December 2020 - openSUSE Security Announce

openSUSE-SU-2020:2162-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Dec '20

05 Dec '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2162-1 Rating: important References: #1177409 #1177412 #1177413 #1177414 #1178591 #1178963 Cross-References: CVE-2020-27670 CVE-2020-27671 CVE-2020-27672 CVE-2020-27674 CVE-2020-28368 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: - bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2162=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.2_04-lp152.2.18.1 xen-devel-4.13.2_04-lp152.2.18.1 xen-libs-4.13.2_04-lp152.2.18.1 xen-libs-debuginfo-4.13.2_04-lp152.2.18.1 xen-tools-domU-4.13.2_04-lp152.2.18.1 xen-tools-domU-debuginfo-4.13.2_04-lp152.2.18.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.2_04-lp152.2.18.1 xen-doc-html-4.13.2_04-lp152.2.18.1 xen-libs-32bit-4.13.2_04-lp152.2.18.1 xen-libs-32bit-debuginfo-4.13.2_04-lp152.2.18.1 xen-tools-4.13.2_04-lp152.2.18.1 xen-tools-debuginfo-4.13.2_04-lp152.2.18.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.2_04-lp152.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-27670.html https://www.suse.com/security/cve/CVE-2020-27671.html https://www.suse.com/security/cve/CVE-2020-27672.html https://www.suse.com/security/cve/CVE-2020-27674.html https://www.suse.com/security/cve/CVE-2020-28368.html https://bugzilla.suse.com/1177409 https://bugzilla.suse.com/1177412 https://bugzilla.suse.com/1177413 https://bugzilla.suse.com/1177414 https://bugzilla.suse.com/1178591 https://bugzilla.suse.com/1178963

1 0

openSUSE-SU-2020:2160-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2160-1 Rating: moderate References: #1179447 Cross-References: CVE-2020-12695 CVE-2020-28926 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for minidlna fixes the following issues: minidlna was updated to version 1.3.0 (boo#1179447) - Fixed some build warnings when building with musl. - Use $USER instead of $LOGNAME for the default friendly name. - Fixed build with GCC 10 - Fixed some warnings from newer compilers - Disallow negative HTTP chunk lengths. [CVE-2020-28926] - Validate SUBSCRIBE callback URL. [CVE-2020-12695] - Fixed spurious warnings with ogg coverart - Fixed an issue with VLC where browse results would be truncated. - Fixed bookmarks on Samsung Q series - Added DSD file support. - Fixed potential stack smash vulnerability in getsyshwaddr on macOS. - Will now reload the log file on SIGHUP. - Worked around bad SearchCriteria from the Control4 Android app. - Increased max supported network addresses to 8. - Added forced alphasort capability. - Added episode season and number metadata support. - Enabled subtitles by default for unknown DLNA clients, and add enable_subtitles config option. - Fixed discovery when connected to certain WiFi routers. - Added FreeBSD kqueue support. - Added the ability to set the group to run as. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2160=1 Package List: - openSUSE Leap 15.2 (x86_64): minidlna-1.3.0-lp152.4.3.1 minidlna-debuginfo-1.3.0-lp152.4.3.1 minidlna-debugsource-1.3.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-12695.html https://www.suse.com/security/cve/CVE-2020-28926.html https://bugzilla.suse.com/1179447

