April 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0520-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 15 Apr '20

15 Apr '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0520-1 Rating: important References: #1168630 #1168874 Cross-References: CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.7.0 fixes the following issues: - CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630) - CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630) - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874) - CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874) - CVE-2020-6825: Memory safety bugs fixed (boo#1168874) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-520=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.7.0-lp151.2.31.1 MozillaThunderbird-debuginfo-68.7.0-lp151.2.31.1 MozillaThunderbird-debugsource-68.7.0-lp151.2.31.1 MozillaThunderbird-translations-common-68.7.0-lp151.2.31.1 MozillaThunderbird-translations-other-68.7.0-lp151.2.31.1 References: https://www.suse.com/security/cve/CVE-2020-6819.html https://www.suse.com/security/cve/CVE-2020-6820.html https://www.suse.com/security/cve/CVE-2020-6821.html https://www.suse.com/security/cve/CVE-2020-6822.html https://www.suse.com/security/cve/CVE-2020-6825.html https://bugzilla.suse.com/1168630 https://bugzilla.suse.com/1168874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0517-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 14 Apr '20

14 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0517-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-517=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): nagios-4.4.5-bp151.4.3.1 nagios-contrib-4.4.5-bp151.4.3.1 nagios-devel-4.4.5-bp151.4.3.1 nagios-www-4.4.5-bp151.4.3.1 nagios-www-dch-4.4.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): nagios-theme-exfoliation-4.4.5-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0513-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0513-1 Rating: moderate References: #1137479 #1142542 #1142690 #1144453 #1153452 #1154231 #1154232 #1154830 #1157968 #1157969 Cross-References: CVE-2019-10206 CVE-2019-10217 CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 CVE-2019-14864 CVE-2019-14904 CVE-2019-14905 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for ansible to version 2.9.6 fixes the following issues: Security issues fixed: - CVE-2019-14904: Fixed a vulnerability in solaris_zone module via crafted solaris zone (boo#1157968). - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxos_file_copy module (boo#1157969). - CVE-2019-14864: Fixed Splunk and Sumologic callback plugins leak sensitive data in logs (boo#1154830). - CVE-2019-14846: Fixed secrets disclosure on logs due to display is hardcoded to DEBUG level (boo#1153452) - CVE-2019-14856: Fixed insufficient fix for CVE-2019-10206 (boo#1154232) - CVE-2019-14858: Fixed data in the sub parameter fields that will not be masked and will be displayed when run with increased verbosity (boo#1154231) - CVE-2019-10206: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. (boo#1142690) - CVE-2019-10217: Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. (boo#1144453) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-513=1 Package List: - openSUSE Leap 15.1 (noarch): ansible-2.9.6-lp151.2.7.1 ansible-doc-2.9.6-lp151.2.7.1 ansible-test-2.9.6-lp151.2.7.1 References: https://www.suse.com/security/cve/CVE-2019-10206.html https://www.suse.com/security/cve/CVE-2019-10217.html https://www.suse.com/security/cve/CVE-2019-14846.html https://www.suse.com/security/cve/CVE-2019-14856.html https://www.suse.com/security/cve/CVE-2019-14858.html https://www.suse.com/security/cve/CVE-2019-14864.html https://www.suse.com/security/cve/CVE-2019-14904.html https://www.suse.com/security/cve/CVE-2019-14905.html https://bugzilla.suse.com/1137479 https://bugzilla.suse.com/1142542 https://bugzilla.suse.com/1142690 https://bugzilla.suse.com/1144453 https://bugzilla.suse.com/1153452 https://bugzilla.suse.com/1154231 https://bugzilla.suse.com/1154232 https://bugzilla.suse.com/1154830 https://bugzilla.suse.com/1157968 https://bugzilla.suse.com/1157969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0511-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0511-1 Rating: moderate References: #1168364 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Fixed spelling of icinga group (bsc#1168364) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-511=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.18.1 permissions-debuginfo-20181116-lp151.4.18.1 permissions-debugsource-20181116-lp151.4.18.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.18.1 References: https://bugzilla.suse.com/1168364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0512-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0512-1 Rating: important References: #1167465 #1168421 Cross-References: CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: chromium was updated to 80.0.3987.162 boo#1168421: * CVE-2020-6450: Use after free in WebAudio. * CVE-2020-6451: Use after free in WebAudio. * CVE-2020-6452: Heap buffer overflow in media. - Use a symbolic icon for GNOME Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-512=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-80.0.3987.162-44.1 chromium-80.0.3987.162-44.1 References: https://www.suse.com/security/cve/CVE-2020-6450.html https://www.suse.com/security/cve/CVE-2020-6451.html https://www.suse.com/security/cve/CVE-2020-6452.html https://bugzilla.suse.com/1167465 https://bugzilla.suse.com/1168421 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0510-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0510-1 Rating: moderate References: #1168699 Cross-References: CVE-2020-1730 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2020-1730: Fixed a possible denial of service when using AES-CTR (bsc#1168699). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-510=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libssh-debugsource-0.8.7-lp151.2.12.1 libssh-devel-0.8.7-lp151.2.12.1 libssh4-0.8.7-lp151.2.12.1 libssh4-debuginfo-0.8.7-lp151.2.12.1 - openSUSE Leap 15.1 (x86_64): libssh4-32bit-0.8.7-lp151.2.12.1 libssh4-32bit-debuginfo-0.8.7-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-1730.html https://bugzilla.suse.com/1168699 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0507-1: important: Security update for python-PyYAML
