openSUSE Security Announce April 2020

security-announce@lists.opensuse.org

1 participants
49 discussions

[security-announce] openSUSE-SU-2020:0565-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 30 Apr '20

30 Apr '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0565-1 Rating: important References: #1082318 #1122242 #1122243 #1122244 #1122245 #1122535 #1158990 #1158992 #1161297 #1164675 #1169215 Cross-References: CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723 CVE-2019-17357 CVE-2019-17358 CVE-2020-7106 CVE-2020-7237 CVE-2020-8813 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for cacti, cacti-spine to version 1.2.11 fixes the following issues: This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-565=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.11-bp151.4.6.1 cacti-spine-debuginfo-1.2.11-bp151.4.6.1 cacti-spine-debugsource-1.2.11-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.11-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2009-4112.html https://www.suse.com/security/cve/CVE-2018-20723.html https://www.suse.com/security/cve/CVE-2018-20724.html https://www.suse.com/security/cve/CVE-2018-20725.html https://www.suse.com/security/cve/CVE-2018-20726.html https://www.suse.com/security/cve/CVE-2019-16723.html https://www.suse.com/security/cve/CVE-2019-17357.html https://www.suse.com/security/cve/CVE-2019-17358.html https://www.suse.com/security/cve/CVE-2020-7106.html https://www.suse.com/security/cve/CVE-2020-7237.html https://www.suse.com/security/cve/CVE-2020-8813.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1122242 https://bugzilla.suse.com/1122243 https://bugzilla.suse.com/1122244 https://bugzilla.suse.com/1122245 https://bugzilla.suse.com/1122535 https://bugzilla.suse.com/1158990 https://bugzilla.suse.com/1158992 https://bugzilla.suse.com/1161297 https://bugzilla.suse.com/1164675 https://bugzilla.suse.com/1169215 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0564-1: critical: Security update for salt
by opensuse-security＠opensuse.org 30 Apr '20

30 Apr '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0564-1 Rating: critical References: #1170595 Cross-References: CVE-2020-11651 CVE-2020-11652 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for salt fixes the following issues: - Fix CVE-2020-11651 and CVE-2020-11652 (bsc#1170595) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-564=1 Package List: - openSUSE Leap 15.1 (x86_64): python2-salt-2019.2.0-lp151.5.15.1 python3-salt-2019.2.0-lp151.5.15.1 salt-2019.2.0-lp151.5.15.1 salt-api-2019.2.0-lp151.5.15.1 salt-cloud-2019.2.0-lp151.5.15.1 salt-doc-2019.2.0-lp151.5.15.1 salt-master-2019.2.0-lp151.5.15.1 salt-minion-2019.2.0-lp151.5.15.1 salt-proxy-2019.2.0-lp151.5.15.1 salt-ssh-2019.2.0-lp151.5.15.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.15.1 salt-syndic-2019.2.0-lp151.5.15.1 - openSUSE Leap 15.1 (noarch): salt-bash-completion-2019.2.0-lp151.5.15.1 salt-fish-completion-2019.2.0-lp151.5.15.1 salt-zsh-completion-2019.2.0-lp151.5.15.1 References: https://www.suse.com/security/cve/CVE-2020-11651.html https://www.suse.com/security/cve/CVE-2020-11652.html https://bugzilla.suse.com/1170595 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0562-1: moderate: Security update for vlc
by opensuse-security＠opensuse.org 29 Apr '20