1 0

openSUSE-SU-2020:2158-1: moderate: Security update for neomutt
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for neomutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2158-1 Rating: moderate References: #1172906 #1172935 #1173197 #1179035 #1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for neomutt fixes the following issues: Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896. * Security - imap: close connection on all failures * Features - alias: add function to Alias/Query dialogs - config: add validators for {imap,smtp,pop}_authenticators - config: warn when signature file is missing or not readable - smtp: support for native SMTP LOGIN auth mech - notmuch: show originating folder in index * Bug Fixes - sidebar: prevent the divider colour bleeding out - sidebar: fix <sidebar-{next,prev}-new> - notmuch: fix query for current email - restore shutdown-hook functionality - crash in reply-to - user-after-free in folder-hook - fix some leaks - fix application of limits to modified mailboxes - write Date header when postponing * Translations - 100% Lithuanian - 100% Czech - 70% Turkish * Docs - Document that $sort_alias affects the query menu * Build - improve ASAN flags - add SASL and S/MIME to --everything - fix contrib (un)install * Code - my_hdr compose screen notifications - add contracts to the MXAPI - maildir refactoring - further reduce the use of global variables * Upstream - Add $count_alternatives to count attachments inside alternatives - Changes from 20200925 * Features - Compose: display user-defined headers - Address Book / Query: live sorting - Address Book / Query: patterns for searching - Config: Add '+=' and '-=' operators for String Lists - Config: Add '+=' operator for Strings - Allow postfix query ':setenv NAME?' for env vars * Bug Fixes - Fix crash when searching with invalid regexes - Compose: Prevent infinite loop of send2-hooks - Fix sidebar on new/removed mailboxes - Restore indentation for named mailboxes - Prevent half-parsing an alias - Remove folder creation prompt for POP path - Show error if $message_cachedir doesn't point to a valid directory - Fix tracking LastDir in case of IMAP paths with Unicode characters - Make sure all mail gets applied the index limit - Add warnings to -Q query CLI option - Fix index tracking functionality * Changed Config - Add $compose_show_user_headers (yes) * Translations - 100% Czech - 100% Lithuanian - Split up usage strings * Build - Run shellcheck on hcachever.sh - Add the Address Sanitizer - Move compose files to lib under compose/ - Move address config into libaddress - Update to latest acutest - fixes a memory leak in the unit tests * Code - Implement ARRAY API - Deglobalised the Config Sort functions - Refactor the Sidebar to be Event-Driven - Refactor the Color Event - Refactor the Commands list - Make ctx_update_tables private - Reduce the scope/deps of some Validator functions - Use the Email's IMAP UID instead of an increasing number as index - debug: log window focus - Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed. - Update to 20200821: * Bug Fixes - fix maildir flag generation - fix query notmuch if file is missing - notmuch: don't abort sync on error - fix type checking for send config variables * Changed Config - $sidebar_format - Use %D rather than %B for named mailboxes * Translations - 96% Lithuanian - 90% Polish - fix(sidebar): abbreviate/shorten what user sees - Fix sidebar mailbox name display problem. - Update to 20200814: * Notes - Add one-liner docs to config items See: neomutt -O -Q smart_wrap - Remove the built-in editor A large unused and unusable feature * Security - Add mitigation against DoS from thousands of parts boo#1179113 * Features - Allow index-style searching in postpone menu - Open NeoMutt using a mailbox name - Add cd command to change the current working directory - Add tab-completion menu for patterns - Allow renaming existing mailboxes - Check for missing attachments in alternative parts - Add one-liner docs to config items * Bug Fixes - Fix logic in checking an empty From address - Fix Imap crash in cmd_parse_expunge() - Fix setting attributes with S-Lang - Fix: redrawing of $pager_index_lines - Fix progress percentage for syncing large mboxes - Fix sidebar drawing in presence of indentation + named mailboxes - Fix retrieval of drafts when "postponed" is not in the mailboxes list - Do not add comments to address group terminators - Fix alias sorting for degenerate addresses - Fix attaching emails - Create directories for nonexistent file hcache case - Avoid creating mailboxes for failed subscribes - Fix crash if rejecting cert * Changed Config - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed - Change default of $crypt_protected_headers_subject to "..." - Add default keybindings to history-up/down * Translations - 100% Czech - 100% Spanish * Build - Allow building against Lua 5.4 - Fix when sqlite3.h is missing * Docs - Add a brief section on stty to the manual - Update section "Terminal Keybindings" in the manual - Clarify PGP Pseudo-header S<id> duration * Code - Clean up String API - Make the Sidebar more independent - De-centralise the Config Variables - Refactor dialogs - Refactor: Help Bar generation - Make more APIs Context-free - Adjust the edata use in Maildir and Notmuch - Window refactoring - Convert libsend to use Config functions - Refactor notifications to reduce noise - Convert Keymaps to use STAILQ - Track currently selected email by msgid - Config: no backing global variable - Add events for key binding * Upstream - Fix imap postponed mailbox use-after-free error - Speed up thread sort when many long threads exist - Fix ~v tagging when switching to non-threaded sorting - Add message/global to the list of known "message" types - Print progress meter when copying/saving tagged messages - Remove ansi formatting from autoview generated quoted replies - Change postpone mode to write Date header too - Unstuff format=flowed - Update to 20200626: * Bug Fixes - Avoid opening the same hcache file twice - Re-open Mailbox after folder-hook - Fix the matching of the spoolfile Mailbox - Fix link-thread to link all tagged emails * Changed Config - Add $tunnel_is_secure config, defaulting to true * Upstream - Don't check IMAP PREAUTH encryption if $tunnel is in use - Add recommendation to use $ssl_force_tls - Changes from 20200501: * Security - Abort GnuTLS certificate check if a cert in the chain is rejected CVE-2020-14154 boo#1172906 - TLS: clear data after a starttls acknowledgement CVE-2020-14954 boo#1173197 - Prevent possible IMAP MITM via PREAUTH response CVE-2020-14093 boo#1172935 * Features - add config operations +=/-= for number,long - Address book has a comment field - Query menu has a comment field * Contrib sample.neomuttrc-starter: Do not echo prompted password * Bug Fixes - make "news://" and "nntp://" schemes interchangeable - Fix CRLF to LF conversion in base64 decoding - Double comma in query - compose: fix redraw after history - Crash inside empty query menu - mmdf: fix creating new mailbox - mh: fix creating new mailbox - mbox: error out when an mbox/mmdf is a pipe - Fix list-reply by correct parsing of List-Post headers - Decode references according to RFC2047 - fix tagged message count - hcache: fix keylen not being considered when building the full key - sidebar: fix path comparison - Don't mess with the original pattern when running IMAP searches - Handle IMAP "NO" resps by issuing a msg instead of failing badly - imap: use the connection delimiter if provided - Memory leaks * Changed Config - $alias_format default changed to include %c comment - $query_format default changed to include %e extra info * Translations - 100% Lithuanian - 84% French - Log the translation in use * Docs - Add missing commands unbind, unmacro to man pages * Build - Check size of long using LONG_MAX instead of __WORDSIZE - Allow ./configure to not record cflags - fix out-of-tree build - Avoid locating gdbm symbols in qdbm library * Code - Refactor unsafe TAILQ returns - add window notifications - flip negative ifs - Update to latest acutest.h - test: add store tests - test: add compression tests - graphviz: email - make more opcode info available - refactor: main_change_folder() - refactor: mutt_mailbox_next() - refactor: generate_body() - compress: add {min,max}_level to ComprOps - emphasise empty loops: "// do nothing" - prex: convert is_from() to use regex - Refactor IMAP's search routines - Update to 20200501: * Bug Fixes - Make sure buffers are initialized on error - fix(sidebar): use abbreviated path if possible * Translations - 100% Lithuanian * Docs - make header cache config more explicit - Changes from 20200424: * Bug Fixes - Fix history corruption - Handle pretty much anything in a URL query part - Correctly parse escaped characters in header phrases - Fix crash reading received header - Fix sidebar indentation - Avoid crashing on failure to parse an IMAP mailbox - Maildir: handle deleted emails correctly - Ensure OP_NULL is always first * Translations - 100% Czech * Build - cirrus: enable pcre2, make pkgconf a special case - Fix finding pcre2 w/o pkgconf - build: tdb.h needs size_t, bring it in with stddef.h - Changes from 20200417: * Features - Fluid layout for Compose Screen, see: vimeo.com/407231157 - Trivial Database (TDB) header cache backend - RocksDB header cache backend - Add <sidebar-first> and <sidebar-last> functions * Bug Fixes - add error for CLI empty emails - Allow spaces and square brackets in paths - browser: fix hidden mailboxes - fix initial email display - notmuch: fix time window search. - fix resize bugs - notmuch: fix entire-thread: update current email pointer - sidebar: support indenting and shortening of names - Handle variables inside backticks in sidebar_whitelist - browser: fix mask regex error reporting * Translations - 100% Lithuanian - 99% Chinese (simplified) * Build - Use regexes for common parsing tasks: urls, dates - Add configure option --pcre2 -- Enable PCRE2 regular expressions - Add configure option --tdb -- Use TDB for the header cache - Add configure option --rocksdb -- Use RocksDB for the header cache - Create libstore (key/value backends) - Update to latest autosetup - Update to latest acutest.h - Rename doc/ directory to docs/ - make: fix location of .Po dependency files - Change libcompress to be more universal - Fix test fails on ��32 - fix uidvalidity to unsigned 32-bit int * Code - Increase test coverage - Fix memory leaks - Fix null checks * Upstream - Buffer refactoring - Fix use-after-free in mutt_str_replace() - Clarify PGP Pseudo-header S<id> duration - Try to respect MUTT_QUIET for IMAP contexts too - Limit recurse depth when parsing mime messages - Update to 20200320: * Bug Fixes - Fix COLUMNS env var - Fix sync after delete - Fix crash in notmuch - Fix sidebar indent - Fix emptying trash - Fix command line sending - Fix reading large address lists - Resolve symlinks only when necessary * Translations - lithuania 100% Lithuanian - es 96% Spanish * Docs - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output - Fix case of GPGME and SQLite * Build - Create libcompress (lz4, zlib, zstd) - Create libhistory - Create libbcache - Move zstrm to libconn * Code - Add more test coverage - Rename magic to type - Use mutt_file_fopen() on config variables - Change commands to use intptr_t for data - Update to 20200313: * Window layout - Sidebar is only visible when it's usable. * Features - UI: add number of old messages to sidebar_format - UI: support ISO 8601 calendar date - UI: fix commands that don��t need to have a non-empty mailbox to be valid - PGP: inform about successful decryption of inline PGP messages - PGP: try to infer the signing key from the From address - PGP: enable GPGMe by default - Notmuch: use query as name for vfolder-from-query - IMAP: add network traffic compression (COMPRESS=DEFLATE, RFC4978) - Header cache: add support for generic header cache compression * Bug Fixes - Fix uncollapse_jump - Only try to perform entire-thread on maildir/mh mailboxes - Fix crash in pager - Avoid logging single new lines at the end of header fields - Fix listing mailboxes - Do not recurse a non-threaded message - Fix initial window order - Fix leaks on IMAP error paths - Notmuch: compose(attach-message): support notmuch backend - Fix IMAP flag comparison code - Fix $move for IMAP mailboxes - Maildir: maildir_mbox_check_stats should only update mailbox stats if requested - Fix unmailboxes for virtual mailboxes - Maildir: sanitize filename before hashing - OAuth: if 'login' name isn't available use 'user' - Add error message on failed encryption - Fix a bunch of crashes - Force C locale for email date - Abort if run without a terminal * Changed Config - $crypt_use_gpgme - Now defaults to 'yes' (enabled) - $abort_backspace - Hitting backspace against an empty prompt aborts the prompt - $abort_key - String representation of key to abort prompts - $arrow_string - Use an custom string for arrow_cursor - $crypt_opportunistic_encrypt_strong_keys - Enable encryption only when strong a key is available - $header_cache_compress_dictionary - Filepath to dictionary for zstd compression - $header_cache_compress_level - Level of compression for method - $header_cache_compress_method - Enable generic hcache database compression - $imap_deflate - Compress network traffic - $smtp_user - Username for the SMTP server * Translations - 100% Lithuanian - 81% Spanish - 78% Russian * Build - Add libdebug - Rename public headers to lib.h - Create libcompress for compressed folders code * Code - Refactor Windows and Dialogs - Lots of code tidying - Refactor: mutt_addrlist_{search,write} - Lots of improvements to the Config code - Use Buffers more pervasively - Unify API function naming - Rename library shared headers - Refactor libconn gui dependencies - Refactor: init.[ch] - Refactor config to use subsets - Config: add path type - Remove backend deps from the connection code * Upstream - Allow ~b ~B ~h patterns in send2-hook - Rename smime oppenc mode parameter to get_keys_by_addr() - Add $crypt_opportunistic_encrypt_strong_keys config var - Fix crash when polling a closed ssl connection - Turn off auto-clear outside of autocrypt initialization - Add protected-headers="v1" to Content-Type when protecting headers - Fix segv in IMAP postponed menu caused by reopen_allow - Adding ISO 8601 calendar date - Fix $fcc_attach to not prompt in batch mode - Convert remaining mutt_encode_path() call to use struct Buffer - Fix rendering of replacement_char when Charset_is_utf8 - Update to latest acutest.h - Update to 20191207: * Features: - compose: draw status bar with highlights * Bug Fixes: - crash opening notmuch mailbox - crash in mutt_autocrypt_ui_recommendation - Avoid negative allocation - Mbox new mail - Setting of DT_MAILBOX type variables from Lua - imap: empty cmdbuf before connecting - imap: select the mailbox on reconnect - compose: fix attach message * Build: - make files conditional * Code: - enum-ify log levels - fix function prototypes - refactor virtual email lookups - factor out global Context - Changes from 20191129: * Features: - Add raw mailsize expando (%cr) * Bug Fixes: - Avoid double question marks in bounce confirmation msg - Fix bounce confirmation - fix new-mail flags and behaviour - fix: browser <descend-directory> - fix ssl crash - fix move to trash - fix flickering - Do not check hidden mailboxes for new mail - Fix new_mail_command notifications - fix crash in examine_mailboxes() - fix crash in mutt_sort_threads() - fix: crash after sending - Fix crash in tunnel's conn_close - fix fcc for deep dirs - imap: fix crash when new mail arrives - fix colour 'quoted9' - quieten messages on exit - fix: crash after failed mbox_check - browser: default to a file/dir view when attaching a file * Changed Config: - Change $write_bcc to default off * Docs: - Add a bit more documentation about sending - Clarify $write_bcc documentation. - Update documentation for raw size expando - docbook: set generate.consistent.ids to make generated html reproducible * Build: - fix build/tests for 32-bit arches - tests: fix test that would fail soon - tests: fix context for failing idna tests - Update to 20191111: Bug fixes: * browser: fix directory view * fix crash in mutt_extract_token() * force a screen refresh * fix crash sending message from command line * notmuch: use nm_default_uri if no mailbox data * fix forward attachments * fix: vfprintf undefined behaviour in body_handler * Fix relative symlink resolution * fix: trash to non-existent file/dir * fix re-opening of mbox Mailboxes * close logging as late as possible * log unknown mailboxes * fix crash in command line postpone * fix memory leaks * fix icommand parsing * fix new mail interaction with mail_check_recent This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2158=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): neomutt-20201120-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): neomutt-doc-20201120-bp152.2.3.1 neomutt-lang-20201120-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14093.html https://www.suse.com/security/cve/CVE-2020-14154.html https://www.suse.com/security/cve/CVE-2020-14954.html https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1172906 https://bugzilla.suse.com/1172935 https://bugzilla.suse.com/1173197 https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113

