI - maildir refactoring - further reduce the use of global variables * Upstream - Add $count_alternatives to count attachments inside alternatives - Changes from 20200925 * Features - Compose: display user-defined headers - Address Book / Query: live sorting - Address Book / Query: patterns for searching - Config: Add '+=' and '-=' operators for String Lists - Config: Add '+=' operator for Strings - Allow postfix query ':setenv NAME?' for env vars * Bug Fixes - Fix crash when searching with invalid regexes - Compose: Prevent infinite loop of send2-hooks - Fix sidebar on new/removed mailboxes - Restore indentation for named mailboxes - Prevent half-parsing an alias - Remove folder creation prompt for POP path - Show error if $message_cachedir doesn't point to a valid directory - Fix tracking LastDir in case of IMAP paths with Unicode characters - Make sure all mail gets applied the index limit - Add warnings to -Q query CLI option - Fix index tracking functionality * Changed Config - Add $compose_show_user_headers (yes) * Translations - 100% Czech - 100% Lithuanian - Split up usage strings * Build - Run shellcheck on hcachever.sh - Add the Address Sanitizer - Move compose files to lib under compose/ - Move address config into libaddress - Update to latest acutest - fixes a memory leak in the unit tests * Code - Implement ARRAY API - Deglobalised the Config Sort functions - Refactor the Sidebar to be Event-Driven - Refactor the Color Event - Refactor the Commands list - Make ctx_update_tables private - Reduce the scope/deps of some Validator functions - Use the Email's IMAP UID instead of an increasing number as index - debug: log window focus - Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed. - Update to 20200821: * Bug Fixes - fix maildir flag generation - fix query notmuch if file is missing - notmuch: don't abort sync on error - fix type checking for send config variables * Changed Config - $sidebar_format - Use %D rather than %B for named mailboxes * Translations - 96% Lithuanian - 90% Polish - fix(sidebar): abbreviate/shorten what user sees - Fix sidebar mailbox name display problem. - Update to 20200814: * Notes - Add one-liner docs to config items See: neomutt -O -Q smart_wrap - Remove the built-in editor A large unused and unusable feature * Security - Add mitigation against DoS from thousands of parts boo#1179113 * Features - Allow index-style searching in postpone menu - Open NeoMutt using a mailbox name - Add cd command to change the current working directory - Add tab-completion menu for patterns - Allow renaming existing mailboxes - Check for missing attachments in alternative parts - Add one-liner docs to config items * Bug Fixes - Fix logic in checking an empty From address - Fix Imap crash in cmd_parse_expunge() - Fix setting attributes with S-Lang - Fix: redrawing of $pager_index_lines - Fix progress percentage for syncing large mboxes - Fix sidebar drawing in presence of indentation + named mailboxes - Fix retrieval of drafts when "postponed" is not in the mailboxes list - Do not add comments to address group terminators - Fix alias sorting for degenerate addresses - Fix attaching emails - Create directories for nonexistent file hcache case - Avoid creating mailboxes for failed subscribes - Fix crash if rejecting cert * Changed Config - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed - Change default of $crypt_protected_headers_subject to "..." - Add default keybindings to history-up/down * Translations - 100% Czech - 100% Spanish * Build - Allow building against Lua 5.4 - Fix when sqlite3.h is missing * Docs - Add a brief section on stty to the manual - Update section "Terminal Keybindings" in the manual - Clarify PGP Pseudo-header S<id> duration * Code - Clean up String API - Make the Sidebar more independent - De-centralise the Config Variables - Refactor dialogs - Refactor: Help Bar generation - Make more APIs Context-free - Adjust the edata use in Maildir and Notmuch - Window refactoring - Convert libsend to use Config functions - Refactor notifications to reduce noise - Convert Keymaps to use STAILQ - Track currently selected email by msgid - Config: no backing global variable - Add events for key binding * Upstream - Fix imap postponed mailbox use-after-free error - Speed up thread sort when many long threads exist - Fix ~v tagging when switching to non-threaded sorting - Add message/global to the list of known "message" types - Print progress meter when copying/saving tagged messages - Remove ansi formatting from autoview generated quoted replies - Change postpone mode to write Date header too - Unstuff format=flowed - Update to 20200626: * Bug Fixes - Avoid opening the same hcache file twice - Re-open Mailbox after folder-hook - Fix the matching of the spoolfile Mailbox - Fix link-thread to link all tagged emails * Changed Config - Add $tunnel_is_secure config, defaulting to true * Upstream - Don't check IMAP PREAUTH encryption if $tunnel is in use - Add recommendation to use $ssl_force_tls - Changes from 20200501: * Security - Abort GnuTLS certificate check if a cert in the chain is rejected CVE-2020-14154 boo#1172906 - TLS: clear data after a starttls acknowledgement CVE-2020-14954 boo#1173197 - Prevent possible IMAP MITM via PREAUTH response CVE-2020-14093 boo#1172935 * Features - add config operations +=/-= for number,long - Address book has a comment field - Query menu has a comment field * Contrib sample.neomuttrc-starter: Do not echo prompted password * Bug Fixes - make "news://" and "nntp://" schemes interchangeable - Fix CRLF to LF conversion in base64 decoding - Double comma in query - compose: fix redraw after history - Crash inside empty query menu - mmdf: fix creating new mailbox - mh: fix creating new mailbox - mbox: error out when an mbox/mmdf is a pipe - Fix list-reply by correct parsing of List-Post headers - Decode references according to RFC2047 - fix tagged message count - hcache: fix keylen not being considered when building the full key - sidebar: fix path comparison - Don't mess with the original pattern when running IMAP searches - Handle IMAP "NO" resps by issuing a msg instead of failing badly - imap: use the connection delimiter if provided - Memory leaks * Changed Config - $alias_format default changed to include %c comment - $query_format default changed to include %e extra info * Translations - 100% Lithuanian - 84% French - Log the translation in use * Docs - Add missing commands unbind, unmacro to man pages * Build - Check size of long using LONG_MAX instead of __WORDSIZE - Allow ./configure to not record cflags - fix out-of-tree build - Avoid locating gdbm symbols in qdbm library * Code - Refactor unsafe TAILQ returns - add window notifications - flip negative ifs - Update to latest acutest.h - test: add store tests - test: add compression tests - graphviz: email - make more opcode info available - refactor: main_change_folder() - refactor: mutt_mailbox_next() - refactor: generate_body() - compress: add {min,max}_level to ComprOps - emphasise empty loops: "// do nothing" - prex: convert is_from() to use regex - Refactor IMAP's search routines - Update to 20200501: * Bug Fixes - Make sure buffers are initialized on error - fix(sidebar): use abbreviated path if possible * Translations - 100% Lithuanian * Docs - make header cache config more explicit - Changes from 20200424: * Bug Fixes - Fix history corruption - Handle pretty much anything in a URL query part - Correctly parse escaped characters in header phrases - Fix crash reading received header - Fix sidebar indentation - Avoid crashing on failure to parse an IMAP mailbox - Maildir: handle deleted emails correctly - Ensure OP_NULL is always first * Translations - 100% Czech * Build - cirrus: enable pcre2, make pkgconf a special case - Fix finding pcre2 w/o pkgconf - build: tdb.h needs size_t, bring it in with stddef.h - Changes from 20200417: * Features - Fluid layout for Compose Screen, see: vimeo.com/407231157 - Trivial Database (TDB) header cache backend - RocksDB header cache backend - Add <sidebar-first> and <sidebar-last> functions * Bug Fixes - add error for CLI empty emails - Allow spaces and square brackets in paths - browser: fix hidden mailboxes - fix initial email display - notmuch: fix time window search. - fix resize bugs - notmuch: fix entire-thread: update current email pointer - sidebar: support indenting and shortening of names - Handle variables inside backticks in sidebar_whitelist - browser: fix mask regex error reporting * Translations - 100% Lithuanian - 99% Chinese (simplified) * Build - Use regexes for common parsing tasks: urls, dates - Add configure option --pcre2 -- Enable PCRE2 regular expressions - Add configure option --tdb -- Use TDB for the header cache - Add configure option --rocksdb -- Use RocksDB for the header cache - Create libstore (key/value backends) - Update to latest autosetup - Update to latest acutest.h - Rename doc/ directory to docs/ - make: fix location of .Po dependency files - Change libcompress to be more universal - Fix test fails on ��32 - fix uidvalidity to unsigned 32-bit int * Code - Increase test coverage - Fix memory leaks - Fix null checks * Upstream - Buffer refactoring - Fix use-after-free in mutt_str_replace() - Clarify PGP Pseudo-header S<id> duration - Try to respect MUTT_QUIET for IMAP contexts too - Limit recurse depth when parsing mime messages - Update to 20200320: * Bug Fixes - Fix COLUMNS env var - Fix sync after delete - Fix crash in notmuch - Fix sidebar indent - Fix emptying trash - Fix command line sending - Fix reading large address lists - Resolve symlinks only when necessary * Translations - lithuania 100% Lithuanian - es 96% Spanish * Docs - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output - Fix case of GPGME and SQLite * Build - Create libcompress (lz4, zlib, zstd) - Create libhistory - Create libbcache - Move zstrm to libconn * Code - Add more test coverage - Rename magic to type - Use mutt_file_fopen() on config variables - Change commands to use intptr_t for data - Update to 20200313: * Window layout - Sidebar is only visible when it's usable. * Features - UI: add number of old messages to sidebar_format - UI: support ISO 8601 calendar date - UI: fix commands that don��t need to have a non-empty mailbox to be valid - PGP: inform about successful decryption of inline PGP messages - PGP: try to infer the signing key from the From address - PGP: enable GPGMe by default - Notmuch: use query as name for vfolder-from-query - IMAP: add network traffic compression (COMPRESS=DEFLATE, RFC4978) - Header cache: add support for generic header cache compression * Bug Fixes - Fix uncollapse_jump - Only try to perform entire-thread on maildir/mh mailboxes - Fix crash in pager - Avoid logging single new lines at the end of header fields - Fix listing mailboxes - Do not recurse a non-threaded message - Fix initial window order - Fix leaks on IMAP error paths - Notmuch: compose(attach-message): support notmuch backend - Fix IMAP flag comparison code - Fix $move for IMAP mailboxes - Maildir: maildir_mbox_check_stats should only update mailbox stats if requested - Fix unmailboxes for virtual mailboxes - Maildir: sanitize filename before hashing - OAuth: if 'login' name isn't available use 'user' - Add error message on failed encryption - Fix a bunch of crashes - Force C locale for email date - Abort if run without a terminal * Changed Config - $crypt_use_gpgme - Now defaults to 'yes' (enabled) - $abort_backspace - Hitting backspace against an empty prompt aborts the prompt - $abort_key - String representation of key to abort prompts - $arrow_string - Use an custom string for arrow_cursor - $crypt_opportunistic_encrypt_strong_keys - Enable encryption only when strong a key is available - $header_cache_compress_dictionary - Filepath to dictionary for zstd compression - $header_cache_compress_level - Level of compression for method - $header_cache_compress_method - Enable generic hcache database compression - $imap_deflate - Compress network traffic - $smtp_user - Username for the SMTP server * Translations - 100% Lithuanian - 81% Spanish - 78% Russian * Build - Add libdebug - Rename public headers to lib.h - Create libcompress for compressed folders code * Code - Refactor Windows and Dialogs - Lots of code tidying - Refactor: mutt_addrlist_{search,write} - Lots of improvements to the Config code - Use Buffers more pervasively - Unify API function naming - Rename library shared headers - Refactor libconn gui dependencies - Refactor: init.[ch] - Refactor config to use subsets - Config: add path type - Remove backend deps from the connection code * Upstream - Allow ~b ~B ~h patterns in send2-hook - Rename smime oppenc mode parameter to get_keys_by_addr() - Add $crypt_opportunistic_encrypt_strong_keys config var - Fix crash when polling a closed ssl connection - Turn off auto-clear outside of autocrypt initialization - Add protected-headers="v1" to Content-Type when protecting headers - Fix segv in IMAP postponed menu caused by reopen_allow - Adding ISO 8601 calendar date - Fix $fcc_attach to not prompt in batch mode - Convert remaining mutt_encode_path() call to use struct Buffer - Fix rendering of replacement_char when Charset_is_utf8 - Update to latest acutest.h - Update to 20191207: * Features: - compose: draw status bar with highlights * Bug Fixes: - crash opening notmuch mailbox - crash in mutt_autocrypt_ui_recommendation - Avoid negative allocation - Mbox new mail - Setting of DT_MAILBOX type variables from Lua - imap: empty cmdbuf before connecting - imap: select the mailbox on reconnect - compose: fix attach message * Build: - make files conditional * Code: - enum-ify log levels - fix function prototypes - refactor virtual email lookups - factor out global Context - Changes from 20191129: * Features: - Add raw mailsize expando (%cr) * Bug Fixes: - Avoid double question marks in bounce confirmation msg - Fix bounce confirmation - fix new-mail flags and behaviour - fix: browser <descend-directory> - fix ssl crash - fix move to trash - fix flickering - Do not check hidden mailboxes for new mail - Fix new_mail_command notifications - fix crash in examine_mailboxes() - fix crash in mutt_sort_threads() - fix: crash after sending - Fix crash in tunnel's conn_close - fix fcc for deep dirs - imap: fix crash when new mail arrives - fix colour 'quoted9' - quieten messages on exit - fix: crash after failed mbox_check - browser: default to a file/dir view when attaching a file * Changed Config: - Change $write_bcc to default off * Docs: - Add a bit more documentation about sending - Clarify $write_bcc documentation. - Update documentation for raw size expando - docbook: set generate.consistent.ids to make generated html reproducible * Build: - fix build/tests for 32-bit arches - tests: fix test that would fail soon - tests: fix context for failing idna tests - Update to 20191111: Bug fixes: * browser: fix directory view * fix crash in mutt_extract_token() * force a screen refresh * fix crash sending message from command line * notmuch: use nm_default_uri if no mailbox data * fix forward attachments * fix: vfprintf undefined behaviour in body_handler * Fix relative symlink resolution * fix: trash to non-existent file/dir * fix re-opening of mbox Mailboxes * close logging as late as possible * log unknown mailboxes * fix crash in command line postpone * fix memory leaks * fix icommand parsing * fix new mail interaction with mail_check_recent This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2158=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): neomutt-20201120-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): neomutt-doc-20201120-bp152.2.3.1 neomutt-lang-20201120-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14093.html https://www.suse.com/security/cve/CVE-2020-14154.html https://www.suse.com/security/cve/CVE-2020-14954.html https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1172906 https://bugzilla.suse.com/1172935 https://bugzilla.suse.com/1173197 https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113 [View Less]

