April 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0534-1: moderate: Security update for gnuhealth
by opensuse-security＠opensuse.org 17 Apr '20

17 Apr '20

openSUSE Security Update: Security update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0534-1 Rating: moderate References: #1167126 #1167128 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - Fixed a local privilege escalation in gnuhealth-control, use of static tmp file/http transport (bsc#1167126) - Fixed a local DoS of backup functionality in gnuhealth-control due to use of static tmp files (bsc#1167128) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-534=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): gnuhealth-3.4.1-bp151.3.9.4 References: https://bugzilla.suse.com/1167126 https://bugzilla.suse.com/1167128 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0524-1: important: Security update for git
by opensuse-security＠opensuse.org 16 Apr '20

16 Apr '20

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0524-1 Rating: important References: #1168930 Cross-References: CVE-2020-5260 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: - CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host (bsc#1168930). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-524=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): git-2.16.4-lp151.4.6.1 git-arch-2.16.4-lp151.4.6.1 git-core-2.16.4-lp151.4.6.1 git-core-debuginfo-2.16.4-lp151.4.6.1 git-credential-gnome-keyring-2.16.4-lp151.4.6.1 git-credential-gnome-keyring-debuginfo-2.16.4-lp151.4.6.1 git-credential-libsecret-2.16.4-lp151.4.6.1 git-credential-libsecret-debuginfo-2.16.4-lp151.4.6.1 git-cvs-2.16.4-lp151.4.6.1 git-daemon-2.16.4-lp151.4.6.1 git-daemon-debuginfo-2.16.4-lp151.4.6.1 git-debuginfo-2.16.4-lp151.4.6.1 git-debugsource-2.16.4-lp151.4.6.1 git-email-2.16.4-lp151.4.6.1 git-gui-2.16.4-lp151.4.6.1 git-p4-2.16.4-lp151.4.6.1 git-svn-2.16.4-lp151.4.6.1 git-svn-debuginfo-2.16.4-lp151.4.6.1 git-web-2.16.4-lp151.4.6.1 gitk-2.16.4-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): git-doc-2.16.4-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-5260.html https://bugzilla.suse.com/1168930 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0523-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 16 Apr '20

16 Apr '20

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0523-1 Rating: moderate References: #1137479 #1142542 #1142690 #1144453 #1153452 #1154231 #1154232 #1154830 #1157968 #1157969 Cross-References: CVE-2019-10206 CVE-2019-10217 CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 CVE-2019-14864 CVE-2019-14904 CVE-2019-14905 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for ansible to version 2.9.6 fixes the following issues: Security issues fixed: - CVE-2019-14904: Fixed a vulnerability in solaris_zone module via crafted solaris zone (boo#1157968). - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxos_file_copy module (boo#1157969). - CVE-2019-14864: Fixed Splunk and Sumologic callback plugins leak sensitive data in logs (boo#1154830). - CVE-2019-14846: Fixed secrets disclosure on logs due to display is hardcoded to DEBUG level (boo#1153452) - CVE-2019-14856: Fixed insufficient fix for CVE-2019-10206 (boo#1154232) - CVE-2019-14858: Fixed data in the sub parameter fields that will not be masked and will be displayed when run with increased verbosity (boo#1154231) - CVE-2019-10206: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. (boo#1142690) - CVE-2019-10217: Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. (boo#1144453) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-523=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): ansible-2.9.6-bp151.3.6.1 ansible-doc-2.9.6-bp151.3.6.1 ansible-test-2.9.6-bp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-10206.html https://www.suse.com/security/cve/CVE-2019-10217.html https://www.suse.com/security/cve/CVE-2019-14846.html https://www.suse.com/security/cve/CVE-2019-14856.html https://www.suse.com/security/cve/CVE-2019-14858.html https://www.suse.com/security/cve/CVE-2019-14864.html https://www.suse.com/security/cve/CVE-2019-14904.html https://www.suse.com/security/cve/CVE-2019-14905.html https://bugzilla.suse.com/1137479 https://bugzilla.suse.com/1142542 https://bugzilla.suse.com/1142690 https://bugzilla.suse.com/1144453 https://bugzilla.suse.com/1153452 https://bugzilla.suse.com/1154231 https://bugzilla.suse.com/1154232 https://bugzilla.suse.com/1154830 https://bugzilla.suse.com/1157968 https://bugzilla.suse.com/1157969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0522-1: moderate: Security update for mp3gain
by opensuse-security＠opensuse.org 15 Apr '20