1 0

openSUSE-SU-2020:2157-1: moderate: Security update for neomutt
by opensuse-security＠opensuse.org 04 Dec '20

04 Dec '20

openSUSE Security Update: Security update for neomutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2157-1 Rating: moderate References: #1172906 #1172935 #1173197 #1179035 #1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for neomutt fixes the following issues: Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896. * Security - imap: close connection on all failures * Features - alias: add function to Alias/Query dialogs - config: add validators for {imap,smtp,pop}_authenticators - config: warn when signature file is missing or not readable - smtp: support for native SMTP LOGIN auth mech - notmuch: show originating folder in index * Bug Fixes - sidebar: prevent the divider colour bleeding out - sidebar: fix <sidebar-{next,prev}-new> - notmuch: fix query for current email - restore shutdown-hook functionality - crash in reply-to - user-after-free in folder-hook - fix some leaks - fix application of limits to modified mailboxes - write Date header when postponing * Translations - 100% Lithuanian - 100% Czech - 70% Turkish * Docs - Document that $sort_alias affects the query menu * Build - improve ASAN flags - add SASL and S/MIME to --everything - fix contrib (un)install * Code - my_hdr compose screen notifications - add contracts to the MXAPI - maildir refactoring - further reduce the use of global variables * Upstream - Add $count_alternatives to count attachments inside alternatives - Changes from 20200925 * Features - Compose: display user-defined headers - Address Book / Query: live sorting - Address Book / Query: patterns for searching - Config: Add '+=' and '-=' operators for String Lists - Config: Add '+=' operator for Strings - Allow postfix query ':setenv NAME?' for env vars * Bug Fixes - Fix crash when searching with invalid regexes - Compose: Prevent infinite loop of send2-hooks - Fix sidebar on new/removed mailboxes - Restore indentation for named mailboxes - Prevent half-parsing an alias - Remove folder creation prompt for POP path - Show error if $message_cachedir doesn't point to a valid directory - Fix tracking LastDir in case of IMAP paths with Unicode characters - Make sure all mail gets applied the index limit - Add warnings to -Q query CLI option - Fix index tracking functionality * Changed Config - Add $compose_show_user_headers (yes) * Translations - 100% Czech - 100% Lithuanian - Split up usage strings * Build - Run shellcheck on hcachever.sh - Add the Address Sanitizer - Move compose files to lib under compose/ - Move address config into libaddress - Update to latest acutest - fixes a memory leak in the unit tests * Code - Implement ARRAY API - Deglobalised the Config Sort functions - Refactor the Sidebar to be Event-Driven - Refactor the Color Event - Refactor the Commands list - Make ctx_update_tables private - Reduce the scope/deps of some Validator functions - Use the Email's IMAP UID instead of an increasing number as index - debug: log window focus - Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed. - Update to 20200821: * Bug Fixes - fix maildir flag generation - fix query notmuch if file is missing - notmuch: don't abort sync on error - fix type checking for send config variables * Changed Config - $sidebar_format - Use %D rather than %B for named mailboxes * Translations - 96% Lithuanian - 90% Polish - fix(sidebar): abbreviate/shorten what user sees - Fix sidebar mailbox name display problem. - Update to 20200814: * Notes - Add one-liner docs to config items See: neomutt -O -Q smart_wrap - Remove the built-in editor A large unused and unusable feature * Security - Add mitigation against DoS from thousands of parts boo#1179113 * Features - Allow index-style searching in postpone menu - Open NeoMutt using a mailbox name - Add cd command to change the current working directory - Add tab-completion menu for patterns - Allow renaming existing mailboxes - Check for missing attachments in alternative parts - Add one-liner docs to config items * Bug Fixes - Fix logic in checking an empty From address - Fix Imap crash in cmd_parse_expunge() - Fix setting attributes with S-Lang - Fix: redrawing of $pager_index_lines - Fix progress percentage for syncing large mboxes - Fix sidebar drawing in presence of indentation + named mailboxes - Fix retrieval of drafts when "postponed" is not in the mailboxes list - Do not add comments to address group terminators - Fix alias sorting for degenerate addresses - Fix attaching emails - Create directories for nonexistent file hcache case - Avoid creating mailboxes for failed subscribes - Fix crash if rejecting cert * Changed Config - Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed - Change default of $crypt_protected_headers_subject to "..." - Add default keybindings to history-up/down * Translations - 100% Czech - 100% Spanish * Build - Allow building against Lua 5.4 - Fix when sqlite3.h is missing * Docs - Add a brief section on stty to the manual - Update section "Terminal Keybindings" in the manual - Clarify PGP Pseudo-header S<id> duration * Code - Clean up String API - Make the Sidebar more independent - De-centralise the Config Variables - Refactor dialogs - Refactor: Help Bar generation - Make more APIs Context-free - Adjust the edata use in Maildir and Notmuch - Window refactoring - Convert libsend to use Config functions - Refactor notifications to reduce noise - Convert Keymaps to use STAILQ - Track currently selected email by msgid - Config: no backing global variable - Add events for key binding * Upstream - Fix imap postponed mailbox use-after-free error - Speed up thread sort when many long threads exist - Fix ~v tagging when switching to non-threaded sorting - Add message/global to the list of known "message" types - Print progress meter when copying/saving tagged messages - Remove ansi formatting from autoview generated quoted replies - Change postpone mode to write Date header too - Unstuff format=flowed - Update to 20200626: * Bug Fixes - Avoid opening the same hcache file twice - Re-open Mailbox after folder-hook - Fix the matching of the spoolfile Mailbox - Fix link-thread to link all tagged emails * Changed Config - Add $tunnel_is_secure config, defaulting to true * Upstream - Don't check IMAP PREAUTH encryption if $tunnel is in use - Add recommendation to use $ssl_force_tls - Changes from 20200501: * Security - Abort GnuTLS certificate check if a cert in the chain is rejected CVE-2020-14154 boo#1172906 - TLS: clear data after a starttls acknowledgement CVE-2020-14954 boo#1173197 - Prevent possible IMAP MITM via PREAUTH response CVE-2020-14093 boo#1172935 * Features - add config operations +=/-= for number,long - Address book has a comment field - Query menu has a comment field * Contrib sample.neomuttrc-starter: Do not echo prompted password * Bug Fixes - make "news://" and "nntp://" schemes interchangeable - Fix CRLF to LF conversion in base64 decoding - Double comma in query - compose: fix redraw after history - Crash inside empty query menu - mmdf: fix creating new mailbox - mh: fix creating new mailbox - mbox: error out when an mbox/mmdf is a pipe - Fix list-reply by correct parsing of List-Post headers - Decode references according to RFC2047 - fix tagged message count - hcache: fix keylen not being considered when building the full key - sidebar: fix path comparison - Don't mess with the original pattern when running IMAP searches - Handle IMAP "NO" resps by issuing a msg instead of failing badly - imap: use the connection delimiter if provided - Memory leaks * Changed Config - $alias_format default changed to include %c comment - $query_format default changed to include %e extra info * Translations - 100% Lithuanian - 84% French - Log the translation in use * Docs - Add missing commands unbind, unmacro to man pages * Build - Check size of long using LONG_MAX instead of __WORDSIZE - Allow ./configure to not record cflags - fix out-of-tree build - Avoid locating gdbm symbols in qdbm library * Code - Refactor unsafe TAILQ returns - add window notifications - flip negative ifs - Update to latest acutest.h - test: add store tests - test: add compression tests - graphviz: email - make more opcode info available - refactor: main_change_folder() - refactor: mutt_mailbox_next() - refactor: generate_body() - compress: add {min,max}_level to ComprOps - emphasise empty loops: "// do nothing" - prex: convert is_from() to use regex - Refactor IMAP's search routines - Update to 20200501: * Bug Fixes - Make sure buffers are initialized on error - fix(sidebar): use abbreviated path if possible * Translations - 100% Lithuanian * Docs - make header cache config more explicit - Changes from 20200424: * Bug Fixes - Fix history corruption - Handle pretty much anything in a URL query part - Correctly parse escaped characters in header phrases - Fix crash reading received header - Fix sidebar indentation - Avoid crashing on failure to parse an IMAP mailbox - Maildir: handle deleted emails correctly - Ensure OP_NULL is always first * Translations - 100% Czech * Build - cirrus: enable pcre2, make pkgconf a special case - Fix finding pcre2 w/o pkgconf - build: tdb.h needs size_t, bring it in with stddef.h - Changes from 20200417: * Features - Fluid layout for Compose Screen, see: vimeo.com/407231157 - Trivial Database (TDB) header cache backend - RocksDB header cache backend - Add <sidebar-first> and <sidebar-last> functions * Bug Fixes - add error for CLI empty emails - Allow spaces and square brackets in paths - browser: fix hidden mailboxes - fix initial email display - notmuch: fix time window search. - fix resize bugs - notmuch: fix entire-thread: update current email pointer - sidebar: support indenting and shortening of names - Handle variables inside backticks in sidebar_whitelist - browser: fix mask regex error reporting * Translations - 100% Lithuanian - 99% Chinese (simplified) * Build - Use regexes for common parsing tasks: urls, dates - Add configure option --pcre2 -- Enable PCRE2 regular expressions - Add configure option --tdb -- Use TDB for the header cache - Add configure option --rocksdb -- Use RocksDB for the header cache - Create libstore (key/value backends) - Update to latest autosetup - Update to latest acutest.h - Rename doc/ directory to docs/ - make: fix location of .Po dependency files - Change libcompress to be more universal - Fix test fails on ��32 - fix uidvalidity to unsigned 32-bit int * Code - Increase test coverage - Fix memory leaks - Fix null checks * Upstream - Buffer refactoring - Fix use-after-free in mutt_str_replace() - Clarify PGP Pseudo-header S<id> duration - Try to respect MUTT_QUIET for IMAP contexts too - Limit recurse depth when parsing mime messages - Update to 20200320: * Bug Fixes - Fix COLUMNS env var - Fix sync after delete - Fix crash in notmuch - Fix sidebar indent - Fix emptying trash - Fix command line sending - Fix reading large address lists - Resolve symlinks only when necessary * Translations - lithuania 100% Lithuanian - es 96% Spanish * Docs - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v output - Fix case of GPGME and SQLite * Build - Create libcompress (lz4, zlib, zstd) - Create libhistory - Create libbcache - Move zstrm to libconn * Code - Add more test coverage - Rename magic to type - Use mutt_file_fopen() on config variables - Change commands to use intptr_t for data - Update to 20200313: * Window layout - Sidebar is only visible when it's usable. * Features - UI: add number of old messages to sidebar_format - UI: support ISO 8601 calendar date - UI: fix commands that don��t need to have