1 0

openSUSE-SU-2020:2157-1: moderate: Security update for neomutt
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for neomutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2157-1 Rating: moderate References: #1172906 #1172935 #1173197 #1179035 #1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP1 … [View More]______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for neomutt fixes the following issues: Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896. * Security - imap: close connection on all failures * Features - alias: add function to Alias/Query dialogs - config: add validators for {imap,smtp,pop}_authenticators - config: warn when signature file is missing or not readable - smtp: support for native SMTP LOGIN auth mech - notmuch: show originating folder in index * Bug Fixes - sidebar: prevent the divider colour bleeding out - sidebar: fix <sidebar-{next,prev}-new> - notmuch: fix query for current email - restore shutdown-hook functionality - crash in reply-to - user-after-free in folder-hook - fix some leaks - fix application of limits to modified mailboxes - write Date header when postponing * Translations - 100% Lithuanian - 100% Czech - 70% Turkish * Docs - Document that $sort_alias affects the query menu * Build - improve ASAN flags - add SASL and S/MIME to --everything - fix contrib (un)install * Code - my_hdr compose screen notifications - add contracts to the MXAPI - maildir refactoring - further reduce the use of global variables * Upstream - Add $count_alternatives to count attachments inside alternatives - Changes from 20200925 * Features - Compose: display user-defined headers - Address Book / Query: live sorting - Address Book / Query: patterns for searching - Config: Add '+=' and '-=' operators for String Lists - Config: Add '+=' operator for Strings - Allow postfix query ':setenv NAME?' for env vars * Bug Fixes - Fix crash when searching with invalid regexes - Compose: Prevent infinite loop of send2-hooks - Fix sidebar on new/removed mailboxes - Restore indentation for named mailboxes - Prevent half-parsing an alias - Remove folder creation prompt for POP path - Show error if $message_cachedir doesn't point to a valid directory - Fix tracking LastDir in case of IMAP paths with Unicode characters - Make sure all mail gets applied the index limit - Add warnings to -Q query CLI option - Fix index tracking functionality * Changed Config - Add $compose_show_user_headers (yes) * Translations - 100% Czech - 100% Lithuanian - Split up usage strings * Build - Run shellcheck on hcachever.sh - Add the Address Sanitizer - Move compose files to lib under compose/ - Move address config into libaddress - Update to latest acutest - fixes a memory leak in the unit tests * Code - Implement ARRAY API - Deglobalised the Config Sort functions - Refactor the Sidebar to be Event-Driven - Refactor the Color Event - Refactor the Commands list - Make ctx_update_tables private - Reduce the scope/deps of some Validator functions - Use the Email's IMAP UID instead of an increasing number as index - debug: log window focus - Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed. - Update to 20200821: * Bug Fixes - fix maildir flag generation - fix query notmuch if file is missing - notmuch: don't abort sync on error - fix type checking for send config variables * Changed Config - $sidebar_format - Use %D rather than %B for named mailboxes * Translations - 96% Lithuanian - 90% Polish - fix(sidebar): abbreviate/shorten what user sees - Fix sidebar mailbox name display problem. - Update to 20200814: * Notes - Add one-liner docs to config items See: neomutt -O -Q smart_wrap - Remove the built-in editor A large unused and unusable feature * Security - Add mitigation against DoS from thousands of parts boo#1179113 * Features - Allow index-style searching in postpone menu - Open NeoMutt using a mailbox name - Add cd command to change the current working directory - Add tab-completion menu for patterns - Allow renaming existing mailboxes - Check for missing attachments in alternative parts - Add one-liner docs to config items * Bug Fixes - Fix logic in checking an empty From address - Fix Imap crash in cmd_parse_expunge() - Fix setting attributes with S-Lang - Fix: redrawing of $pager_index_lines - Fix progress percentage for syncing large mboxes - Fix sidebar drawing in presence of indentation + named mailboxes - Fix retrieval of drafts when "postponed" is not in the mailboxes list - Do not add comments to address group terminators - Fix alias sorting for degenerate addresses - Fix attaching emails - Create directories for nonexistent file hcache case - Avoid creating mailboxes for failed subscribes - Fix crash if rejecting cert * Changed Config - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed - Change default of $crypt_protected_headers_subject to "..." - Add default keybindings to history-up/down * Translations - 100% Czech - 100% Spanish * Build - Allow building against Lua 5.4 - Fix when sqlite3.h is missing * Docs - Add a brief section on stty to the manual - Update section "Terminal Keybindings" in the manual - Clarify PGP Pseudo-header S<id> duration * Code - Clean up String API - Make the Sidebar more independent - De-centralise the Config Variables - Refactor dialogs - Refactor: Help Bar generation - Make more APIs Context-free - Adjust the edata use in Maildir and Notmuch - Window refactoring - Convert libsend to use Config functions - Refactor notifications to reduce noise - Convert Keymaps to use STAILQ - Track currently selected email by msgid - Config: no backing global variable - Add events for key binding * Upstream - Fix imap postponed mailbox use-after-free error - Speed up thread sort when many long threads exist - Fix ~v tagging when switching to non-threaded sorting - Add message/global to the list of known "message" types - Print progress meter when copying/saving tagged messages - Remove ansi formatting from autoview generated quoted replies - Change postpone mode to write Date header too - Unstuff format=flowed - Update to 20200626: * Bug Fixes - Avoid opening the same hcache file twice - Re-open Mailbox after folder-hook - Fix the matching of the spoolfile Mailbox - Fix link-thread to link all tagged emails * Changed Config - Add $tunnel_is_secure config, defaulting to true * Upstream - Don't check IMAP PREAUTH encryption if $tunnel is in use - Add recommendation to use $ssl_force_tls - Changes from 20200501: * Security - Abort GnuTLS certificate check if a cert in the chain is rejected CVE-2020-14154 boo#1172906 - TLS: clear data after a starttls acknowledgement CVE-2020-14954 boo#1173197 - Prevent possible IMAP MITM via PREAUTH response CVE-2020-14093 boo#1172935 * Features - add config operations +=/-= for number,long - Address book has a comment field - Query menu has a comment field * Contrib sample.neomuttrc-starter: Do not echo prompted password * Bug Fixes - make "news://" and "nntp://" schemes interchangeable - Fix CRLF to LF conversion in base64 decoding - Double comma in query - compose: fix redraw after history - Crash inside empty query menu - mmdf: fix creating new mailbox - mh: fix creating new mailbox - mbox: error out when an mbox/mmdf is a pipe - Fix list-reply by correct parsing of List-Post headers - Decode references according to RFC2047 - fix tagged message count - hcache: fix keylen not being considered when building the full key - sidebar: fix path comparison - Don't mess with the original pattern when running IMAP searches - Handle IMAP "NO" resps by issuing a msg instead of failing badly - imap: use the connection delimiter if provided - Memory leaks * Changed Config - $alias_format default changed to include %c comment - $query_format default changed to include %e extra info * Translations - 100% Lithuanian - 84% French - Log the translation in use * Docs - Add missing commands unbind, unmacro to man pages * Build - Check size of long using LONG_MAX instead of __WORDSIZE - Allow ./configure to not record cflags - fix out-of-tree build - Avoid locating gdbm symbols in qdbm library * Code - Refactor unsafe TAILQ returns - add window notifications - flip negative ifs - Update to latest acutest.h - test: add store tests - test: add compression tests - graphviz: email - make more opcode info available - refactor: main_change_folder() - refactor: mutt_mailbox_next() - refactor: generate_body() - compress: add {min,max}_level to ComprOps - emphasise empty loops: "// do nothing" - prex: convert is_from() to use regex - Refactor IMAP's search routines - Update to 20200501: * Bug Fixes - Make sure buffers are initialized on error - fix(sidebar): use abbreviated path if possible * Translations - 100% Lithuanian * Docs - make header cache config more explicit - Changes from 20200424: * Bug Fixes - Fix history corruption - Handle pretty much anything in a URL query part - Correctly parse escaped characters in header phrases - Fix crash reading received header - Fix sidebar indentation - Avoid crashing on failure to parse an IMAP mailbox - Maildir: handle deleted emails correctly - Ensure OP_NULL is always first * Translations - 100% Czech * Build - cirrus: enable pcre2, make pkgconf a special case - Fix finding pcre2 w/o pkgconf - build: tdb.h needs size_t, bring it in with stddef.h - Changes from 20200417: * Features - Fluid layout for Compose Screen, see: vimeo.com/407231157 - Trivial Database (TDB) header cache backend - RocksDB header cache backend - Add <sidebar-first> and <sidebar-last> functions * Bug Fixes - add error for CLI empty emails - Allow spaces and square brackets in paths - browser: fix hidden mailboxes - fix initial email display - notmuch: fix time window search. - fix resize bugs - notmuch: fix entire-thread: update current email pointer - sidebar: support indenting and shortening of names - Handle variables inside backticks in sidebar_whitelist - browser: fix mask regex error reporting * Translations - 100% Lithuanian - 99% Chinese (simplified) * Build - Use regexes for common parsing tasks: urls, dates - Add configure option --pcre2 -- Enable PCRE2 regular expressions - Add configure option --tdb -- Use TDB for the header cache - Add configure option --rocksdb -- Use RocksDB for the header cache - Create libstore (key/value backends) - Update to latest autosetup - Update to latest acutest.h - Rename doc/ directory to docs/ - make: fix location of .Po dependency files - Change libcompress to be more universal - Fix test fails on ��32 - fix uidvalidity to unsigned 32-bit int * Code - Increase test coverage - Fix memory leaks - Fix null checks * Upstream - Buffer refactoring - Fix use-after-free in mutt_str_replace() - Clarify PGP Pseudo-header S<id> duration - Try to respect MUTT_QUIET for IMAP contexts too - Limit recurse depth when parsing mime messages - Update to 20200320: * Bug Fixes - Fix COLUMNS env var - Fix sync after delete - Fix crash in notmuch - Fix sidebar indent - Fix emptying trash - Fix command line sending - Fix reading large address lists - Resolve symlinks only when necessary * Translations - lithuania 100% Lithuanian - es 96% Spanish * Docs - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output - Fix case of GPGME and SQLite * Build - Create libcompress (lz4, zlib, zstd) - Create libhistory - Create libbcache - Move zstrm to libconn * Code - Add more test coverage - Rename magic to type - Use mutt_file_fopen() on config variables - Change commands to use intptr_t for data - Update to 20200313: * Window layout - Sidebar is only visible when it's usable. * Features - UI: add number of old messages to sidebar_format - UI: support ISO 8601 calendar date - UI: fix commands that don��t need to