December 2020

openSUSE-SU-2020:2344-1: Security update for PackageKit
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2344-1 Rating: low References: #1104313 #1176930 Cross-References: CVE-2020-16121 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. … [View More] Description: This update for PackageKit fixes the following issue: - CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930). - Update summary and description of gstreamer-plugin and gtk3-module. (bsc#1104313) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2344=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): PackageKit-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-debuginfo-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debugsource-1.1.13-lp152.3.15.1 PackageKit-devel-1.1.13-lp152.3.15.1 PackageKit-devel-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-1.1.13-lp152.3.15.1 typelib-1_0-PackageKitGlib-1_0-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (x86_64): libpackagekit-glib2-18-32bit-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-32bit-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): PackageKit-branding-upstream-1.1.13-lp152.3.15.1 PackageKit-lang-1.1.13-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-16121.html https://bugzilla.suse.com/1104313 https://bugzilla.suse.com/1176930 [View Less]

1 0

openSUSE-SU-2020:2336-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2336-1 Rating: moderate References: #1177789 Cross-References: CVE-2019-14584 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update … [View More]

1 0

openSUSE-SU-2020:2337-1: moderate: Security update for blosc
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for blosc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2337-1 Rating: moderate References: #1174075 #1179914 Cross-References: CVE-2020-29367 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 … [View More]______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for blosc fixes the following issues: Update to version 1.20.1 boo#1179914 CVE-2020-29367: * More saftey checks have been implemented so that potential flaws discovered by new fuzzers in OSS-Fuzzer are fixed now * BloscLZ updated to 2.3.0. Expect better compression ratios for faster codecs. For details, see our new blog post: https://blosc.org/posts/beast-release/ * Fixed the _xgetbv() collision. Thanks to Micha�� G��rny (@mgorny). Update to version 1.19.0: * The length of automatic blocksizes for fast codecs (lz4, blosclz) has been incremented quite a bit (up to 256 KB) for better compression ratios. * The performance in modern CPUs (with at least 256 KB in L2 cache) should be better too (for older CPUs the performance should stay roughly the same). * For small buffers that cannot be compressed (typically < 128 bytes), blosc_compress() returns now a 0 (cannot compress) instead of a negative number (internal error). See #294. * blosclz codec updated to 2.1.0. Expect better compression ratios and performance in a wider variety of scenarios. * blosc_decompress_unsafe(), blosc_decompress_ctx_unsafe() and blosc_getitem_unsafe() have been removed because they are dangerous and after latest improvements, they should not be used in production. Update to version 1.18.1: * Fixed the copy of the leftovers of a chunk when its size is not a multiple of the typesize. Update to version 1.17.1: * BloscLZ codec updated to 2.0.0. Update to version 1.16.3: * Fix for building for clang with -march=haswell. See PR #262. * Fix all the known warnings for GCC/Clang. Still some work to do for MSVC in this front. * Due to some problems with several CI systems, the check for library symbols are deactivated now by default. If you want to enforce this check, use: cmake .. -DDEACTIVATE_SYMBOLS_CHECK=ON to re-activate it. * Correct the check for the compressed size when the buffer is memcpyed. This was a regression introduced in 1.16.0. Fixes #261. * Fixed a regression in 1.16.0 that prevented to compress empty buffers (see #260). * Now the functions that execute Blosc decompressions are safe by default for untrusted/possibly corrupted inputs. * The previous functions (with less safety) checks are still available with a '_unsafe' suffix. The complete list is: * Also, a new API function named blosc_cbuffer_validate(), for validating Blosc compressed data, has been added. * For details, see PR #258. Thanks to Jeremy Maitin-Shepard. * Fixed a bug in blosc_compress() that could lead to thread deadlock under some situations. See #251. Thanks to @wenjuno for the report and the fix. * Fix data race in shuffle.c host_implementation initialization. Fixes #253. Thanks to Jeremy Maitin-Shepard. * Add workaround for Visual Studio 2008's lack of a stdint.h file to blosclz.c. * Replaced //-comments with /**/-comments and other improvements for compatibility with quite old gcc compilers. See PR #243. Thanks to Andreas Martin. * Empty buffers can be compressed again (this was unadvertedly prevented while fixing #234). See #247. Thanks to Valentin Haenel. Update to version 1.14.4: * Added a new DEACTIVATE_SSE2 option for cmake that is useful for disabling SSE2 when doing cross-compilation (see #236). * New check for detecting output buffers smaller than BLOSC_MAX_OVERHEAD. * The complib and version parameters for blosc_get_complib_info() can be safely set to NULL now. This allows to call this function even if the user is not interested in these parameters (so no need to reserve memory for them). * In some situations that a supposedly blosc chunk is passed to blosc_decompress(), one might end with an Arithmetic exception. This is probably due to the chunk not being an actual blosc chunk, and divisions by zero might occur. A protection has been added for this. Update to version 1.14.3: * Fixed a bug that caused C-Blosc to crash on platforms requiring strict alignment. * Fixed a piece of code that was not C89 compliant. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2337=1 Package List: - openSUSE Leap 15.2 (x86_64): blosc-debugsource-1.20.1-lp152.4.3.1 blosc-devel-1.20.1-lp152.4.3.1 libblosc1-1.20.1-lp152.4.3.1 libblosc1-debuginfo-1.20.1-lp152.4.3.1 - openSUSE Leap 15.1 (x86_64): blosc-debugsource-1.20.1-lp151.3.3.1 blosc-devel-1.20.1-lp151.3.3.1 libblosc1-1.20.1-lp151.3.3.1 libblosc1-debuginfo-1.20.1-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): blosc-debugsource-1.20.1-bp152.4.3.1 blosc-devel-1.20.1-bp152.4.3.1 libblosc1-1.20.1-bp152.4.3.1 libblosc1-debuginfo-1.20.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): blosc-devel-1.20.1-bp151.4.3.1 libblosc1-1.20.1-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-29367.html https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1179914 [View Less]