a non-empty mailbox to be valid - PGP: inform about successful decryption of inline PGP messages - PGP: try to infer the signing key from the From address - PGP: enable GPGMe by default - Notmuch: use query as name for vfolder-from-query - IMAP: add network traffic compression (COMPRESS=DEFLATE, RFC4978) - Header cache: add support for generic header cache compression * Bug Fixes - Fix uncollapse_jump - Only try to perform entire-thread on maildir/mh mailboxes - Fix crash in pager - Avoid logging single new lines at the end of header fields - Fix listing mailboxes - Do not recurse a non-threaded message - Fix initial window order - Fix leaks on IMAP error paths - Notmuch: compose(attach-message): support notmuch backend - Fix IMAP flag comparison code - Fix $move for IMAP mailboxes - Maildir: maildir_mbox_check_stats should only update mailbox stats if requested - Fix unmailboxes for virtual mailboxes - Maildir: sanitize filename before hashing - OAuth: if 'login' name isn't available use 'user' - Add error message on failed encryption - Fix a bunch of crashes - Force C locale for email date - Abort if run without a terminal * Changed Config - $crypt_use_gpgme - Now defaults to 'yes' (enabled) - $abort_backspace - Hitting backspace against an empty prompt aborts the prompt - $abort_key - String representation of key to abort prompts - $arrow_string - Use an custom string for arrow_cursor - $crypt_opportunistic_encrypt_strong_keys - Enable encryption only when strong a key is available - $header_cache_compress_dictionary - Filepath to dictionary for zstd compression - $header_cache_compress_level - Level of compression for method - $header_cache_compress_method - Enable generic hcache database compression - $imap_deflate - Compress network traffic - $smtp_user - Username for the SMTP server * Translations - 100% Lithuanian - 81% Spanish - 78% Russian * Build - Add libdebug - Rename public headers to lib.h - Create libcompress for compressed folders code * Code - Refactor Windows and Dialogs - Lots of code tidying - Refactor: mutt_addrlist_{search,write} - Lots of improvements to the Config code - Use Buffers more pervasively - Unify API function naming - Rename library shared headers - Refactor libconn gui dependencies - Refactor: init.[ch] - Refactor config to use subsets - Config: add path type - Remove backend deps from the connection code * Upstream - Allow ~b ~B ~h patterns in send2-hook - Rename smime oppenc mode parameter to get_keys_by_addr() - Add $crypt_opportunistic_encrypt_strong_keys config var - Fix crash when polling a closed ssl connection - Turn off auto-clear outside of autocrypt initialization - Add protected-headers="v1" to Content-Type when protecting headers - Fix segv in IMAP postponed menu caused by reopen_allow - Adding ISO 8601 calendar date - Fix $fcc_attach to not prompt in batch mode - Convert remaining mutt_encode_path() call to use struct Buffer - Fix rendering of replacement_char when Charset_is_utf8 - Update to latest acutest.h - Update to 20191207: * Features: - compose: draw status bar with highlights * Bug Fixes: - crash opening notmuch mailbox - crash in mutt_autocrypt_ui_recommendation - Avoid negative allocation - Mbox new mail - Setting of DT_MAILBOX type variables from Lua - imap: empty cmdbuf before connecting - imap: select the mailbox on reconnect - compose: fix attach message * Build: - make files conditional * Code: - enum-ify log levels - fix function prototypes - refactor virtual email lookups - factor out global Context - Changes from 20191129: * Features: - Add raw mailsize expando (%cr) * Bug Fixes: - Avoid double question marks in bounce confirmation msg - Fix bounce confirmation - fix new-mail flags and behaviour - fix: browser <descend-directory> - fix ssl crash - fix move to trash - fix flickering - Do not check hidden mailboxes for new mail - Fix new_mail_command notifications - fix crash in examine_mailboxes() - fix crash in mutt_sort_threads() - fix: crash after sending - Fix crash in tunnel's conn_close - fix fcc for deep dirs - imap: fix crash when new mail arrives - fix colour 'quoted9' - quieten messages on exit - fix: crash after failed mbox_check - browser: default to a file/dir view when attaching a file * Changed Config: - Change $write_bcc to default off * Docs: - Add a bit more documentation about sending - Clarify $write_bcc documentation. - Update documentation for raw size expando - docbook: set generate.consistent.ids to make generated html reproducible * Build: - fix build/tests for 32-bit arches - tests: fix test that would fail soon - tests: fix context for failing idna tests - Update to 20191111: Bug fixes: * browser: fix directory view * fix crash in mutt_extract_token() * force a screen refresh * fix crash sending message from command line * notmuch: use nm_default_uri if no mailbox data * fix forward attachments * fix: vfprintf undefined behaviour in body_handler * Fix relative symlink resolution * fix: trash to non-existent file/dir * fix re-opening of mbox Mailboxes * close logging as late as possible * log unknown mailboxes * fix crash in command line postpone * fix memory leaks * fix icommand parsing * fix new mail interaction with mail_check_recent This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2157=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): neomutt-20201120-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): neomutt-doc-20201120-bp151.3.3.1 neomutt-lang-20201120-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-14093.html https://www.suse.com/security/cve/CVE-2020-14154.html https://www.suse.com/security/cve/CVE-2020-14954.html https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1172906 https://bugzilla.suse.com/1172935 https://bugzilla.suse.com/1173197 https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113

