March 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0314-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 08 Mar '20

08 Mar '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0314-1 Rating: moderate References: #1153072 #1163927 #1163959 #1163969 Cross-References: CVE-2019-14553 CVE-2019-14559 CVE-2019-14563 CVE-2019-14575 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959). - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences (bsc#1153072). - CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927). - CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969). - Enabled HTTPS-over-IPv6 (bsc#1153072). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-314=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp151.11.3.1 ovmf-tools-2017+git1510945757.b2662641d5-lp151.11.3.1 - openSUSE Leap 15.1 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp151.11.3.1 - openSUSE Leap 15.1 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp151.11.3.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp151.11.3.1 References: https://www.suse.com/security/cve/CVE-2019-14553.html https://www.suse.com/security/cve/CVE-2019-14559.html https://www.suse.com/security/cve/CVE-2019-14563.html https://www.suse.com/security/cve/CVE-2019-14575.html https://bugzilla.suse.com/1153072 https://bugzilla.suse.com/1163927 https://bugzilla.suse.com/1163959 https://bugzilla.suse.com/1163969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0308-1: important: Security update for python-bleach
by opensuse-security＠opensuse.org 07 Mar '20

07 Mar '20

openSUSE Security Update: Security update for python-bleach ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0308-1 Rating: important References: #1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-bleach to version 3.1.1 fixes the following issue: - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities (boo#1165303). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-308=1 Package List: - openSUSE Leap 15.1 (noarch): python2-bleach-3.1.1-lp151.3.6.1 python3-bleach-3.1.1-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-6802.html https://bugzilla.suse.com/1165303 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0307-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 06 Mar '20

06 Mar '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0307-1 Rating: moderate References: #1162687 #1162689 #1162691 Cross-References: CVE-2019-12528 CVE-2020-8449 CVE-2020-8450 CVE-2020-8517 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for squid to version 4.10 fixes the following issues: Security issues fixed: - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689). - CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691). Non-security issue fixed: - Improved cache handling with chunked responses. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-307=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.10-lp151.2.11.1 squid-debuginfo-4.10-lp151.2.11.1 squid-debugsource-4.10-lp151.2.11.1 References: https://www.suse.com/security/cve/CVE-2019-12528.html https://www.suse.com/security/cve/CVE-2020-8449.html https://www.suse.com/security/cve/CVE-2020-8450.html https://www.suse.com/security/cve/CVE-2020-8517.html https://bugzilla.suse.com/1162687 https://bugzilla.suse.com/1162689 https://bugzilla.suse.com/1162691 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0305-1: important: Security update for openfortivpn
by opensuse-security＠opensuse.org 05 Mar '20

05 Mar '20

openSUSE Security Update: Security update for openfortivpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0305-1 Rating: important References: #1165299 #1165300 #1165301 Cross-References: CVE-2020-7041 CVE-2020-7042 CVE-2020-7043 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openfortivpn to version 1.12.0 fixes the following issues: - CVE-2020-7043: Fixed a TLS Certificate CommonName NULL Byte Vulnerability (boo#1165301). - CVE-2020-7042: Fixed use of uninitialized memory in X509_check_host (boo#1165300). - CVE-2020-7041: Fixed incorrect use of X509_check_host (boo#1165299). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-305=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): openfortivpn-1.12.0-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-7041.html https://www.suse.com/security/cve/CVE-2020-7042.html https://www.suse.com/security/cve/CVE-2020-7043.html https://bugzilla.suse.com/1165299 https://bugzilla.suse.com/1165300 https://bugzilla.suse.com/1165301 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0302-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 04 Mar '20

04 Mar '20

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0302-1 Rating: moderate References: #1148788 #1160594 #1160764 #1161779 #1163922 Cross-References: CVE-2019-3687 CVE-2020-8013 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for permissions fixes the following issues: Security issues fixed: - CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed (bsc#1148788) - CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities for mrsh and wodim (bsc#1163922). Non-security issues fixed: - Fixed a regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594). - Fixed capability handling when doing multiple permission changes at once (bsc#1161779). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-302=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.12.1 permissions-debuginfo-20181116-lp151.4.12.1 permissions-debugsource-20181116-lp151.4.12.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.12.1 References: https://www.suse.com/security/cve/CVE-2019-3687.html https://www.suse.com/security/cve/CVE-2020-8013.html https://bugzilla.suse.com/1148788 https://bugzilla.suse.com/1160594 https://bugzilla.suse.com/1160764 https://bugzilla.suse.com/1161779 https://bugzilla.suse.com/1163922 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0301-1: important: Security update for openfortivpn
by opensuse-security＠opensuse.org 04 Mar '20

04 Mar '20

openSUSE Security Update: Security update for openfortivpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0301-1 Rating: important References: #1165299 #1165300 #1165301 Cross-References: CVE-2020-7041 CVE-2020-7042 CVE-2020-7043 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openfortivpn to version 1.12.0 fixes the following issues: - CVE-2020-7043: Fixed a TLS Certificate CommonName NULL Byte Vulnerability (boo#1165301). - CVE-2020-7042: Fixed use of uninitialized memory in X509_check_host (boo#1165300). - CVE-2020-7041: Fixed incorrect use of X509_check_host (boo#1165299). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-301=1 Package List: - openSUSE Leap 15.1 (x86_64): openfortivpn-1.12.0-lp151.2.5.1 openfortivpn-debuginfo-1.12.0-lp151.2.5.1 openfortivpn-debugsource-1.12.0-lp151.2.5.1 References: https://www.suse.com/security/cve/CVE-2020-7041.html https://www.suse.com/security/cve/CVE-2020-7042.html https://www.suse.com/security/cve/CVE-2020-7043.html https://bugzilla.suse.com/1165299 https://bugzilla.suse.com/1165300 https://bugzilla.suse.com/1165301 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0293-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 03 Mar '20