15 Apr '20

openSUSE Security Update: Security update for mp3gain ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0522-1 Rating: moderate References: #1154971 Cross-References: CVE-2017-12911 CVE-2019-18359 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mp3gain fixes the following issues: Update to version 1.6.2. - CVE-2019-18359: Fixed a buffer over-read was discovered in ReadMP3APETag (boo#1154971) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-522=1 Package List: - openSUSE Leap 15.1 (x86_64): mp3gain-1.6.2-lp151.3.3.1 mp3gain-debuginfo-1.6.2-lp151.3.3.1 mp3gain-debugsource-1.6.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-12911.html https://www.suse.com/security/cve/CVE-2019-18359.html https://bugzilla.suse.com/1154971 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0519-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Apr '20

15 Apr '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0519-1 Rating: important References: #1167465 #1168421 #1168911 Cross-References: CVE-2020-6423 CVE-2020-6430 CVE-2020-6431 CVE-2020-6432 CVE-2020-6433 CVE-2020-6434 CVE-2020-6435 CVE-2020-6436 CVE-2020-6437 CVE-2020-6438 CVE-2020-6439 CVE-2020-6440 CVE-2020-6441 CVE-2020-6442 CVE-2020-6443 CVE-2020-6444 CVE-2020-6445 CVE-2020-6446 CVE-2020-6447 CVE-2020-6448 CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 CVE-2020-6454 CVE-2020-6455 CVE-2020-6456 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 81.0.4044.92 boo#1168911: * CVE-2020-6454: Use after free in extensions * CVE-2020-6423: Use after free in audio * CVE-2020-6455: Out of bounds read in WebSQL * CVE-2020-6430: Type Confusion in V8 * CVE-2020-6456: Insufficient validation of untrusted input in clipboard * CVE-2020-6431: Insufficient policy enforcement in full screen * CVE-2020-6432: Insufficient policy enforcement in navigations * CVE-2020-6433: Insufficient policy enforcement in extensions * CVE-2020-6434: Use after free in devtools * CVE-2020-6435: Insufficient policy enforcement in extensions * CVE-2020-6436: Use after free in window management * CVE-2020-6437: Inappropriate implementation in WebView * CVE-2020-6438: Insufficient policy enforcement in extensions * CVE-2020-6439: Insufficient policy enforcement in navigations * CVE-2020-6440: Inappropriate implementation in extensions * CVE-2020-6441: Insufficient policy enforcement in omnibox * CVE-2020-6442: Inappropriate implementation in cache * CVE-2020-6443: Insufficient data validation in developer tools * CVE-2020-6444: Uninitialized Use in WebRTC * CVE-2020-6445: Insufficient policy enforcement in trusted types * CVE-2020-6446: Insufficient policy enforcement in trusted types * CVE-2020-6447: Inappropriate implementation in developer tools * CVE-2020-6448: Use after free in V8 Chromium was updated to 80.0.3987.162 boo#1168421: * CVE-2020-6450: Use after free in WebAudio. * CVE-2020-6451: Use after free in WebAudio. * CVE-2020-6452: Heap buffer overflow in media. - Use a symbolic icon for GNOME Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-519=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-81.0.4044.92-lp151.2.77.1 chromedriver-debuginfo-81.0.4044.92-lp151.2.77.1 chromium-81.0.4044.92-lp151.2.77.1 chromium-debuginfo-81.0.4044.92-lp151.2.77.1 chromium-debugsource-81.0.4044.92-lp151.2.77.1 References: https://www.suse.com/security/cve/CVE-2020-6423.html https://www.suse.com/security/cve/CVE-2020-6430.html https://www.suse.com/security/cve/CVE-2020-6431.html https://www.suse.com/security/cve/CVE-2020-6432.html https://www.suse.com/security/cve/CVE-2020-6433.html https://www.suse.com/security/cve/CVE-2020-6434.html https://www.suse.com/security/cve/CVE-2020-6435.html https://www.suse.com/security/cve/CVE-2020-6436.html https://www.suse.com/security/cve/CVE-2020-6437.html https://www.suse.com/security/cve/CVE-2020-6438.html https://www.suse.com/security/cve/CVE-2020-6439.html https://www.suse.com/security/cve/CVE-2020-6440.html https://www.suse.com/security/cve/CVE-2020-6441.html https://www.suse.com/security/cve/CVE-2020-6442.html https://www.suse.com/security/cve/CVE-2020-6443.html https://www.suse.com/security/cve/CVE-2020-6444.html https://www.suse.com/security/cve/CVE-2020-6445.html https://www.suse.com/security/cve/CVE-2020-6446.html https://www.suse.com/security/cve/CVE-2020-6447.html https://www.suse.com/security/cve/CVE-2020-6448.html https://www.suse.com/security/cve/CVE-2020-6450.html https://www.suse.com/security/cve/CVE-2020-6451.html https://www.suse.com/security/cve/CVE-2020-6452.html https://www.suse.com/security/cve/CVE-2020-6454.html https://www.suse.com/security/cve/CVE-2020-6455.html https://www.suse.com/security/cve/CVE-2020-6456.html https://bugzilla.suse.com/1167465 https://bugzilla.suse.com/1168421 https://bugzilla.suse.com/1168911 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0520-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 15 Apr '20