29 Apr '20

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0562-1 Rating: moderate References: #1142161 #1146428 Cross-References: CVE-2019-13602 CVE-2019-13962 CVE-2019-14437 CVE-2019-14438 CVE-2019-14498 CVE-2019-14533 CVE-2019-14534 CVE-2019-14535 CVE-2019-14776 CVE-2019-14777 CVE-2019-14778 CVE-2019-14970 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for vlc fixes the following issues: vlc was updated to version 3.0.9.2: + Misc: Properly bump the version in configure.ac. Changes from version 3.0.9.1: + Misc: Fix VLSub returning 401 for earch request. Changes from version 3.0.9: + Core: Work around busy looping when playing an invalid item through VLM. + Access: * Multiple dvdread and dvdnav crashs fixes * Fixed DVD glitches on clip change * Fixed dvdread commands/data sequence inversion in some cases causing unwanted glitches * Better handling of authored as corrupted DVD * Added libsmb2 support for SMB2/3 shares + Demux: * Fix TTML entities not passed to decoder * Fixed some WebVTT styling tags being not applied * Misc raw H264/HEVC frame rate fixes * Fix adaptive regression on TS format change (mostly HLS) * Fixed MP4 regression with twos/sowt PCM audio * Fixed some MP4 raw quicktime and ms-PCM audio * Fixed MP4 interlacing handling * Multiple adaptive stack (DASH/HLS/Smooth) fixes * Enabled Live seeking for HLS * Fixed seeking in some cases for HLS * Improved Live playback for Smooth and DASH * Fixed adaptive unwanted end of stream in some cases * Faster adaptive start and new buffering control options + Packetizers: * Fixes H264/HEVC incomplete draining in some cases * packetizer_helper: Fix potential trailing junk on last packet * Added missing drain in packetizers that was causing missing last frame or audio * Improved check to prevent fLAC synchronization drops + Decoder: * avcodec: revector video decoder to fix incomplete drain * spudec: implemented palette updates, fixing missing subtitles on some DVD * Fixed WebVTT CSS styling not being applied on Windows/macOS * Fixed Hebrew teletext pages support in zvbi * Fixed Dav1d aborting decoding on corrupted picture * Extract and display of all CEA708 subtitles * Update libfaad to 2.9.1 * Add DXVA support for VP9 Profile 2 (10 bits) * Mediacodec aspect ratio with Amazon devices + Audio output: * Added support for iOS audiounit audio above 48KHz * Added support for amem audio up to 384KHz + Video output: * Fix for opengl glitches in some drivers * Fix GMA950 opengl support on macOS * YUV to RGB StretchRect fixes with NVIDIA drivers * Use libpacebo new tone mapping desaturation algorithm + Text renderer: * Fix crashes on macOS with SSA/ASS subtitles containing emoji * Fixed unwanted growing background in Freetype rendering and Y padding + Mux: Fixed some YUV mappings + Service Discovery: Update libmicrodns to 0.1.2. + Misc: * Update YouTube, SoundCloud and Vocaroo scripts: this restores playback of YouTube URLs. * Add missing .wpl & .zpl file associations on Windows * Improved chromecast audio quality Update to version 3.0.8 'vetinari': + Fix stuttering for low framerate videos + Improve adaptive streaming + Improve audio output for external audio devices on macOS/iOS + Fix hardware acceleration with Direct3D11 for some AMD drivers + Fix WebVTT subtitles rendering + Vetinari is a major release changing a lot in the media engine of VLC. It is one of the largest release we've ever done. Notably, it: - activates hardware decoding on all platforms, of H.264 & H.265, 8 & 10bits, allowing 4K60 or even 8K decoding with little CPU consumption, - merges all the code from the mobile ports into the same codebase with common numbering and releases, - supports 360 video and 3D audio, and prepares for VR content, - supports direct HDR and HDR tone-mapping, - updates the audio passthrough for HD Audio codecs, - allows browsing of local network drives like SMB, FTP, SFTP, NFS... - stores the passwords securely, - brings a new subtitle rendering engine, supporting ComplexTextLayout and font fallback to support multiple languages and fonts, - supports ChromeCast with the new renderer framework, - adds support for numerous new formats and codecs, including WebVTT, AV1, TTML, HQX, 708, Cineform, and many more, - improves Bluray support with Java menus, aka BD-J, - updates the macOS interface with major cleaning and improvements, - support HiDPI UI on Windows, with the switch to Qt5, - prepares the experimental support for Wayland on Linux, and switches to OpenGL by default on Linux. + Security fixes included: * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970) * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) * Fix a read buffer overflow in the FAAD decoder * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) * Fix a use after free in the ASF demuxer (CVE-2019-14533) * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) * Fix a null dereference in the dvdnav demuxer * Fix a null dereference in the ASF demuxer (CVE-2019-14534) * Fix a null dereference in the AVI demuxer * Fix a division by zero in the CAF demuxer (CVE-2019-14498) * Fix a division by zero in the ASF demuxer (CVE-2019-14535) - Disbale mod-plug for the time being: libmodplug 0.8.9 is not yet available. - Disable SDL_image (SDL 1.2) based codec. It is only a wrapper around some image loading libraries (libpng, libjpeg, ...) which are either wrapped by vlc itself (libpng_plugin.so) or via libavcodec (libavcodec_plugin.so). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-562=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.9.2-bp151.5.6.1 libvlccore9-3.0.9.2-bp151.5.6.1 vlc-3.0.9.2-bp151.5.6.1 vlc-codec-gstreamer-3.0.9.2-bp151.5.6.1 vlc-devel-3.0.9.2-bp151.5.6.1 vlc-jack-3.0.9.2-bp151.5.6.1 vlc-noX-3.0.9.2-bp151.5.6.1 vlc-opencv-3.0.9.2-bp151.5.6.1 vlc-qt-3.0.9.2-bp151.5.6.1 vlc-vdpau-3.0.9.2-bp151.5.6.1 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.9.2-bp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-14437.html https://www.suse.com/security/cve/CVE-2019-14438.html https://www.suse.com/security/cve/CVE-2019-14498.html https://www.suse.com/security/cve/CVE-2019-14533.html https://www.suse.com/security/cve/CVE-2019-14534.html https://www.suse.com/security/cve/CVE-2019-14535.html https://www.suse.com/security/cve/CVE-2019-14776.html https://www.suse.com/security/cve/CVE-2019-14777.html https://www.suse.com/security/cve/CVE-2019-14778.html https://www.suse.com/security/cve/CVE-2019-14970.html https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1146428 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0563-1: moderate: Security update for teeworlds
by opensuse-security＠opensuse.org 29 Apr '20