03 Mar '20

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0293-1 Rating: important References: #1163102 #1163103 #1163104 Cross-References: CVE-2019-15604 CVE-2019-15605 CVE-2019-15606 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: Security issues fixed: - CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104). - CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102). - CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-293=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs8-8.17.0-lp151.2.12.1 nodejs8-debuginfo-8.17.0-lp151.2.12.1 nodejs8-debugsource-8.17.0-lp151.2.12.1 nodejs8-devel-8.17.0-lp151.2.12.1 npm8-8.17.0-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): nodejs8-docs-8.17.0-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-15604.html https://www.suse.com/security/cve/CVE-2019-15605.html https://www.suse.com/security/cve/CVE-2019-15606.html https://bugzilla.suse.com/1163102 https://bugzilla.suse.com/1163103 https://bugzilla.suse.com/1163104 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0289-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 03 Mar '20

03 Mar '20

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0289-1 Rating: moderate References: #1160878 #1160883 #1160895 #1160912 #1162388 Cross-References: CVE-2019-18901 CVE-2020-2574 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for mariadb fixes the following issues: MariaDB was updated to version 10.2.31 GA (bsc#1162388). Security issues fixed: - CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388). - CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895). - Enabled security hardenings in MariaDB's systemd service, namely ProtectSystem, ProtectHome and UMask (bsc#1160878). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-289=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmysqld-devel-10.2.31-lp151.2.12.1 libmysqld19-10.2.31-lp151.2.12.1 libmysqld19-debuginfo-10.2.31-lp151.2.12.1 mariadb-10.2.31-lp151.2.12.1 mariadb-bench-10.2.31-lp151.2.12.1 mariadb-bench-debuginfo-10.2.31-lp151.2.12.1 mariadb-client-10.2.31-lp151.2.12.1 mariadb-client-debuginfo-10.2.31-lp151.2.12.1 mariadb-debuginfo-10.2.31-lp151.2.12.1 mariadb-debugsource-10.2.31-lp151.2.12.1 mariadb-galera-10.2.31-lp151.2.12.1 mariadb-test-10.2.31-lp151.2.12.1 mariadb-test-debuginfo-10.2.31-lp151.2.12.1 mariadb-tools-10.2.31-lp151.2.12.1 mariadb-tools-debuginfo-10.2.31-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.31-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-18901.html https://www.suse.com/security/cve/CVE-2020-2574.html https://bugzilla.suse.com/1160878 https://bugzilla.suse.com/1160883 https://bugzilla.suse.com/1160895 https://bugzilla.suse.com/1160912 https://bugzilla.suse.com/1162388 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0286-1: important: Security update for ppp
by opensuse-security＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Security Update: Security update for ppp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0286-1 Rating: important References: #1162610 Cross-References: CVE-2020-8597 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ppp fixes the following security issue: - CVE-2020-8597: Fixed a buffer overflow in the eap_request and eap_response functions (bsc#1162610). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-286=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ppp-2.4.7-lp151.5.3.1 ppp-debuginfo-2.4.7-lp151.5.3.1 ppp-debugsource-2.4.7-lp151.5.3.1 ppp-devel-2.4.7-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): ppp-modem-2.4.7-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-8597.html https://bugzilla.suse.com/1162610 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0284-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0284-1 Rating: important References: #1082318 #1101024 #1101139 #1122242 #1122243 #1122244 #1122245 #1122535 #1158990 #1158992 #1161297 #1163749 Cross-References: CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723 CVE-2019-17357 CVE-2019-17358 CVE-2020-7106 CVE-2020-7237 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine was updated to version 1.2.9. Security issues fixed: - CVE-2009-4112: Fixed a privilege escalation (bsc#1122535). - CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245). - CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244). - CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535). - CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242). - CVE-2019-16723: Fixed an authentication bypass vulnerability. - CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990). - CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992). - CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749). - CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297). Non-security issues fixed: - Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024). - Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-284=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.9-bp151.4.3.1 cacti-spine-debuginfo-1.2.9-bp151.4.3.1 cacti-spine-debugsource-1.2.9-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.9-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2009-4112.html https://www.suse.com/security/cve/CVE-2018-20723.html https://www.suse.com/security/cve/CVE-2018-20724.html https://www.suse.com/security/cve/CVE-2018-20725.html https://www.suse.com/security/cve/CVE-2018-20726.html https://www.suse.com/security/cve/CVE-2019-16723.html https://www.suse.com/security/cve/CVE-2019-17357.html https://www.suse.com/security/cve/CVE-2019-17358.html https://www.suse.com/security/cve/CVE-2020-7106.html https://www.suse.com/security/cve/CVE-2020-7237.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1101024 https://bugzilla.suse.com/1101139 https://bugzilla.suse.com/1122242 https://bugzilla.suse.com/1122243 https://bugzilla.suse.com/1122244 https://bugzilla.suse.com/1122245 https://bugzilla.suse.com/1122535 https://bugzilla.suse.com/1158990 https://bugzilla.suse.com/1158992 https://bugzilla.suse.com/1161297 https://bugzilla.suse.com/1163749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0