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for python-PyYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0507-1 Rating: important References: #1165439 Cross-References: CVE-2020-1747 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-PyYAML fixes the following issues: - CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-507=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python-PyYAML-debugsource-5.1.2-lp151.2.6.1 python2-PyYAML-5.1.2-lp151.2.6.1 python2-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python3-PyYAML-5.1.2-lp151.2.6.1 python3-PyYAML-debuginfo-5.1.2-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-1747.html https://bugzilla.suse.com/1165439 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0506-1: moderate: Security update for mgetty
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0506-1 Rating: moderate References: #1142770 #1168170 Cross-References: CVE-2019-1010190 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mgetty fixes the following issues: - CVE-2019-1010190: Fixed a denial of service which could be caused by a local attacker in putwhitespan() (bsc#1142770). - Fixed a permission issue which have resulted in build failures (bsc#1168170). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-506=1 Package List: - openSUSE Leap 15.1 (x86_64): g3utils-1.1.37-lp151.4.3.1 g3utils-debuginfo-1.1.37-lp151.4.3.1 mgetty-1.1.37-lp151.4.3.1 mgetty-debuginfo-1.1.37-lp151.4.3.1 mgetty-debugsource-1.1.37-lp151.4.3.1 sendfax-1.1.37-lp151.4.3.1 sendfax-debuginfo-1.1.37-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-1010190.html https://bugzilla.suse.com/1142770 https://bugzilla.suse.com/1168170 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0501-1: moderate: Security update for gmp, gnutls, libnettle
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for gmp, gnutls, libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0501-1 Rating: moderate References: #1152692 #1155327 #1166881 #1168345 Cross-References: CVE-2020-11501 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for gmp, gnutls, libnettle fixes the following issues: Security issue fixed: - CVE-2020-11501: Fixed zero random value in DTLS client hello (bsc#1168345) FIPS related bugfixes: - FIPS: Install checksums for binary integrity verification which are required when running in FIPS mode (bsc#1152692, jsc#SLE-9518) - FIPS: Fixed a cfb8 decryption issue, no longer truncate output IV if input is shorter than block size. (bsc#1166881) - FIPS: Added Diffie Hellman public key verification test. (bsc#1155327) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-501=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gmp-debugsource-6.1.2-lp151.4.3.1 gmp-devel-6.1.2-lp151.4.3.1 gnutls-3.6.7-lp151.2.6.1 gnutls-debuginfo-3.6.7-lp151.2.6.1 gnutls-debugsource-3.6.7-lp151.2.6.1 gnutls-guile-3.6.7-lp151.2.6.1 gnutls-guile-debuginfo-3.6.7-lp151.2.6.1 libgmp10-6.1.2-lp151.4.3.1 libgmp10-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-6.1.2-lp151.4.3.1 libgmpxx4-debuginfo-6.1.2-lp151.4.3.1 libgnutls-dane-devel-3.6.7-lp151.2.6.1 libgnutls-dane0-3.6.7-lp151.2.6.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.6.1 libgnutls-devel-3.6.7-lp151.2.6.1 libgnutls30-3.6.7-lp151.2.6.1 libgnutls30-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-3.6.7-lp151.2.6.1 libgnutlsxx-devel-3.6.7-lp151.2.6.1 libgnutlsxx28-3.6.7-lp151.2.6.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.6.1 libhogweed4-3.4.1-lp151.2.3.2 libhogweed4-debuginfo-3.4.1-lp151.2.3.2 libnettle-debugsource-3.4.1-lp151.2.3.2 libnettle-devel-3.4.1-lp151.2.3.2 libnettle6-3.4.1-lp151.2.3.2 libnettle6-debuginfo-3.4.1-lp151.2.3.2 nettle-3.4.1-lp151.2.3.2 nettle-debuginfo-3.4.1-lp151.2.3.2 - openSUSE Leap 15.1 (x86_64): gmp-devel-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-32bit-6.1.2-lp151.4.3.1 libgmpxx4-32bit-debuginfo-6.1.2-lp151.4.3.1 libgnutls-devel-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.6.1 libhogweed4-32bit-3.4.1-lp151.2.3.2 libhogweed4-32bit-debuginfo-3.4.1-lp151.2.3.2 libnettle-devel-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-debuginfo-3.4.1-lp151.2.3.2 References: https://www.suse.com/security/cve/CVE-2020-11501.html https://bugzilla.suse.com/1152692 https://bugzilla.suse.com/1155327 https://bugzilla.suse.com/1166881 https://bugzilla.suse.com/1168345 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0500-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0500-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-500=1 Package List: - openSUSE Leap 15.1 (x86_64): nagios-4.4.5-lp151.5.4.1 nagios-contrib-4.4.5-lp151.5.4.1 nagios-debuginfo-4.4.5-lp151.5.4.1 nagios-debugsource-4.4.5-lp151.5.4.1 nagios-devel-4.4.5-lp151.5.4.1 nagios-www-4.4.5-lp151.5.4.1 nagios-www-dch-4.4.5-lp151.5.4.1 nagios-www-debuginfo-4.4.5-lp151.5.4.1 - openSUSE Leap 15.1 (noarch): nagios-theme-exfoliation-4.4.5-lp151.5.4.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0494-1: important: Security update for ceph