29 Apr '20

openSUSE Security Update: Security update for teeworlds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0563-1 Rating: moderate References: #1170252 #1170253 Cross-References: CVE-2019-20787 CVE-2020-12066 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for teeworlds to version 0.7.5 fixes the following issues: Security issues fixed: - CVE-2020-12066: Fixed a denial of service against the server (boo#1170252) - CVE-2019-20787: Fixed an integer overflow when computing a tilemap size (boo#1170253) Non-security issues fixed: - multiple smaller bug fixes and improvements. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-563=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): teeworlds-0.7.5-bp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-20787.html https://www.suse.com/security/cve/CVE-2020-12066.html https://bugzilla.suse.com/1170252 https://bugzilla.suse.com/1170253 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0557-1: moderate: Security update for teeworlds
by opensuse-security＠opensuse.org 27 Apr '20

27 Apr '20

openSUSE Security Update: Security update for teeworlds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0557-1 Rating: moderate References: #1170252 #1170253 Cross-References: CVE-2019-20787 CVE-2020-12066 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for teeworlds to version 0.7.5 fixes the following issues: Security issues fixed: - CVE-2020-12066: Fixed a denial of service against the server (boo#1170252) - CVE-2019-20787: Fixed an integer overflow when computing a tilemap size (boo#1170253) Non-security issues fixed: - multiple smaller bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-557=1 Package List: - openSUSE Leap 15.1 (x86_64): teeworlds-0.7.5-lp151.2.6.1 teeworlds-debuginfo-0.7.5-lp151.2.6.1 teeworlds-debugsource-0.7.5-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-20787.html https://www.suse.com/security/cve/CVE-2020-12066.html https://bugzilla.suse.com/1170252 https://bugzilla.suse.com/1170253 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0558-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 27 Apr '20

27 Apr '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0558-1 Rating: important References: #1082318 #1122242 #1122243 #1122244 #1122245 #1122535 #1158990 #1158992 #1161297 #1164675 #1169215 Cross-References: CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723 CVE-2019-17357 CVE-2019-17358 CVE-2020-7106 CVE-2020-7237 CVE-2020-8813 Affected Products: openSUSE Leap 15.1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for cacti, cacti-spine to version 1.2.11 fixes the following issues: This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-558=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-558=1 Package List: - openSUSE Leap 15.1 (noarch): cacti-1.2.11-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.11-lp151.3.6.1 cacti-spine-debuginfo-1.2.11-lp151.3.6.1 cacti-spine-debugsource-1.2.11-lp151.3.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.11-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): cacti-spine-debuginfo-1.2.11-2.1 cacti-spine-debugsource-1.2.11-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.11-5.1 References: https://www.suse.com/security/cve/CVE-2009-4112.html https://www.suse.com/security/cve/CVE-2018-20723.html https://www.suse.com/security/cve/CVE-2018-20724.html https://www.suse.com/security/cve/CVE-2018-20725.html https://www.suse.com/security/cve/CVE-2018-20726.html https://www.suse.com/security/cve/CVE-2019-16723.html https://www.suse.com/security/cve/CVE-2019-17357.html https://www.suse.com/security/cve/CVE-2019-17358.html https://www.suse.com/security/cve/CVE-2020-7106.html https://www.suse.com/security/cve/CVE-2020-7237.html https://www.suse.com/security/cve/CVE-2020-8813.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1122242 https://bugzilla.suse.com/1122243 https://bugzilla.suse.com/1122244 https://bugzilla.suse.com/1122245 https://bugzilla.suse.com/1122535 https://bugzilla.suse.com/1158990 https://bugzilla.suse.com/1158992 https://bugzilla.suse.com/1161297 https://bugzilla.suse.com/1164675 https://bugzilla.suse.com/1169215 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0558-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 27 Apr '20