15 Apr '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0520-1 Rating: important References: #1168630 #1168874 Cross-References: CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.7.0 fixes the following issues: - CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630) - CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630) - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874) - CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874) - CVE-2020-6825: Memory safety bugs fixed (boo#1168874) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-520=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.7.0-lp151.2.31.1 MozillaThunderbird-debuginfo-68.7.0-lp151.2.31.1 MozillaThunderbird-debugsource-68.7.0-lp151.2.31.1 MozillaThunderbird-translations-common-68.7.0-lp151.2.31.1 MozillaThunderbird-translations-other-68.7.0-lp151.2.31.1 References: https://www.suse.com/security/cve/CVE-2020-6819.html https://www.suse.com/security/cve/CVE-2020-6820.html https://www.suse.com/security/cve/CVE-2020-6821.html https://www.suse.com/security/cve/CVE-2020-6822.html https://www.suse.com/security/cve/CVE-2020-6825.html https://bugzilla.suse.com/1168630 https://bugzilla.suse.com/1168874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0517-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 14 Apr '20

14 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0517-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-517=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): nagios-4.4.5-bp151.4.3.1 nagios-contrib-4.4.5-bp151.4.3.1 nagios-devel-4.4.5-bp151.4.3.1 nagios-www-4.4.5-bp151.4.3.1 nagios-www-dch-4.4.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): nagios-theme-exfoliation-4.4.5-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0513-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0513-1 Rating: moderate References: #1137479 #1142542 #1142690 #1144453 #1153452 #1154231 #1154232 #1154830 #1157968 #1157969 Cross-References: CVE-2019-10206 CVE-2019-10217 CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 CVE-2019-14864 CVE-2019-14904 CVE-2019-14905 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for ansible to version 2.9.6 fixes the following issues: Security issues fixed: - CVE-2019-14904: Fixed a vulnerability in solaris_zone module via crafted solaris zone (boo#1157968). - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxos_file_copy module (boo#1157969). - CVE-2019-14864: Fixed Splunk and Sumologic callback plugins leak sensitive data in logs (boo#1154830). - CVE-2019-14846: Fixed secrets disclosure on logs due to display is hardcoded to DEBUG level (boo#1153452) - CVE-2019-14856: Fixed insufficient fix for CVE-2019-10206 (boo#1154232) - CVE-2019-14858: Fixed data in the sub parameter fields that will not be masked and will be displayed when run with increased verbosity (boo#1154231) - CVE-2019-10206: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. (boo#1142690) - CVE-2019-10217: Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. (boo#1144453) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-513=1 Package List: - openSUSE Leap 15.1 (noarch): ansible-2.9.6-lp151.2.7.1 ansible-doc-2.9.6-lp151.2.7.1 ansible-test-2.9.6-lp151.2.7.1 References: https://www.suse.com/security/cve/CVE-2019-10206.html https://www.suse.com/security/cve/CVE-2019-10217.html https://www.suse.com/security/cve/CVE-2019-14846.html https://www.suse.com/security/cve/CVE-2019-14856.html https://www.suse.com/security/cve/CVE-2019-14858.html https://www.suse.com/security/cve/CVE-2019-14864.html https://www.suse.com/security/cve/CVE-2019-14904.html https://www.suse.com/security/cve/CVE-2019-14905.html https://bugzilla.suse.com/1137479 https://bugzilla.suse.com/1142542 https://bugzilla.suse.com/1142690 https://bugzilla.suse.com/1144453 https://bugzilla.suse.com/1153452 https://bugzilla.suse.com/1154231 https://bugzilla.suse.com/1154232 https://bugzilla.suse.com/1154830 https://bugzilla.suse.com/1157968 https://bugzilla.suse.com/1157969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0511-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0511-1 Rating: moderate References: #1168364 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Fixed spelling of icinga group (bsc#1168364) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-511=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.18.1 permissions-debuginfo-20181116-lp151.4.18.1 permissions-debugsource-20181116-lp151.4.18.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.18.1 References: https://bugzilla.suse.com/1168364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0512-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0512-1 Rating: important References: #1167465 #1168421 Cross-References: CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: chromium was updated to 80.0.3987.162 boo#1168421: * CVE-2020-6450: Use after free in WebAudio. * CVE-2020-6451: Use after free in WebAudio. * CVE-2020-6452: Heap buffer overflow in media. - Use a symbolic icon for GNOME Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-512=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-80.0.3987.162-44.1 chromium-80.0.3987.162-44.1 References: https://www.suse.com/security/cve/CVE-2020-6450.html https://www.suse.com/security/cve/CVE-2020-6451.html https://www.suse.com/security/cve/CVE-2020-6452.html https://bugzilla.suse.com/1167465 https://bugzilla.suse.com/1168421 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0