1 0

openSUSE-SU-2020:2152-1: important: Security update for python3
by opensuse-security＠opensuse.org 03 Dec '20

03 Dec '20

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2152-1 Rating: important References: #1176262 #1179193 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for python3 fixes the following issues: Update to 3.6.12 (bsc#1179193), including: - Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2152=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython3_6m1_0-3.6.12-lp152.4.9.1 libpython3_6m1_0-debuginfo-3.6.12-lp152.4.9.1 python3-3.6.12-lp152.4.9.1 python3-base-3.6.12-lp152.4.9.1 python3-base-debuginfo-3.6.12-lp152.4.9.1 python3-base-debugsource-3.6.12-lp152.4.9.1 python3-curses-3.6.12-lp152.4.9.1 python3-curses-debuginfo-3.6.12-lp152.4.9.1 python3-dbm-3.6.12-lp152.4.9.1 python3-dbm-debuginfo-3.6.12-lp152.4.9.1 python3-debuginfo-3.6.12-lp152.4.9.1 python3-debugsource-3.6.12-lp152.4.9.1 python3-devel-3.6.12-lp152.4.9.1 python3-devel-debuginfo-3.6.12-lp152.4.9.1 python3-idle-3.6.12-lp152.4.9.1 python3-testsuite-3.6.12-lp152.4.9.1 python3-testsuite-debuginfo-3.6.12-lp152.4.9.1 python3-tk-3.6.12-lp152.4.9.1 python3-tk-debuginfo-3.6.12-lp152.4.9.1 python3-tools-3.6.12-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): libpython3_6m1_0-32bit-3.6.12-lp152.4.9.1 libpython3_6m1_0-32bit-debuginfo-3.6.12-lp152.4.9.1 python3-32bit-3.6.12-lp152.4.9.1 python3-32bit-debuginfo-3.6.12-lp152.4.9.1 python3-base-32bit-3.6.12-lp152.4.9.1 python3-base-32bit-debuginfo-3.6.12-lp152.4.9.1 - openSUSE Leap 15.2 (noarch): python3-doc-3.6.12-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262 https://bugzilla.suse.com/1179193

1 0

openSUSE-SU-2020:2149-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 02 Dec '20

02 Dec '20

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2149-1 Rating: moderate References: #1175596 #1177472 #1178428 Cross-References: CVE-2020-14765 CVE-2020-14776 CVE-2020-14789 CVE-2020-14812 CVE-2020-15180 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: - Update mariadb to 10.2.36 GA [bsc#1177472, bsc#1178428] fixing for the following security vulnerabilities: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 CVE-2020-15180 - Update mariadb-connector-c to 3.1.11 [bsc#1177472 and bsc#1178428] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2149=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.11-lp151.3.15.1 libmariadb-devel-debuginfo-3.1.11-lp151.3.15.1 libmariadb3-3.1.11-lp151.3.15.1 libmariadb3-debuginfo-3.1.11-lp151.3.15.1 libmariadb_plugins-3.1.11-lp151.3.15.1 libmariadb_plugins-debuginfo-3.1.11-lp151.3.15.1 libmariadbprivate-3.1.11-lp151.3.15.1 libmariadbprivate-debuginfo-3.1.11-lp151.3.15.1 libmysqld-devel-10.2.36-lp151.2.18.1 libmysqld19-10.2.36-lp151.2.18.1 libmysqld19-debuginfo-10.2.36-lp151.2.18.1 mariadb-10.2.36-lp151.2.18.1 mariadb-bench-10.2.36-lp151.2.18.1 mariadb-bench-debuginfo-10.2.36-lp151.2.18.1 mariadb-client-10.2.36-lp151.2.18.1 mariadb-client-debuginfo-10.2.36-lp151.2.18.1 mariadb-connector-c-debugsource-3.1.11-lp151.3.15.1 mariadb-debuginfo-10.2.36-lp151.2.18.1 mariadb-debugsource-10.2.36-lp151.2.18.1 mariadb-galera-10.2.36-lp151.2.18.1 mariadb-test-10.2.36-lp151.2.18.1 mariadb-test-debuginfo-10.2.36-lp151.2.18.1 mariadb-tools-10.2.36-lp151.2.18.1 mariadb-tools-debuginfo-10.2.36-lp151.2.18.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.36-lp151.2.18.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.11-lp151.3.15.1 libmariadb3-32bit-debuginfo-3.1.11-lp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-14765.html https://www.suse.com/security/cve/CVE-2020-14776.html https://www.suse.com/security/cve/CVE-2020-14789.html https://www.suse.com/security/cve/CVE-2020-14812.html https://www.suse.com/security/cve/CVE-2020-15180.html https://bugzilla.suse.com/1175596 https://bugzilla.suse.com/1177472 https://bugzilla.suse.com/1178428

1 0

openSUSE-SU-2020:2147-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 02 Dec '20

02 Dec '20

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2147-1 Rating: important References: #1174908 #1177596 Cross-References: CVE-2020-14360 CVE-2020-25712 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2020-25712: Fixed a heap-based buffer overflow which could have led to privilege escalation (bsc#1177596). - CVE-2020-14360: Fixed an out of bounds memory accesses on too short request which could lead to denial of service (bsc#1174908). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2147=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.12.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.12.1 xorg-x11-server-debugsource-1.20.3-lp152.8.12.1 xorg-x11-server-extra-1.20.3-lp152.8.12.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.12.1 xorg-x11-server-sdk-1.20.3-lp152.8.12.1 xorg-x11-server-source-1.20.3-lp152.8.12.1 xorg-x11-server-wayland-1.20.3-lp152.8.12.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.12.1 References: https://www.suse.com/security/cve/CVE-2020-14360.html https://www.suse.com/security/cve/CVE-2020-25712.html https://bugzilla.suse.com/1174908 https://bugzilla.suse.com/1177596

1 0

[opensuse-security-announce] openSUSE-SU-2020:2141-1: important: Security update for mutt
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2141-1 Rating: important References: #1179035 #1179113 Cross-References: CVE-2020-28896 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mutt fixes the following issues: - CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035) - Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2141=1 Package List: - openSUSE Leap 15.2 (noarch): mutt-doc-1.10.1-lp152.3.6.1 mutt-lang-1.10.1-lp152.3.6.1 - openSUSE Leap 15.2 (x86_64): mutt-1.10.1-lp152.3.6.1 mutt-debuginfo-1.10.1-lp152.3.6.1 mutt-debugsource-1.10.1-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-28896.html https://bugzilla.suse.com/1179035 https://bugzilla.suse.com/1179113