27 Apr '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0558-1 Rating: important References: #1082318 #1122242 #1122243 #1122244 #1122245 #1122535 #1158990 #1158992 #1161297 #1164675 #1169215 Cross-References: CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723 CVE-2019-17357 CVE-2019-17358 CVE-2020-7106 CVE-2020-7237 CVE-2020-8813 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for cacti, cacti-spine to version 1.2.11 fixes the following issues: This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-558=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.11-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): cacti-spine-debuginfo-1.2.11-2.1 cacti-spine-debugsource-1.2.11-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.11-5.1 References: https://www.suse.com/security/cve/CVE-2009-4112.html https://www.suse.com/security/cve/CVE-2018-20723.html https://www.suse.com/security/cve/CVE-2018-20724.html https://www.suse.com/security/cve/CVE-2018-20725.html https://www.suse.com/security/cve/CVE-2018-20726.html https://www.suse.com/security/cve/CVE-2019-16723.html https://www.suse.com/security/cve/CVE-2019-17357.html https://www.suse.com/security/cve/CVE-2019-17358.html https://www.suse.com/security/cve/CVE-2020-7106.html https://www.suse.com/security/cve/CVE-2020-7237.html https://www.suse.com/security/cve/CVE-2020-8813.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1122242 https://bugzilla.suse.com/1122243 https://bugzilla.suse.com/1122244 https://bugzilla.suse.com/1122245 https://bugzilla.suse.com/1122535 https://bugzilla.suse.com/1158990 https://bugzilla.suse.com/1158992 https://bugzilla.suse.com/1161297 https://bugzilla.suse.com/1164675 https://bugzilla.suse.com/1169215 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0554-1: important: Security update for kubernetes
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for kubernetes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0554-1 Rating: important References: #1039663 #1042383 #1042387 #1057277 #1059207 #1061027 #1065972 #1069469 #1084765 #1084766 #1085009 #1086185 #1086412 #1095131 #1095154 #1096773 #1097473 #1100838 #1101010 #1104598 #1104821 #1112980 #1118897 #1118898 #1136403 #1144065 #1155323 #1161056 #1161179 Cross-References: CVE-2016-5195 CVE-2016-8859 CVE-2017-1002101 CVE-2018-1002105 CVE-2018-16873 CVE-2018-16874 CVE-2019-10214 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 22 fixes is now available. Description: This update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-554=1 Package List: - openSUSE Leap 15.1 (x86_64): cri-o-1.17.1-lp151.2.2 cri-o-kubeadm-criconfig-1.17.1-lp151.2.2 cri-tools-1.18.0-lp151.2.1 go1.14-1.14-lp151.6.1 go1.14-doc-1.14-lp151.6.1 go1.14-race-1.14-lp151.6.1 kubernetes-apiserver-1.18.0-lp151.5.1 kubernetes-client-1.18.0-lp151.5.1 kubernetes-controller-manager-1.18.0-lp151.5.1 kubernetes-kubeadm-1.18.0-lp151.5.1 kubernetes-kubelet-common-1.18.0-lp151.5.1 kubernetes-kubelet1.17-1.18.0-lp151.5.1 kubernetes-kubelet1.18-1.18.0-lp151.5.1 kubernetes-master-1.18.0-lp151.5.1 kubernetes-node-1.18.0-lp151.5.1 kubernetes-proxy-1.18.0-lp151.5.1 kubernetes-scheduler-1.18.0-lp151.5.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-8859.html https://www.suse.com/security/cve/CVE-2017-1002101.html https://www.suse.com/security/cve/CVE-2018-1002105.html https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2019-10214.html https://bugzilla.suse.com/1039663 https://bugzilla.suse.com/1042383 https://bugzilla.suse.com/1042387 https://bugzilla.suse.com/1057277 https://bugzilla.suse.com/1059207 https://bugzilla.suse.com/1061027 https://bugzilla.suse.com/1065972 https://bugzilla.suse.com/1069469 https://bugzilla.suse.com/1084765 https://bugzilla.suse.com/1084766 https://bugzilla.suse.com/1085009 https://bugzilla.suse.com/1086185 https://bugzilla.suse.com/1086412 https://bugzilla.suse.com/1095131 https://bugzilla.suse.com/1095154 https://bugzilla.suse.com/1096773 https://bugzilla.suse.com/1097473 https://bugzilla.suse.com/1100838 https://bugzilla.suse.com/1101010 https://bugzilla.suse.com/1104598 https://bugzilla.suse.com/1104821 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1136403 https://bugzilla.suse.com/1144065 https://bugzilla.suse.com/1155323 https://bugzilla.suse.com/1161056 https://bugzilla.suse.com/1161179 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0555-1: important: Security update for cups