have a non-empty mailbox to be valid - PGP: inform about successful decryption of inline PGP messages - PGP: try to infer the signing key from the From address - PGP: enable GPGMe by default - Notmuch: use query as name for vfolder-from-query - IMAP: add network traffic compression (COMPRESS=DEFLATE, RFC4978) - Header cache: add support for generic header cache compression * Bug Fixes - Fix uncollapse_jump - Only try to perform entire-thread on maildir/mh mailboxes - Fix crash in pager - Avoid logging single new lines at the end of header fields - Fix listing mailboxes - Do not recurse a non-threaded message - Fix initial window order - Fix leaks on IMAP error paths - Notmuch: compose(attach-message): support notmuch backend - Fix IMAP flag comparison code - Fix $move for IMAP mailboxes - Maildir: maildir_mbox_check_stats should only update mailbox stats if requested - Fix unmailboxes for virtual mailboxes - Maildir: sanitize filename before hashing - OAuth: if 'login' name isn't available use 'user' - Add error message on failed encryption - Fix a bunch of crashes - Force C locale for email date - Abort if run without a terminal * Changed Config - $crypt_use_gpgme - Now defaults to 'yes' (enabled) - $abort_backspace - Hitting backspace against an empty prompt aborts the prompt - $abort_key - String representation of key to abort prompts - $arrow_string - Use an custom string for arrow_cursor - $crypt_opportunistic_encrypt_strong_keys - Enable encryption only when strong a key is available - $header_cache_compress_dictionary - Filepath to dictionary for zstd compression - $header_cache_compress_level - Level of compression for method - $header_cache_compress_method - Enable generic hcache database compression - $imap_deflate - Compress network traffic - $smtp_user - Username for the SMTP server * Translations - 100% Lithuanian - 81% Spanish - 78% Russian * Build - Add libdebug - Rename public headers to lib.h - Create libcompress for compressed folders code * Code - Refactor Windows and Dialogs - Lots of code tidying - Refactor: mutt_addrlist_{search,write} - Lots of improvements to the Config code - Use Buffers more pervasively - Unify API function naming - Rename library shared headers - Refactor libconn gui dependencies - Refactor: init.[ch] - Refactor config to use subsets - Config: add path type - Remove backend deps from the connection code * Upstream - Allow ~b ~B ~h patterns in send2-hook - Rename smime oppenc mode parameter to get_keys_by_addr() - Add $crypt_opportunistic_encrypt_strong_keys config var - Fix crash when polling a closed ssl connection - Turn off auto-clear outside of autocrypt initialization - Add protected-headers="v1" to Content-Type when protecting headers - Fix segv in IMAP postponed menu caused by reopen_allow - Adding ISO 8601 calendar date - Fix $fcc_attach to not prompt in batch mode - Convert remaining mutt_encode_path() call to use struct Buffer - Fix rendering of replacement_char when Charset_is_utf8 - Update to latest acutest.h - Update to 20191207: * Features: - compose: draw status bar with highlights * Bug Fixes: - crash opening notmuch mailbox - crash in mutt_autocrypt_ui_recommendation - Avoid negative allocation - Mbox new mail - Setting of DT_MAILBOX type variables from Lua - imap: empty cmdbuf before connecting - imap: select the mailbox on reconnect - compose: fix attach message * Build: - make files conditional * Code: - enum-ify log levels - fix function prototypes - refactor virtual email lookups - factor out global Context - Changes from 20191129: * Features: - Add raw mailsize expando (%cr) * Bug Fixes: - Avoid double question marks in bounce confirmation msg - Fix bounce confirmation - fix new-mail flags and behaviour - fix: browser <descend-directory> - fix ssl crash - fix move to trash - fix flickering - Do not check hidden mailboxes for new mail - Fix new_mail_command notifications - fix crash in examine_mailboxes() - fix crash in mutt_sort_threads() - fix: crash after sending - Fix crash in tunnel's conn_close - fix fcc for deep dirs - imap: fix crash when new mail arrives - fix colour 'quoted9' - quieten messages on exit - fix: crash after failed mbox_check - browser: default to a file/dir view when attaching a file * Changed Config: - Change $write_bcc to default off * Docs: - Add a bit more documentation about sending - Clarify $write_bcc documentation. - Update documentation for raw size expando - docbook: set generate.consistent.ids to make generated html reproducible * Build: - fix build/tests for 32-bit arches - tests: fix test that would fail soon - tests: fix context for failing idna tests - Update to 20191111: Bug fixes: * browser: fix directory view * fix crash in mutt_extract_token() * force a screen refresh * fix crash sending message from command line * notmuch: use nm_default_uri if no mailbox data * fix forward attachments * fix: vfprintf undefined behaviour in body_handler * Fix relative symlink resolution * fix: trash to non-existent file/dir * fix re-opening of mbox Mailboxes * close logging as late as possible * log unknown mailboxes * fix crash in command line postpone * fix memory leaks * fix icommand parsing * fix new mail interaction with mail_check_recent This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2157=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): neomutt-20201120-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): neomutt-doc-20201120-bp151.3.3.1 neomutt-lang-20201120-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-14093.html https://www.suse.com/security/cve/CVE-2020-14154.html https://www.suse.com/security/cve/CVE-2020-14954.html https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1172906 https://bugzilla.suse.com/1172935 https://bugzilla.suse.com/1173197 https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113 [View Less]