1 0

[opensuse-security-announce] openSUSE-SU-2020:2142-1: important: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2142-1 Rating: important References: #1172515 #1176315 Cross-References: CVE-2020-17507 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libqt5-qtbase fixes the following issues: - CVE-2020-17507: Fixed a buffer overflow in XBM parser (bsc#1176315) - Fixed various issues discovered by fuzzing: - Made handling of XDG_RUNTIME_DIR more secure (bsc#1172515): This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2142=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libQt5Bootstrap-devel-static-5.12.7-lp152.3.9.1 libQt5Concurrent-devel-5.12.7-lp152.3.9.1 libQt5Concurrent5-5.12.7-lp152.3.9.1 libQt5Concurrent5-debuginfo-5.12.7-lp152.3.9.1 libQt5Core-devel-5.12.7-lp152.3.9.1 libQt5Core5-5.12.7-lp152.3.9.1 libQt5Core5-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus-devel-5.12.7-lp152.3.9.1 libQt5DBus-devel-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus5-5.12.7-lp152.3.9.1 libQt5DBus5-debuginfo-5.12.7-lp152.3.9.1 libQt5Gui-devel-5.12.7-lp152.3.9.1 libQt5Gui5-5.12.7-lp152.3.9.1 libQt5Gui5-debuginfo-5.12.7-lp152.3.9.1 libQt5KmsSupport-devel-static-5.12.7-lp152.3.9.1 libQt5Network-devel-5.12.7-lp152.3.9.1 libQt5Network5-5.12.7-lp152.3.9.1 libQt5Network5-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGL-devel-5.12.7-lp152.3.9.1 libQt5OpenGL5-5.12.7-lp152.3.9.1 libQt5OpenGL5-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGLExtensions-devel-static-5.12.7-lp152.3.9.1 libQt5PlatformHeaders-devel-5.12.7-lp152.3.9.1 libQt5PlatformSupport-devel-static-5.12.7-lp152.3.9.1 libQt5PrintSupport-devel-5.12.7-lp152.3.9.1 libQt5PrintSupport5-5.12.7-lp152.3.9.1 libQt5PrintSupport5-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql-devel-5.12.7-lp152.3.9.1 libQt5Sql5-5.12.7-lp152.3.9.1 libQt5Sql5-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-debuginfo-5.12.7-lp152.3.9.1 libQt5Test-devel-5.12.7-lp152.3.9.1 libQt5Test5-5.12.7-lp152.3.9.1 libQt5Test5-debuginfo-5.12.7-lp152.3.9.1 libQt5Widgets-devel-5.12.7-lp152.3.9.1 libQt5Widgets5-5.12.7-lp152.3.9.1 libQt5Widgets5-debuginfo-5.12.7-lp152.3.9.1 libQt5Xml-devel-5.12.7-lp152.3.9.1 libQt5Xml5-5.12.7-lp152.3.9.1 libQt5Xml5-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-common-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-common-devel-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-debugsource-5.12.7-lp152.3.9.1 libqt5-qtbase-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-gtk3-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-xdgdesktopportal-5.12.7-lp152.3.9.1 libqt5-qtbase-platformtheme-xdgdesktopportal-debuginfo-5.12.7-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libQt5Bootstrap-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent-devel-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent5-32bit-5.12.7-lp152.3.9.1 libQt5Concurrent5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Core-devel-32bit-5.12.7-lp152.3.9.1 libQt5Core5-32bit-5.12.7-lp152.3.9.1 libQt5Core5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus-devel-32bit-5.12.7-lp152.3.9.1 libQt5DBus-devel-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5DBus5-32bit-5.12.7-lp152.3.9.1 libQt5DBus5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Gui-devel-32bit-5.12.7-lp152.3.9.1 libQt5Gui5-32bit-5.12.7-lp152.3.9.1 libQt5Gui5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Network-devel-32bit-5.12.7-lp152.3.9.1 libQt5Network5-32bit-5.12.7-lp152.3.9.1 libQt5Network5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGL-devel-32bit-5.12.7-lp152.3.9.1 libQt5OpenGL5-32bit-5.12.7-lp152.3.9.1 libQt5OpenGL5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5OpenGLExtensions-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5PlatformSupport-devel-static-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport-devel-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport5-32bit-5.12.7-lp152.3.9.1 libQt5PrintSupport5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql-devel-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-mysql-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-postgresql-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-sqlite-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-32bit-5.12.7-lp152.3.9.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Test-devel-32bit-5.12.7-lp152.3.9.1 libQt5Test5-32bit-5.12.7-lp152.3.9.1 libQt5Test5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Widgets-devel-32bit-5.12.7-lp152.3.9.1 libQt5Widgets5-32bit-5.12.7-lp152.3.9.1 libQt5Widgets5-32bit-debuginfo-5.12.7-lp152.3.9.1 libQt5Xml-devel-32bit-5.12.7-lp152.3.9.1 libQt5Xml5-32bit-5.12.7-lp152.3.9.1 libQt5Xml5-32bit-debuginfo-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-32bit-5.12.7-lp152.3.9.1 libqt5-qtbase-examples-32bit-debuginfo-5.12.7-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): libQt5Core-private-headers-devel-5.12.7-lp152.3.9.1 libQt5DBus-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Gui-private-headers-devel-5.12.7-lp152.3.9.1 libQt5KmsSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Network-private-headers-devel-5.12.7-lp152.3.9.1 libQt5OpenGL-private-headers-devel-5.12.7-lp152.3.9.1 libQt5PlatformSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5PrintSupport-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Sql-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Test-private-headers-devel-5.12.7-lp152.3.9.1 libQt5Widgets-private-headers-devel-5.12.7-lp152.3.9.1 libqt5-qtbase-private-headers-devel-5.12.7-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-17507.html https://bugzilla.suse.com/1172515 https://bugzilla.suse.com/1176315

1 0

[opensuse-security-announce] openSUSE-SU-2020:2143-1: important: Security update for python-setuptools
by opensuse-security＠opensuse.org 01 Dec '20

01 Dec '20

openSUSE Security Update: Security update for python-setuptools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2143-1 Rating: important References: #1176262 Cross-References: CVE-2019-20916 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-setuptools fixes the following issues: - Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2143=1 Package List: - openSUSE Leap 15.2 (noarch): python2-setuptools-40.5.0-lp152.3.3.1 python2-setuptools-test-40.5.0-lp152.3.3.1 python2-setuptools-wheel-40.5.0-lp152.3.3.1 python3-setuptools-40.5.0-lp152.3.3.1 python3-setuptools-test-40.5.0-lp152.3.3.1 python3-setuptools-wheel-40.5.0-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-20916.html https://bugzilla.suse.com/1176262

1 0