by opensuse-security＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0494-1 Rating: important References: #1166403 #1166484 Cross-References: CVE-2020-1759 CVE-2020-1760 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ceph fixes the following issues: - CVE-2020-1759: Fixed once reuse in msgr V2 secure mode (bsc#1166403) - CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting (bsc#1166484). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-494=1 Package List: - openSUSE Leap 15.1 (noarch): ceph-dashboard-e2e-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-grafana-dashboards-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-dashboard-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-diskprediction-cloud-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-diskprediction-local-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-k8sevents-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-rook-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-ssh-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-prometheus-alerts-14.2.5.389+gb0f23ac248-lp151.2.13.1 - openSUSE Leap 15.1 (x86_64): ceph-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-base-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-base-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-common-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-common-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-debugsource-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-fuse-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-fuse-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mds-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mds-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mon-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mon-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-osd-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-osd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-radosgw-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-radosgw-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-resource-agents-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-debugsource-14.2.5.389+gb0f23ac248-lp151.2.13.1 cephfs-shell-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs2-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados-devel-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados2-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradospp-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper1-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper1-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd1-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd1-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw2-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-ceph-argparse-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-cephfs-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-cephfs-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rados-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rados-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rbd-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rbd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rgw-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rgw-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rados-objclass-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-fuse-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-fuse-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-mirror-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-mirror-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-nbd-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-nbd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-1759.html https://www.suse.com/security/cve/CVE-2020-1760.html https://bugzilla.suse.com/1166403 https://bugzilla.suse.com/1166484 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0493-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0493-1 Rating: important References: #1168874 Cross-References: CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 CVE-2020-6827 CVE-2020-6828 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues: - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method (bsc#1168874). - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images (bsc#1168874). - CVE-2020-6825: Fixed Memory safety bugs (bsc#1168874). - CVE-2020-6827: Custom Tabs could have the URI spoofed (bsc#1168874). - CVE-2020-6828: Preference overwrite via crafted Intent (bsc#1168874). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-493=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.7.0-lp151.2.42.1 MozillaFirefox-branding-upstream-68.7.0-lp151.2.42.1 MozillaFirefox-buildsymbols-68.7.0-lp151.2.42.1 MozillaFirefox-debuginfo-68.7.0-lp151.2.42.1 MozillaFirefox-debugsource-68.7.0-lp151.2.42.1 MozillaFirefox-devel-68.7.0-lp151.2.42.1 MozillaFirefox-translations-common-68.7.0-lp151.2.42.1 MozillaFirefox-translations-other-68.7.0-lp151.2.42.1 References: https://www.suse.com/security/cve/CVE-2020-6821.html https://www.suse.com/security/cve/CVE-2020-6822.html https://www.suse.com/security/cve/CVE-2020-6825.html https://www.suse.com/security/cve/CVE-2020-6827.html https://www.suse.com/security/cve/CVE-2020-6828.html https://bugzilla.suse.com/1168874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0490-1: moderate: Security update for gnuhealth
by opensuse-security＠opensuse.org 09 Apr '20