1 0

openSUSE-SU-2020:2152-1: important: Security update for python3
by opensuse-security＠opensuse.org 03 Dec '20

03 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2152-1 Rating: important References: #1176262 #1179193 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now … [View More]available. Description: This update for python3 fixes the following issues: Update to 3.6.12 (bsc#1179193), including: - Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2152=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython3_6m1_0-3.6.12-lp152.4.9.1 libpython3_6m1_0-debuginfo-3.6.12-lp152.4.9.1 python3-3.6.12-lp152.4.9.1 python3-base-3.6.12-lp152.4.9.1 python3-base-debuginfo-3.6.12-lp152.4.9.1 python3-base-debugsource-3.6.12-lp152.4.9.1 python3-curses-3.6.12-lp152.4.9.1 python3-curses-debuginfo-3.6.12-lp152.4.9.1 python3-dbm-3.6.12-lp152.4.9.1 python3-dbm-debuginfo-3.6.12-lp152.4.9.1 python3-debuginfo-3.6.12-lp152.4.9.1 python3-debugsource-3.6.12-lp152.4.9.1 python3-devel-3.6.12-lp152.4.9.1 python3-devel-debuginfo-3.6.12-lp152.4.9.1 python3-idle-3.6.12-lp152.4.9.1 python3-testsuite-3.6.12-lp152.4.9.1 python3-testsuite-debuginfo-3.6.12-lp152.4.9.1 python3-tk-3.6.12-lp152.4.9.1 python3-tk-debuginfo-3.6.12-lp152.4.9.1 python3-tools-3.6.12-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp152.4.9.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp152.4.9.1 python3-32bit-3.6.12-lp152.4.9.1 python3-32bit-debuginfo-3.6.12-lp152.4.9.1 python3-base-32bit-3.6.12-lp152.4.9.1 python3-base-32bit-debuginfo-3.6.12-lp152.4.9.1 - openSUSE Leap 15.2 (noarch): python3-doc-3.6.12-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1179193 [View Less]

1 0

openSUSE-SU-2020:2149-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 02 Dec '20