1 0

openSUSE-SU-2020:2343-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2343-1 Rating: important References: #1177672 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde … [View More]

1 0

openSUSE-SU-2020:2334-1: important: Security update for kdeconnect-kde
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for kdeconnect-kde ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2334-1 Rating: important References: #1177672 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for kdeconnect-kde … [View More]

1 0

openSUSE-SU-2020:2333-1: important: Security update for python3
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2333-1 Rating: important References: #1155094 #1174091 #1174571 #1174701 #1177211 #1178009 #1179193 #1179630 Cross-References: CVE-2019-16935 CVE-2019-18348 CVE-2019-20907 CVE-2019-5010 CVE-2020-14422 CVE-2020-26116 CVE-2020-27619 CVE-2020-8492 … [View More]Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for python3 fixes the following issues: - Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738) - add triplets for mips-r6 and riscv - RISC-V needs CTYPES_PASS_BY_REF_HACK Update to 3.6.12 (bsc#1179193) * Ensure python3.dll is loaded from correct locations when Python is embedded * The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address). * Prevent http header injection by rejecting control characters in http.client.putrequest(��). * Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing. * Avoid infinite loop when reading specially crafted TAR files using the tarfile module - This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091). Update to 3.6.11: - Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094) - CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2333=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython3_6m1_0-3.6.12-lp151.6.30.1 libpython3_6m1_0-debuginfo-3.6.12-lp151.6.30.1 python3-3.6.12-lp151.6.30.1 python3-base-3.6.12-lp151.6.30.1 python3-base-debuginfo-3.6.12-lp151.6.30.1 python3-core-debugsource-3.6.12-lp151.6.30.1 python3-curses-3.6.12-lp151.6.30.1 python3-curses-debuginfo-3.6.12-lp151.6.30.1 python3-dbm-3.6.12-lp151.6.30.1 python3-dbm-debuginfo-3.6.12-lp151.6.30.1 python3-debuginfo-3.6.12-lp151.6.30.1 python3-debugsource-3.6.12-lp151.6.30.1 python3-devel-3.6.12-lp151.6.30.1 python3-devel-debuginfo-3.6.12-lp151.6.30.1 python3-doc-3.6.12-lp151.6.30.1 python3-doc-devhelp-3.6.12-lp151.6.30.1 python3-idle-3.6.12-lp151.6.30.1 python3-testsuite-3.6.12-lp151.6.30.1 python3-testsuite-debuginfo-3.6.12-lp151.6.30.1 python3-tk-3.6.12-lp151.6.30.1 python3-tk-debuginfo-3.6.12-lp151.6.30.1 python3-tools-3.6.12-lp151.6.30.1 - openSUSE Leap 15.1 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp151.6.30.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp151.6.30.1 python3-32bit-3.6.12-lp151.6.30.1 python3-32bit-debuginfo-3.6.12-lp151.6.30.1 python3-base-32bit-3.6.12-lp151.6.30.1 python3-base-32bit-debuginfo-3.6.12-lp151.6.30.1 References: https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-20907.html https://www.suse.com/security/cve/CVE-2019-5010.html https://www.suse.com/security/cve/CVE-2020-14422.html https://www.suse.com/security/cve/CVE-2020-26116.html https://www.suse.com/security/cve/CVE-2020-27619.html https://www.suse.com/security/cve/CVE-2020-8492.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1174091 https://bugzilla.suse.com/1174571 https://bugzilla.suse.com/1174701 https://bugzilla.suse.com/1177211 https://bugzilla.suse.com/1178009 https://bugzilla.suse.com/1179193 https://bugzilla.suse.com/1179630 [View Less]