09 Apr '20

openSUSE Security Update: Security update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0490-1 Rating: moderate References: #1167126 #1167128 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - Fixed a local privilege escalation in gnuhealth-control, use of static tmp file/http transport (bsc#1167126) - Fixed a local DoS of backup functionality in gnuhealth-control due to use of static tmp files (bsc#1167128) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-490=1 Package List: - openSUSE Leap 15.1 (noarch): gnuhealth-3.4.1-lp151.2.11.1 References: https://bugzilla.suse.com/1167126 https://bugzilla.suse.com/1167128 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0491-1: moderate: Security update for exim
by opensuse-security＠opensuse.org 09 Apr '20

09 Apr '20

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0491-1 Rating: moderate References: #1154183 #1160726 Cross-References: CVE-2020-8015 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for exim fixes the following issues: - CVE-2020-8015: Fixed a local privilege escalation from user mail to root (boo#1154183). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-491=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.12.1 exim-debuginfo-4.88-lp151.4.12.1 exim-debugsource-4.88-lp151.4.12.1 eximon-4.88-lp151.4.12.1 eximon-debuginfo-4.88-lp151.4.12.1 eximstats-html-4.88-lp151.4.12.1 References: https://www.suse.com/security/cve/CVE-2020-8015.html https://bugzilla.suse.com/1154183 https://bugzilla.suse.com/1160726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0482-1: moderate: Security update for exiv2
by opensuse-security＠opensuse.org 08 Apr '20

08 Apr '20

openSUSE Security Update: Security update for exiv2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0482-1 Rating: moderate References: #1040973 #1068873 #1088424 #1097599 #1097600 #1109175 #1109176 #1109299 #1115364 #1117513 #1142684 Cross-References: CVE-2017-1000126 CVE-2017-9239 CVE-2018-12264 CVE-2018-12265 CVE-2018-17229 CVE-2018-17230 CVE-2018-17282 CVE-2018-19108 CVE-2018-19607 CVE-2018-9305 CVE-2019-13114 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for exiv2 fixes the following issues: exiv2 was updated to latest 0.26 branch, fixing bugs and security issues: - CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873). - CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973). - CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which might have led to an out-of-bounds read (bsc#1097600). - CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have led to memory corruption (bsc#1097599). - CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175). - CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176). - CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299). - CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have led to infinite loop (bsc#1115364). - CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial of service (bsc#1117513). - CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to to information leak or denial of service (bsc#1088424). - CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via a crafted response of an malicious http server (bsc#1142684). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-482=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): exiv2-0.26-lp151.7.3.1 exiv2-debuginfo-0.26-lp151.7.3.1 exiv2-debugsource-0.26-lp151.7.3.1 libexiv2-26-0.26-lp151.7.3.1 libexiv2-26-debuginfo-0.26-lp151.7.3.1 libexiv2-devel-0.26-lp151.7.3.1 libexiv2-doc-0.26-lp151.7.3.1 - openSUSE Leap 15.1 (x86_64): libexiv2-26-32bit-0.26-lp151.7.3.1 libexiv2-26-32bit-debuginfo-0.26-lp151.7.3.1 - openSUSE Leap 15.1 (noarch): exiv2-lang-0.26-lp151.7.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000126.html https://www.suse.com/security/cve/CVE-2017-9239.html https://www.suse.com/security/cve/CVE-2018-12264.html https://www.suse.com/security/cve/CVE-2018-12265.html https://www.suse.com/security/cve/CVE-2018-17229.html https://www.suse.com/security/cve/CVE-2018-17230.html https://www.suse.com/security/cve/CVE-2018-17282.html https://www.suse.com/security/cve/CVE-2018-19108.html https://www.suse.com/security/cve/CVE-2018-19607.html https://www.suse.com/security/cve/CVE-2018-9305.html https://www.suse.com/security/cve/CVE-2019-13114.html https://bugzilla.suse.com/1040973 https://bugzilla.suse.com/1068873 https://bugzilla.suse.com/1088424 https://bugzilla.suse.com/1097599 https://bugzilla.suse.com/1097600 https://bugzilla.suse.com/1109175 https://bugzilla.suse.com/1109176 https://bugzilla.suse.com/1109299 https://bugzilla.suse.com/1115364 https://bugzilla.suse.com/1117513 https://bugzilla.suse.com/1142684 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0479-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 08 Apr '20