02 Dec '20

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2149-1 Rating: moderate References: #1175596 #1177472 #1178428 Cross-References: CVE-2020-14765 CVE-2020-14776 CVE-2020-14789 CVE-2020-14812 CVE-2020-15180 Affected Products: openSUSE Leap 15.1 … [View More]______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: - Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180 - Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2149=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.11-lp151.3.15.1 libmariadb-devel-debuginfo-3.1.11-lp151.3.15.1 libmariadb3-3.1.11-lp151.3.15.1 libmariadb3-debuginfo-3.1.11-lp151.3.15.1 libmariadb_plugins-3.1.11-lp151.3.15.1 libmariadb_plugins-debuginfo-3.1.11-lp151.3.15.1 libmariadbprivate-3.1.11-lp151.3.15.1 libmariadbprivate-debuginfo-3.1.11-lp151.3.15.1 libmysqld-devel-10.2.36-lp151.2.18.1 libmysqld19-10.2.36-lp151.2.18.1 libmysqld19-debuginfo-10.2.36-lp151.2.18.1 mariadb-10.2.36-lp151.2.18.1 mariadb-bench-10.2.36-lp151.2.18.1 mariadb-bench-debuginfo-10.2.36-lp151.2.18.1 mariadb-client-10.2.36-lp151.2.18.1 mariadb-client-debuginfo-10.2.36-lp151.2.18.1 mariadb-connector-c-debugsource-3.1.11-lp151.3.15.1 mariadb-debuginfo-10.2.36-lp151.2.18.1 mariadb-debugsource-10.2.36-lp151.2.18.1 mariadb-galera-10.2.36-lp151.2.18.1 mariadb-test-10.2.36-lp151.2.18.1 mariadb-test-debuginfo-10.2.36-lp151.2.18.1 mariadb-tools-10.2.36-lp151.2.18.1 mariadb-tools-debuginfo-10.2.36-lp151.2.18.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.36-lp151.2.18.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.11-lp151.3.15.1 libmariadb3-32bit-debuginfo-3.1.11-lp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-14765.html https://www.suse.com/security/cve/CVE-2020-14776.html https://www.suse.com/security/cve/CVE-2020-14789.html https://www.suse.com/security/cve/CVE-2020-14812.html https://www.suse.com/security/cve/CVE-2020-15180.html https://bugzilla.suse.com/1175596 https://bugzilla.suse.com/1177472 https://bugzilla.suse.com/1178428 [View Less]

1 0

openSUSE-SU-2020:2147-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 02 Dec '20