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0555-1 Rating: important References: #1168422 Cross-References: CVE-2020-3898 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: - CVE-2020-3898: Fixed a heap buffer overflow in ppdFindOption() (bsc#1168422). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-555=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cups-2.2.7-lp151.6.6.1 cups-client-2.2.7-lp151.6.6.1 cups-client-debuginfo-2.2.7-lp151.6.6.1 cups-config-2.2.7-lp151.6.6.1 cups-ddk-2.2.7-lp151.6.6.1 cups-ddk-debuginfo-2.2.7-lp151.6.6.1 cups-debuginfo-2.2.7-lp151.6.6.1 cups-debugsource-2.2.7-lp151.6.6.1 cups-devel-2.2.7-lp151.6.6.1 libcups2-2.2.7-lp151.6.6.1 libcups2-debuginfo-2.2.7-lp151.6.6.1 libcupscgi1-2.2.7-lp151.6.6.1 libcupscgi1-debuginfo-2.2.7-lp151.6.6.1 libcupsimage2-2.2.7-lp151.6.6.1 libcupsimage2-debuginfo-2.2.7-lp151.6.6.1 libcupsmime1-2.2.7-lp151.6.6.1 libcupsmime1-debuginfo-2.2.7-lp151.6.6.1 libcupsppdc1-2.2.7-lp151.6.6.1 libcupsppdc1-debuginfo-2.2.7-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): cups-devel-32bit-2.2.7-lp151.6.6.1 libcups2-32bit-2.2.7-lp151.6.6.1 libcups2-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupscgi1-32bit-2.2.7-lp151.6.6.1 libcupscgi1-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsimage2-32bit-2.2.7-lp151.6.6.1 libcupsimage2-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsmime1-32bit-2.2.7-lp151.6.6.1 libcupsmime1-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsppdc1-32bit-2.2.7-lp151.6.6.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-3898.html https://bugzilla.suse.com/1168422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0553-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0553-1 Rating: moderate References: #1144524 #1146848 #1166847 Cross-References: CVE-2019-13456 CVE-2019-17185 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524). - CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847). - Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-553=1 Package List: - openSUSE Leap 15.1 (x86_64): freeradius-server-3.0.16-lp151.4.4.1 freeradius-server-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-debugsource-3.0.16-lp151.4.4.1 freeradius-server-devel-3.0.16-lp151.4.4.1 freeradius-server-doc-3.0.16-lp151.4.4.1 freeradius-server-krb5-3.0.16-lp151.4.4.1 freeradius-server-krb5-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-ldap-3.0.16-lp151.4.4.1 freeradius-server-ldap-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-libs-3.0.16-lp151.4.4.1 freeradius-server-libs-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-mysql-3.0.16-lp151.4.4.1 freeradius-server-mysql-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-perl-3.0.16-lp151.4.4.1 freeradius-server-perl-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-postgresql-3.0.16-lp151.4.4.1 freeradius-server-postgresql-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-python-3.0.16-lp151.4.4.1 freeradius-server-python-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-sqlite-3.0.16-lp151.4.4.1 freeradius-server-sqlite-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-utils-3.0.16-lp151.4.4.1 freeradius-server-utils-debuginfo-3.0.16-lp151.4.4.1 References: https://www.suse.com/security/cve/CVE-2019-13456.html https://www.suse.com/security/cve/CVE-2019-17185.html https://bugzilla.suse.com/1144524 https://bugzilla.suse.com/1146848 https://bugzilla.suse.com/1166847 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

openSUSE Security Announce April 2020