08 Apr '20

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0479-1 Rating: moderate References: #1166751 Cross-References: CVE-2020-0556 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bluez fixes the following issues: - CVE-2020-0556: Fixed an improper access control which could have allowed an unauthenticated user to potentially enable escalation of privilege and denial of service (bsc#1166751). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-479=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bluez-5.48-lp151.8.12.1 bluez-cups-5.48-lp151.8.12.1 bluez-cups-debuginfo-5.48-lp151.8.12.1 bluez-debuginfo-5.48-lp151.8.12.1 bluez-debugsource-5.48-lp151.8.12.1 bluez-devel-5.48-lp151.8.12.1 bluez-test-5.48-lp151.8.12.1 bluez-test-debuginfo-5.48-lp151.8.12.1 libbluetooth3-5.48-lp151.8.12.1 libbluetooth3-debuginfo-5.48-lp151.8.12.1 - openSUSE Leap 15.1 (x86_64): bluez-devel-32bit-5.48-lp151.8.12.1 libbluetooth3-32bit-5.48-lp151.8.12.1 libbluetooth3-32bit-debuginfo-5.48-lp151.8.12.1 - openSUSE Leap 15.1 (noarch): bluez-auto-enable-devices-5.48-lp151.8.12.1 References: https://www.suse.com/security/cve/CVE-2020-0556.html https://bugzilla.suse.com/1166751 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0468-1: important: Security update for qemu
by opensuse-security＠opensuse.org 07 Apr '20