1 0

openSUSE-SU-2020:2332-1: important: Security update for python3
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2332-1 Rating: important References: #1155094 #1174091 #1174571 #1174701 #1177211 #1178009 #1179193 #1179630 Cross-References: CVE-2019-16935 CVE-2019-18348 CVE-2019-20907 CVE-2019-5010 CVE-2020-14422 CVE-2020-26116 CVE-2020-27619 CVE-2020-8492 … [View More]Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for python3 fixes the following issues: - Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738) - add triplets for mips-r6 and riscv - RISC-V needs CTYPES_PASS_BY_REF_HACK Update to 3.6.12 (bsc#1179193) * Ensure python3.dll is loaded from correct locations when Python is embedded * The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address). * Prevent http header injection by rejecting control characters in http.client.putrequest(��). * Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing. * Avoid infinite loop when reading specially crafted TAR files using the tarfile module - This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091). Update to 3.6.11: - Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094) - CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2332=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython3_6m1_0-3.6.12-lp152.4.12.2 libpython3_6m1_0-debuginfo-3.6.12-lp152.4.12.2 python3-3.6.12-lp152.4.12.2 python3-base-3.6.12-lp152.4.12.2 python3-base-debuginfo-3.6.12-lp152.4.12.2 python3-core-debugsource-3.6.12-lp152.4.12.2 python3-curses-3.6.12-lp152.4.12.2 python3-curses-debuginfo-3.6.12-lp152.4.12.2 python3-dbm-3.6.12-lp152.4.12.2 python3-dbm-debuginfo-3.6.12-lp152.4.12.2 python3-debuginfo-3.6.12-lp152.4.12.2 python3-debugsource-3.6.12-lp152.4.12.2 python3-devel-3.6.12-lp152.4.12.2 python3-devel-debuginfo-3.6.12-lp152.4.12.2 python3-doc-3.6.12-lp152.4.12.2 python3-doc-devhelp-3.6.12-lp152.4.12.2 python3-idle-3.6.12-lp152.4.12.2 python3-testsuite-3.6.12-lp152.4.12.2 python3-testsuite-debuginfo-3.6.12-lp152.4.12.2 python3-tk-3.6.12-lp152.4.12.2 python3-tk-debuginfo-3.6.12-lp152.4.12.2 python3-tools-3.6.12-lp152.4.12.2 - openSUSE Leap 15.2 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp152.4.12.2 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp152.4.12.2 python3-32bit-3.6.12-lp152.4.12.2 python3-32bit-debuginfo-3.6.12-lp152.4.12.2 python3-base-32bit-3.6.12-lp152.4.12.2 python3-base-32bit-debuginfo-3.6.12-lp152.4.12.2 References: https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-20907.html https://www.suse.com/security/cve/CVE-2019-5010.html https://www.suse.com/security/cve/CVE-2020-14422.html https://www.suse.com/security/cve/CVE-2020-26116.html https://www.suse.com/security/cve/CVE-2020-27619.html https://www.suse.com/security/cve/CVE-2020-8492.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1174091 https://bugzilla.suse.com/1174571 https://bugzilla.suse.com/1174701 https://bugzilla.suse.com/1177211 https://bugzilla.suse.com/1178009 https://bugzilla.suse.com/1179193 https://bugzilla.suse.com/1179630 [View Less]

