December 2020 - openSUSE Security Announce

[opensuse-security-announce] openSUSE-SU-2020:2139-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2139-1 Rating: moderate References: #1175132 #1178750 #1178752 #1178753 Cross-References: CVE-2020-28362 CVE-2020-28366 CVE-2020-28367 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.15 fixes the following issues: - go1.15.5 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages. * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362) * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367) * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366) * go#42169 cmd/compile, runtime, reflect: pointers to go:notinheap types must be stored indirectly in interfaces * go#42151 cmd/cgo: opaque struct pointers are broken since Go 1.15.3 * go#42138 time: Location interprets wrong timezone (DST) with slim zoneinfo * go#42113 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly * go#41914 net/http: request.Clone doesn't deep copy TransferEncoding * go#41704 runtime: macOS syscall.Exec can get SIGILL due to preemption signal * go#41463 compress/flate: deflatefast produces corrupted output * go#41387 x/net/http2: connection-level flow control not returned if stream errors, causes server hang * go#40974 cmd/link: sectionForAddress(0xA9D67F) address not in any section file Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2139=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.5-lp152.2.1 go1.15-doc-1.15.5-lp152.2.1 go1.15-race-1.15.5-lp152.2.1 References: https://www.suse.com/security/cve/CVE-2020-28362.html https://www.suse.com/security/cve/CVE-2020-28366.html https://www.suse.com/security/cve/CVE-2020-28367.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1178750 https://bugzilla.suse.com/1178752 https://bugzilla.suse.com/1178753

1 0

[opensuse-security-announce] openSUSE-SU-2020:2133-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2133-1 Rating: moderate References: #1178611 Cross-References: CVE-2020-26950 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.4.2 MFSA 2020-49 (bsc#1178611) * CVE-2020-26950 (bmo#1675905) Write side effects in MCallGetProperty opcode not accounted for - Mozilla Thunderbird 78.4.1 * new: Thunderbird prompts for an address to use when starting an email from an address book entry with multiple addresses (bmo#84028) * fixed: Searching global search results did not work (bmo#1664761) * fixed: Link location was not focused by default when adding a hyperlink in message composer (bmo#1670660) * fixed: Advanced address book search dialog was unusable (bmo#1668147) * fixed: Encrypted draft reply emails lost "Re:" prefix (bmo#1661510) * fixed: Replying to a newsgroup message did not open the compose window (bmo#1672667) * fixed: Unable to delete multiple newsgroup messages (bmo#1657988) * fixed: Appmenu displayed visual glitches (bmo#1636243) * fixed: Visual glitches when selecting multiple messages in the message pane and using Ctrl+click (bmo#1671800) * fixed: Switching between dark and light mode could lead to unreadable text on macOS (bmo#1668989) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2133=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-78.4.2-lp151.2.56.1 MozillaThunderbird-debuginfo-78.4.2-lp151.2.56.1 MozillaThunderbird-debugsource-78.4.2-lp151.2.56.1 MozillaThunderbird-translations-common-78.4.2-lp151.2.56.1 MozillaThunderbird-translations-other-78.4.2-lp151.2.56.1 References: https://www.suse.com/security/cve/CVE-2020-26950.html https://bugzilla.suse.com/1178611

1 0

[opensuse-security-announce] openSUSE-SU-2020:2129-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2129-1 Rating: moderate References: #1130103 #1178083 Cross-References: CVE-2019-17498 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for libssh2_org fixes the following issues: - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2129=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libssh2-1-1.9.0-lp152.8.3.1 libssh2-1-debuginfo-1.9.0-lp152.8.3.1 libssh2-devel-1.9.0-lp152.8.3.1 libssh2_org-debugsource-1.9.0-lp152.8.3.1 - openSUSE Leap 15.2 (x86_64): libssh2-1-32bit-1.9.0-lp152.8.3.1 libssh2-1-32bit-debuginfo-1.9.0-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-17498.html https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1130103 https://bugzilla.suse.com/1178083

1 0

[opensuse-security-announce] openSUSE-SU-2020:2128-1: important: Security update for mutt
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2128-1 Rating: important References: #1179035 #1179113 Cross-References: CVE-2020-28896 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mutt fixes the following issues: - CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035) - Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2128=1 Package List: - openSUSE Leap 15.1 (x86_64): mutt-1.10.1-lp151.2.6.1 mutt-debuginfo-1.10.1-lp151.2.6.1 mutt-debugsource-1.10.1-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): mutt-doc-1.10.1-lp151.2.6.1 mutt-lang-1.10.1-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113

1 0