07 Apr '20

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0468-1 Rating: important References: #1123156 #1154790 #1161066 #1162729 #1163018 #1165776 #1166240 #1166379 Cross-References: CVE-2019-15034 CVE-2019-20382 CVE-2019-6778 CVE-2020-1711 CVE-2020-7039 CVE-2020-8608 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: - CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066). - CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379). - CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240). - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156). - CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018). - CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776). - Fixed a live migration error (bsc#1154790). - Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-468=1 Package List: - openSUSE Leap 15.1 (x86_64): qemu-3.1.1.1-lp151.7.12.1 qemu-arm-3.1.1.1-lp151.7.12.1 qemu-arm-debuginfo-3.1.1.1-lp151.7.12.1 qemu-audio-alsa-3.1.1.1-lp151.7.12.1 qemu-audio-alsa-debuginfo-3.1.1.1-lp151.7.12.1 qemu-audio-oss-3.1.1.1-lp151.7.12.1 qemu-audio-oss-debuginfo-3.1.1.1-lp151.7.12.1 qemu-audio-pa-3.1.1.1-lp151.7.12.1 qemu-audio-pa-debuginfo-3.1.1.1-lp151.7.12.1 qemu-audio-sdl-3.1.1.1-lp151.7.12.1 qemu-audio-sdl-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-curl-3.1.1.1-lp151.7.12.1 qemu-block-curl-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-dmg-3.1.1.1-lp151.7.12.1 qemu-block-dmg-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-gluster-3.1.1.1-lp151.7.12.1 qemu-block-gluster-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-iscsi-3.1.1.1-lp151.7.12.1 qemu-block-iscsi-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-nfs-3.1.1.1-lp151.7.12.1 qemu-block-nfs-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-rbd-3.1.1.1-lp151.7.12.1 qemu-block-rbd-debuginfo-3.1.1.1-lp151.7.12.1 qemu-block-ssh-3.1.1.1-lp151.7.12.1 qemu-block-ssh-debuginfo-3.1.1.1-lp151.7.12.1 qemu-debuginfo-3.1.1.1-lp151.7.12.1 qemu-debugsource-3.1.1.1-lp151.7.12.1 qemu-extra-3.1.1.1-lp151.7.12.1 qemu-extra-debuginfo-3.1.1.1-lp151.7.12.1 qemu-guest-agent-3.1.1.1-lp151.7.12.1 qemu-guest-agent-debuginfo-3.1.1.1-lp151.7.12.1 qemu-ksm-3.1.1.1-lp151.7.12.1 qemu-kvm-3.1.1.1-lp151.7.12.1 qemu-lang-3.1.1.1-lp151.7.12.1 qemu-linux-user-3.1.1.1-lp151.7.12.1 qemu-linux-user-debuginfo-3.1.1.1-lp151.7.12.1 qemu-linux-user-debugsource-3.1.1.1-lp151.7.12.1 qemu-ppc-3.1.1.1-lp151.7.12.1 qemu-ppc-debuginfo-3.1.1.1-lp151.7.12.1 qemu-s390-3.1.1.1-lp151.7.12.1 qemu-s390-debuginfo-3.1.1.1-lp151.7.12.1 qemu-tools-3.1.1.1-lp151.7.12.1 qemu-tools-debuginfo-3.1.1.1-lp151.7.12.1 qemu-ui-curses-3.1.1.1-lp151.7.12.1 qemu-ui-curses-debuginfo-3.1.1.1-lp151.7.12.1 qemu-ui-gtk-3.1.1.1-lp151.7.12.1 qemu-ui-gtk-debuginfo-3.1.1.1-lp151.7.12.1 qemu-ui-sdl-3.1.1.1-lp151.7.12.1 qemu-ui-sdl-debuginfo-3.1.1.1-lp151.7.12.1 qemu-x86-3.1.1.1-lp151.7.12.1 qemu-x86-debuginfo-3.1.1.1-lp151.7.12.1 - openSUSE Leap 15.1 (noarch): qemu-ipxe-1.0.0+-lp151.7.12.1 qemu-seabios-1.12.0-lp151.7.12.1 qemu-sgabios-8-lp151.7.12.1 qemu-vgabios-1.12.0-lp151.7.12.1 References: https://www.suse.com/security/cve/CVE-2019-15034.html https://www.suse.com/security/cve/CVE-2019-20382.html https://www.suse.com/security/cve/CVE-2019-6778.html https://www.suse.com/security/cve/CVE-2020-1711.html https://www.suse.com/security/cve/CVE-2020-7039.html https://www.suse.com/security/cve/CVE-2020-8608.html https://bugzilla.suse.com/1123156 https://bugzilla.suse.com/1154790 https://bugzilla.suse.com/1161066 https://bugzilla.suse.com/1162729 https://bugzilla.suse.com/1163018 https://bugzilla.suse.com/1165776 https://bugzilla.suse.com/1166240 https://bugzilla.suse.com/1166379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0467-1: important: Security update for glibc
by opensuse-security＠opensuse.org 06 Apr '20

06 Apr '20

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0467-1 Rating: important References: #1167631 Cross-References: CVE-2020-1752 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following issues: - CVE-2020-1752: Fixed a use after free in glob which could have allowed a local attacker to create a specially crafted path that, when processed by the glob function, could potentially have led to arbitrary code execution (bsc#1167631). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-467=1 Package List: - openSUSE Leap 15.1 (i586 i686 x86_64): glibc-2.26-lp151.19.11.1 glibc-debuginfo-2.26-lp151.19.11.1 glibc-debugsource-2.26-lp151.19.11.1 glibc-devel-2.26-lp151.19.11.1 glibc-devel-debuginfo-2.26-lp151.19.11.1 glibc-devel-static-2.26-lp151.19.11.1 glibc-locale-2.26-lp151.19.11.1 glibc-locale-base-2.26-lp151.19.11.1 glibc-locale-base-debuginfo-2.26-lp151.19.11.1 glibc-profile-2.26-lp151.19.11.1 - openSUSE Leap 15.1 (i586 x86_64): glibc-extra-2.26-lp151.19.11.1 glibc-extra-debuginfo-2.26-lp151.19.11.1 glibc-utils-2.26-lp151.19.11.1 glibc-utils-debuginfo-2.26-lp151.19.11.1 glibc-utils-src-debugsource-2.26-lp151.19.11.1 nscd-2.26-lp151.19.11.1 nscd-debuginfo-2.26-lp151.19.11.1 - openSUSE Leap 15.1 (x86_64): glibc-32bit-2.26-lp151.19.11.1 glibc-32bit-debuginfo-2.26-lp151.19.11.1 glibc-devel-32bit-2.26-lp151.19.11.1 glibc-devel-32bit-debuginfo-2.26-lp151.19.11.1 glibc-devel-static-32bit-2.26-lp151.19.11.1 glibc-locale-base-32bit-2.26-lp151.19.11.1 glibc-locale-base-32bit-debuginfo-2.26-lp151.19.11.1 glibc-profile-32bit-2.26-lp151.19.11.1 glibc-utils-32bit-2.26-lp151.19.11.1 glibc-utils-32bit-debuginfo-2.26-lp151.19.11.1 - openSUSE Leap 15.1 (noarch): glibc-html-2.26-lp151.19.11.1 glibc-i18ndata-2.26-lp151.19.11.1 glibc-info-2.26-lp151.19.11.1 References: https://www.suse.com/security/cve/CVE-2020-1752.html https://bugzilla.suse.com/1167631 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0461-1: critical: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 06 Apr '20