1 0

openSUSE-SU-2020:2331-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2331-1 Rating: moderate References: #1027519 #1176782 #1179496 #1179498 #1179501 #1179502 #1179506 #1179514 #1179516 Cross-References: CVE-2020-29480 CVE-2020-29481 CVE-2020-29483 CVE-2020-29484 CVE-2020-29566 CVE-2020-29570 CVE-2020-29571 Affected … [View More]Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for xen fixes the following issues: - CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115). - CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322). - CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325). - CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324). - CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348). - CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358). - CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359). - Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782). - Multiple other bugs (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2331=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.2_06-lp152.2.21.1 xen-devel-4.13.2_06-lp152.2.21.1 xen-libs-4.13.2_06-lp152.2.21.1 xen-libs-debuginfo-4.13.2_06-lp152.2.21.1 xen-tools-domU-4.13.2_06-lp152.2.21.1 xen-tools-domU-debuginfo-4.13.2_06-lp152.2.21.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.2_06-lp152.2.21.1 xen-doc-html-4.13.2_06-lp152.2.21.1 xen-libs-32bit-4.13.2_06-lp152.2.21.1 xen-libs-32bit-debuginfo-4.13.2_06-lp152.2.21.1 xen-tools-4.13.2_06-lp152.2.21.1 xen-tools-debuginfo-4.13.2_06-lp152.2.21.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.2_06-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-29480.html https://www.suse.com/security/cve/CVE-2020-29481.html https://www.suse.com/security/cve/CVE-2020-29483.html https://www.suse.com/security/cve/CVE-2020-29484.html https://www.suse.com/security/cve/CVE-2020-29566.html https://www.suse.com/security/cve/CVE-2020-29570.html https://www.suse.com/security/cve/CVE-2020-29571.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176782 https://bugzilla.suse.com/1179496 https://bugzilla.suse.com/1179498 https://bugzilla.suse.com/1179501 https://bugzilla.suse.com/1179502 https://bugzilla.suse.com/1179506 https://bugzilla.suse.com/1179514 https://bugzilla.suse.com/1179516 [View Less]

1 0

openSUSE-SU-2020:2327-1: important: Security update for ceph
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2327-1 Rating: important References: #1178860 #1179016 #1179802 #1180107 #1180155 Cross-References: CVE-2020-27781 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one … [View More]vulnerability and has four fixes is now available. Description: This update for ceph fixes the following issues: Security issue fixed: - CVE-2020-27781: Fixed a privilege escalation via the ceph_volume_client Python interface (bsc#1180155, bsc#1179802). Non-security issues fixed: - Update to 15.2.8-80-g1f4b6229ca: + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55 * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/ - Update to 15.2.7-776-g343cd10fe5: + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05 * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1 + (bsc#1179016) rpm: require smartmontools on SUSE + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2327=1 Package List: - openSUSE Leap 15.2 (x86_64): ceph-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-base-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-base-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-common-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-common-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-debugsource-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-fuse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-fuse-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-immutable-object-cache-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-immutable-object-cache-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mds-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mds-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mon-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mon-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-osd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-osd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-radosgw-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-radosgw-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-test-debugsource-15.2.8.80+g1f4b6229ca-lp152.2.9.1 cephadm-15.2.8.80+g1f4b6229ca-lp152.2.9.1 cephfs-shell-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libcephfs2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados-devel-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librados2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 libradospp-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd1-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librbd1-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw2-15.2.8.80+g1f4b6229ca-lp152.2.9.1 librgw2-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-ceph-argparse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-ceph-common-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-cephfs-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-cephfs-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rados-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rados-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rbd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rbd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rgw-15.2.8.80+g1f4b6229ca-lp152.2.9.1 python3-rgw-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rados-objclass-devel-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-fuse-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-fuse-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-mirror-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-mirror-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-nbd-15.2.8.80+g1f4b6229ca-lp152.2.9.1 rbd-nbd-debuginfo-15.2.8.80+g1f4b6229ca-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-cephadm-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-dashboard-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-diskprediction-cloud-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-diskprediction-local-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-k8sevents-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-modules-core-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-mgr-rook-15.2.8.80+g1f4b6229ca-lp152.2.9.1 ceph-prometheus-alerts-15.2.8.80+g1f4b6229ca-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-27781.html https://bugzilla.suse.com/1178860 https://bugzilla.suse.com/1179016 https://bugzilla.suse.com/1179802 https://bugzilla.suse.com/1180107 https://bugzilla.suse.com/1180155 [View Less]

1 0

openSUSE-SU-2020:2325-1: critical: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Dec '20

25 Dec '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2325-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.1 … [View More]______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2325=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.6.0-lp151.2.82.1 MozillaFirefox-branding-upstream-78.6.0-lp151.2.82.1 MozillaFirefox-buildsymbols-78.6.0-lp151.2.82.1 MozillaFirefox-debuginfo-78.6.0-lp151.2.82.1 MozillaFirefox-debugsource-78.6.0-lp151.2.82.1 MozillaFirefox-devel-78.6.0-lp151.2.82.1 MozillaFirefox-translations-common-78.6.0-lp151.2.82.1 MozillaFirefox-translations-other-78.6.0-lp151.2.82.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 [View Less]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Security Announce