02 Dec '20

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2147-1 Rating: important References: #1174908 #1177596 Cross-References: CVE-2020-14360 CVE-2020-25712 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now … [View More]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2141-1: important: Security update for mutt
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2141-1 Rating: important References: #1179035 #1179113 Cross-References: CVE-2020-28896 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. … [View More]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2142-1: important: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2142-1 Rating: important References: #1172515 #1176315 Cross-References: CVE-2020-17507 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now … [View More]available. Description: This update for libqt5-qtbase fixes the following issues: - CVE-2020-17507: Fixed a buffer overflow in XBM parser (bsc#1176315) - Fixed various issues discovered by fuzzing: - Made handling of XDG_RUNTIME_DIR more secure (bsc#1172515): This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2142=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libQt5Bootstrap-devel-static-5.12.7-lp152.3.9.1 libQt5Concurrent-devel-5.12.7-lp152.3.9.1 libQt5Concurrent5-5.12.7-lp152.3.9.1 libQt5Concurrent5-debuginfo-5.12.7-lp152.3.9.1 libQt5Core-devel-5.12.7-lp152.3.9.1 libQt5Core5-5.12.7-lp152.3.9.1 libQt5Core5-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus-devel-5.12.7-lp152.3.9.1 libQt5DBus-devel-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus5-5.12.7-lp152.3.9.1 libQt5DBus5-debuginfo-5.12.7-lp152.3.9.1 libQt5Gui-devel-5.12.7-lp152.3.9.1 libQt5Gui5-5.12.7-lp152.3.9.1 libQt5Gui5-debuginfo-5.12.7-lp152.3.9.1 libQt5KmsSupport-devel-static-5.12.7-lp152.3.9.1 libQt5Network-devel-5.12.7-lp152.3.9.1 libQt5Network5-5.12.7-lp152.3.9.1 libQt5Network5-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGL-devel-5.12.7-lp152.3.9.1 libQt5OpenGL5-5.12.7-lp152.3.9.1 libQt5OpenGL5-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGLExtensions-devel-static-5.12.7-lp152.3.9.1 libQt5PlatformHeaders-devel-5.12.7-lp152.3.9.1 libQt5PlatformSupport-devel-static-5.12.7-lp152.3.9.1 libQt5PrintSupport-devel-5.12.7-lp152.3.9.1 libQt5PrintSupport5-5.12.7-lp152.3.9.1 libQt5PrintSupport5-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql-devel-5.12.7-lp152.3.9.1 libQt5Sql5-5.12.7-lp152.3.9.1 libQt5Sql5-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-debuginfo-5.12.7-lp152.3.9.1 libQt5Test-devel-5.12.7-lp152.3.9.1 libQt5Test5-5.12.7-lp152.3.9.1 libQt5Test5-debuginfo-5.12.7-lp152.3.9.1 libQt5Widgets-devel-5.12.7-lp152.3.9.1 libQt5Widgets5-5.12.7-lp152.3.9.1 libQt5Widgets5-debuginfo-5.12.7-lp152.3.9.1 libQt5Xml-devel-5.12.7-lp152.3.9.1 libQt5Xml5-5.12.7-lp152.3.9.1 libQt5Xml5-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-common-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-common-devel-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-debugsource-5.12.7-lp152.3.9.1 libqt5-qtbase-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-gtk3-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-xdgdesktopportal-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-xdgdesktopportal-debuginfo-5.12.7-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libQt5Bootstrap-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent-devel-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent5-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Core-devel-32bit-5.12.7-lp152.3.9.1 libQt5Core5-32bit-5.12.7-lp152.3.9.1 libQt5Core5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus-devel-32bit-5.12.7-lp152.3.9.1 libQt5DBus-devel-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus5-32bit-5.12.7-lp152.3.9.1 libQt5DBus5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Gui-devel-32bit-5.12.7-lp152.3.9.1 libQt5Gui5-32bit-5.12.7-lp152.3.9.1 libQt5Gui5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Network-devel-32bit-5.12.7-lp152.3.9.1 libQt5Network5-32bit-5.12.7-lp152.3.9.1 libQt5Network5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGL-devel-32bit-5.12.7-lp152.3.9.1 libQt5OpenGL5-32bit-5.12.7-lp152.3.9.1 libQt5OpenGL5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGLExtensions-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5PlatformSupport-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport-devel-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport5-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql-devel-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Test-devel-32bit-5.12.7-lp152.3.9.1 libQt5Test5-32bit-5.12.7-lp152.3.9.1 libQt5Test5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Widgets-devel-32bit-5.12.7-lp152.3.9.1 libQt5Widgets5-32bit-5.12.7-lp152.3.9.1 libQt5Widgets5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Xml-devel-32bit-5.12.7-lp152.3.9.1 libQt5Xml5-32bit-5.12.7-lp152.3.9.1 libQt5Xml5-32bit-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-32bit-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-32bit-debuginfo-5.12.7-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): libQt5Core-private-headers-devel-5.12.7-lp152.3.9.1 libQt5DBus-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Gui-private-headers-devel-5.12.7-lp152.3.9.1 libQt5KmsSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Network-private-headers-devel-5.12.7-lp152.3.9.1 libQt5OpenGL-private-headers-devel-5.12.7-lp152.3.9.1 libQt5PlatformSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5PrintSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Sql-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Test-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Widgets-private-headers-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-private-headers-devel-5.12.7-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-17507.html https://bugzilla.suse.com/1172515 https://bugzilla.suse.com/1176315 [View Less]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2143-1: important: Security update for python-setuptools
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for python-setuptools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2143-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2139-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2139-1 Rating: moderate References: #1175132 #1178750 #1178752 #1178753 Cross-References: CVE-2020-28362 CVE-2020-28366 CVE-2020-28367 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update … [View More]that solves three vulnerabilities and has one errata is now available. Description: This update for go1.15 fixes the following issues: - go1.15.5 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages. * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362) * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367) * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366) * go#42169 cmd/compile, runtime, reflect: pointers to go:notinheap types must be stored indirectly in interfaces * go#42151 cmd/cgo: opaque struct pointers are broken since Go 1.15.3 * go#42138 time: Location interprets wrong timezone (DST) with slim zoneinfo * go#42113 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly * go#41914 net/http: request.Clone doesn't deep copy TransferEncoding * go#41704 runtime: macOS syscall.Exec can get SIGILL due to preemption signal * go#41463 compress/flate: deflatefast produces corrupted output * go#41387 x/net/http2: connection-level flow control not returned if stream errors, causes server hang * go#40974 cmd/link: sectionForAddress(0xA9D67F) address not in any section file Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2139=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.5-lp152.2.1 go1.15-doc-1.15.5-lp152.2.1 go1.15-race-1.15.5-lp152.2.1 References: https://www.suse.com/security/cve/CVE-2020-28362.html https://www.suse.com/security/cve/CVE-2020-28366.html https://www.suse.com/security/cve/CVE-2020-28367.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1178750 https://bugzilla.suse.com/1178752 https://bugzilla.suse.com/1178753 [View Less]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2133-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2133-1 Rating: moderate References: #1178611 Cross-References: CVE-2020-26950 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: … [View More]This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.4.2 MFSA 2020-49 (bsc#1178611) * CVE-2020-26950 (bmo#1675905) Write side effects in MCallGetProperty opcode not accounted for - Mozilla Thunderbird 78.4.1 * new: Thunderbird prompts for an address to use when starting an email from an address book entry with multiple addresses (bmo#84028) * fixed: Searching global search results did not work (bmo#1664761) * fixed: Link location was not focused by default when adding a hyperlink in message composer (bmo#1670660) * fixed: Advanced address book search dialog was unusable (bmo#1668147) * fixed: Encrypted draft reply emails lost "Re:" prefix (bmo#1661510) * fixed: Replying to a newsgroup message did not open the compose window (bmo#1672667) * fixed: Unable to delete multiple newsgroup messages (bmo#1657988) * fixed: Appmenu displayed visual glitches (bmo#1636243) * fixed: Visual glitches when selecting multiple messages in the message pane and using Ctrl+click (bmo#1671800) * fixed: Switching between dark and light mode could lead to unreadable text on macOS (bmo#1668989) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2133=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-78.4.2-lp151.2.56.1 MozillaThunderbird-debuginfo-78.4.2-lp151.2.56.1 MozillaThunderbird-debugsource-78.4.2-lp151.2.56.1 MozillaThunderbird-translations-common-78.4.2-lp151.2.56.1 MozillaThunderbird-translations-other-78.4.2-lp151.2.56.1 References: https://www.suse.com/security/cve/CVE-2020-26950.html https://bugzilla.suse.com/1178611 [View Less]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2129-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2129-1 Rating: moderate References: #1130103 #1178083 Cross-References: CVE-2019-17498 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: … [View More] openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for libssh2_org fixes the following issues: - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2129=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libssh2-1-1.9.0-lp152.8.3.1 libssh2-1-debuginfo-1.9.0-lp152.8.3.1 libssh2-devel-1.9.0-lp152.8.3.1 libssh2_org-debugsource-1.9.0-lp152.8.3.1 - openSUSE Leap 15.2 (x86_64): libssh2-1-32bit-1.9.0-lp152.8.3.1 libssh2-1-32bit-debuginfo-1.9.0-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-17498.html https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1130103 https://bugzilla.suse.com/1178083 [View Less]

1 0

[opensuse-security-announce] openSUSE-SU-2020:2128-1: important: Security update for mutt
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2128-1 Rating: important References: #1179035 #1179113 Cross-References: CVE-2020-28896 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. … [View More]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Security Announce