06 Apr '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0461-1 Rating: critical References: #1168630 Cross-References: CVE-2020-6819 CVE-2020-6820 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Mozilla Firefox was updated to 68.6.1esr to fix critical security issues: MFSA 2020-11 (boo#1168630) * CVE-2020-6819: Use-after-free while running the nsDocShell destructor * CVE-2020-6820: Use-after-free when handling a ReadableStream Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-461=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.6.1-lp151.2.39.1 MozillaFirefox-branding-upstream-68.6.1-lp151.2.39.1 MozillaFirefox-buildsymbols-68.6.1-lp151.2.39.1 MozillaFirefox-debuginfo-68.6.1-lp151.2.39.1 MozillaFirefox-debugsource-68.6.1-lp151.2.39.1 MozillaFirefox-devel-68.6.1-lp151.2.39.1 MozillaFirefox-translations-common-68.6.1-lp151.2.39.1 MozillaFirefox-translations-other-68.6.1-lp151.2.39.1 References: https://www.suse.com/security/cve/CVE-2020-6819.html https://www.suse.com/security/cve/CVE-2020-6820.html https://bugzilla.suse.com/1168630 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0459-1: important: Security update for icu
by opensuse-security＠opensuse.org 05 Apr '20

05 Apr '20

openSUSE Security Update: Security update for icu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0459-1 Rating: important References: #1166844 Cross-References: CVE-2020-10531 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icu fixes the following issues: - CVE-2020-10531: Fixed a potential integer overflow in UnicodeString:doAppend (bsc#1166844). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-459=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): icu-60.2-lp151.3.11.1 icu-debuginfo-60.2-lp151.3.11.1 icu-debugsource-60.2-lp151.3.11.1 libicu-devel-60.2-lp151.3.11.1 libicu-doc-60.2-lp151.3.11.1 libicu60_2-60.2-lp151.3.11.1 libicu60_2-debuginfo-60.2-lp151.3.11.1 - openSUSE Leap 15.1 (noarch): libicu60_2-bedata-60.2-lp151.3.11.1 libicu60_2-ledata-60.2-lp151.3.11.1 - openSUSE Leap 15.1 (x86_64): libicu-devel-32bit-60.2-lp151.3.11.1 libicu60_2-32bit-60.2-lp151.3.11.1 libicu60_2-32bit-debuginfo-60.2-lp151.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-10531.html https://bugzilla.suse.com/1166844 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0446-1: important: Security update for spamassassin
by opensuse-security＠opensuse.org 04 Apr '20

04 Apr '20

openSUSE Security Update: Security update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0446-1 Rating: important References: #1118987 #1162197 #1162200 #862963 Cross-References: CVE-2018-11805 CVE-2020-1930 CVE-2020-1931 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for spamassassin fixes the following issues: Security issues fixed: - CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987). - CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197). - CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200). Non-security issue fixed: - Altering hash requires restarting loop (bsc#862963). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-446=1 Package List: - openSUSE Leap 15.1 (x86_64): perl-Mail-SpamAssassin-3.4.2-lp151.8.3.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp151.8.3.1 spamassassin-3.4.2-lp151.8.3.1 spamassassin-debuginfo-3.4.2-lp151.8.3.1 spamassassin-debugsource-3.4.2-lp151.8.3.1 References: https://www.suse.com/security/cve/CVE-2018-11805.html https://www.suse.com/security/cve/CVE-2020-1930.html https://www.suse.com/security/cve/CVE-2020-1931.html https://bugzilla.suse.com/1118987 https://bugzilla.suse.com/1162197 https://bugzilla.suse.com/1162200 https://bugzilla.suse.com/862963 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0444-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 04 Apr '20

04 Apr '20

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0444-1 Rating: important References: #1168023 Cross-References: CVE-2020-11100 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy fixes the following issues: - CVE-2020-11100: Fixed an H2/HPAC vulnerability ch might have allowed arbitrary writes into a 32-bit relative address space (bsc#1168023). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-444=1 Package List: - openSUSE Leap 15.1 (x86_64): haproxy-2.0.10+git0.ac198b92-lp151.2.9.1 haproxy-debuginfo-2.0.10+git0.ac198b92-lp151.2.9.1 haproxy-debugsource-2.0.10+git0.ac198b92-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-11100.html https://bugzilla.suse.com/1168023 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0440-1: moderate: Security update for python-nltk
by opensuse-security＠opensuse.org 01 Apr '20

01 Apr '20

openSUSE Security Update: Security update for python-nltk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0440-1 Rating: moderate References: #1146427 Cross-References: CVE-2019-14751 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-nltk fixes the following issues: Update to 3.4.5 (boo#1146427, CVE-2019-14751): * CVE-2019-14751: Fixed Zip slip vulnerability in downloader for the unlikely situation where a user configures their downloader to use a compromised server (boo#1146427) Update to 3.4.4: * fix bug in plot function (probability.py) * add improved PanLex Swadesh corpus reader * add Text.generate() * add QuadgramAssocMeasures * add SSP to tokenizers * return confidence of best tag from AveragedPerceptron * make plot methods return Axes objects * don't require list arguments to PositiveNaiveBayesClassifier.train * fix Tree classes to work with native Python copy library * fix inconsistency for NomBank * fix random seeding in LanguageModel.generate * fix ConditionalFreqDist mutation on tabulate/plot call * fix broken links in documentation * fix misc Wordnet issues * update installation instructions Version update to 3.4.1: * add chomsky_normal_form for CFGs * add meteor score * add minimum edit/Levenshtein distance based alignment function * allow access to collocation list via text.collocation_list() * support corenlp server options * drop support for Python 3.4 * other minor fixes Update to v3.4: * Support Python 3.7 * New Language Modeling package * Cistem Stemmer for German * Support Russian National Corpus incl POS tag model * Krippendorf Alpha inter-rater reliability test * Comprehensive code clean-ups * Switch continuous integration from Jenkins to Travis Updated to v3.3: * Support Python 3.6 * New interface to CoreNLP * Support synset retrieval by sense key * Minor fixes to CoNLL Corpus Reader * AlignedSent * Fixed minor inconsistencies in APIs and API documentation * Better conformance to PEP8 * Drop Moses Tokenizer (incompatible license) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-440=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-nltk-3.4.5-bp151.4.3.1 python3-nltk-3.4.5-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-14751.html https://bugzilla.suse.com/1146427 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0438-1: moderate: Security update for ldns
by opensuse-security＠opensuse.org 01 Apr '20

01 Apr '20

openSUSE Security Update: Security update for ldns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0438-1 Rating: moderate References: #1068709 #1068711 Cross-References: CVE-2017-1000231 CVE-2017-1000232 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ldns fixes the following issues: - CVE-2017-1000231: Fixed a buffer overflow during token parsing (bsc#1068711). - CVE-2017-1000232: Fixed a double-free vulnerability in str2host.c (bsc#1068709). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-438=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ldns-1.7.0-lp151.4.3.1 ldns-debuginfo-1.7.0-lp151.4.3.1 ldns-debugsource-1.7.0-lp151.4.3.1 ldns-devel-1.7.0-lp151.4.3.1 libldns2-1.7.0-lp151.4.3.1 libldns2-debuginfo-1.7.0-lp151.4.3.1 perl-DNS-LDNS-1.7.0-lp151.4.3.1 perl-DNS-LDNS-debuginfo-1.7.0-lp151.4.3.1 python3-ldns-1.7.0-lp151.4.3.1 python3-ldns-debuginfo-1.7.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000231.html https://www.suse.com/security/cve/CVE-2017-1000232.html https://bugzilla.suse.com/1068709 https://bugzilla.suse.com/1068711 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0