April 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0510-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 12 Apr '20

12 Apr '20

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0510-1 Rating: moderate References: #1168699 Cross-References: CVE-2020-1730 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2020-1730: Fixed a possible denial of service when using AES-CTR (bsc#1168699). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-510=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libssh-debugsource-0.8.7-lp151.2.12.1 libssh-devel-0.8.7-lp151.2.12.1 libssh4-0.8.7-lp151.2.12.1 libssh4-debuginfo-0.8.7-lp151.2.12.1 - openSUSE Leap 15.1 (x86_64): libssh4-32bit-0.8.7-lp151.2.12.1 libssh4-32bit-debuginfo-0.8.7-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-1730.html https://bugzilla.suse.com/1168699 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0507-1: important: Security update for python-PyYAML
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for python-PyYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0507-1 Rating: important References: #1165439 Cross-References: CVE-2020-1747 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-PyYAML fixes the following issues: - CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-507=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python-PyYAML-debugsource-5.1.2-lp151.2.6.1 python2-PyYAML-5.1.2-lp151.2.6.1 python2-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python3-PyYAML-5.1.2-lp151.2.6.1 python3-PyYAML-debuginfo-5.1.2-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-1747.html https://bugzilla.suse.com/1165439 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0506-1: moderate: Security update for mgetty
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0506-1 Rating: moderate References: #1142770 #1168170 Cross-References: CVE-2019-1010190 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mgetty fixes the following issues: - CVE-2019-1010190: Fixed a denial of service which could be caused by a local attacker in putwhitespan() (bsc#1142770). - Fixed a permission issue which have resulted in build failures (bsc#1168170). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-506=1 Package List: - openSUSE Leap 15.1 (x86_64): g3utils-1.1.37-lp151.4.3.1 g3utils-debuginfo-1.1.37-lp151.4.3.1 mgetty-1.1.37-lp151.4.3.1 mgetty-debuginfo-1.1.37-lp151.4.3.1 mgetty-debugsource-1.1.37-lp151.4.3.1 sendfax-1.1.37-lp151.4.3.1 sendfax-debuginfo-1.1.37-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-1010190.html https://bugzilla.suse.com/1142770 https://bugzilla.suse.com/1168170 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0501-1: moderate: Security update for gmp, gnutls, libnettle
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for gmp, gnutls, libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0501-1 Rating: moderate References: #1152692 #1155327 #1166881 #1168345 Cross-References: CVE-2020-11501 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for gmp, gnutls, libnettle fixes the following issues: Security issue fixed: - CVE-2020-11501: Fixed zero random value in DTLS client hello (bsc#1168345) FIPS related bugfixes: - FIPS: Install checksums for binary integrity verification which are required when running in FIPS mode (bsc#1152692, jsc#SLE-9518) - FIPS: Fixed a cfb8 decryption issue, no longer truncate output IV if input is shorter than block size. (bsc#1166881) - FIPS: Added Diffie Hellman public key verification test. (bsc#1155327) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-501=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gmp-debugsource-6.1.2-lp151.4.3.1 gmp-devel-6.1.2-lp151.4.3.1 gnutls-3.6.7-lp151.2.6.1 gnutls-debuginfo-3.6.7-lp151.2.6.1 gnutls-debugsource-3.6.7-lp151.2.6.1 gnutls-guile-3.6.7-lp151.2.6.1 gnutls-guile-debuginfo-3.6.7-lp151.2.6.1 libgmp10-6.1.2-lp151.4.3.1 libgmp10-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-6.1.2-lp151.4.3.1 libgmpxx4-debuginfo-6.1.2-lp151.4.3.1 libgnutls-dane-devel-3.6.7-lp151.2.6.1 libgnutls-dane0-3.6.7-lp151.2.6.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.6.1 libgnutls-devel-3.6.7-lp151.2.6.1 libgnutls30-3.6.7-lp151.2.6.1 libgnutls30-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-3.6.7-lp151.2.6.1 libgnutlsxx-devel-3.6.7-lp151.2.6.1 libgnutlsxx28-3.6.7-lp151.2.6.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.6.1 libhogweed4-3.4.1-lp151.2.3.2 libhogweed4-debuginfo-3.4.1-lp151.2.3.2 libnettle-debugsource-3.4.1-lp151.2.3.2 libnettle-devel-3.4.1-lp151.2.3.2 libnettle6-3.4.1-lp151.2.3.2 libnettle6-debuginfo-3.4.1-lp151.2.3.2 nettle-3.4.1-lp151.2.3.2 nettle-debuginfo-3.4.1-lp151.2.3.2 - openSUSE Leap 15.1 (x86_64): gmp-devel-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-32bit-6.1.2-lp151.4.3.1 libgmpxx4-32bit-debuginfo-6.1.2-lp151.4.3.1 libgnutls-devel-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.6.1 libhogweed4-32bit-3.4.1-lp151.2.3.2 libhogweed4-32bit-debuginfo-3.4.1-lp151.2.3.2 libnettle-devel-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-debuginfo-3.4.1-lp151.2.3.2 References: https://www.suse.com/security/cve/CVE-2020-11501.html https://bugzilla.suse.com/1152692 https://bugzilla.suse.com/1155327 https://bugzilla.suse.com/1166881 https://bugzilla.suse.com/1168345 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0500-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0500-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-500=1 Package List: - openSUSE Leap 15.1 (x86_64): nagios-4.4.5-lp151.5.4.1 nagios-contrib-4.4.5-lp151.5.4.1 nagios-debuginfo-4.4.5-lp151.5.4.1 nagios-debugsource-4.4.5-lp151.5.4.1 nagios-devel-4.4.5-lp151.5.4.1 nagios-www-4.4.5-lp151.5.4.1 nagios-www-dch-4.4.5-lp151.5.4.1 nagios-www-debuginfo-4.4.5-lp151.5.4.1 - openSUSE Leap 15.1 (noarch): nagios-theme-exfoliation-4.4.5-lp151.5.4.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0494-1: important: Security update for ceph
by opensuse-security＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0494-1 Rating: important References: #1166403 #1166484 Cross-References: CVE-2020-1759 CVE-2020-1760 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ceph fixes the following issues: - CVE-2020-1759: Fixed once reuse in msgr V2 secure mode (bsc#1166403) - CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting (bsc#1166484). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-494=1 Package List: - openSUSE Leap 15.1 (noarch): ceph-dashboard-e2e-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-grafana-dashboards-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-dashboard-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-diskprediction-cloud-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-diskprediction-local-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-k8sevents-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-rook-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-ssh-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-prometheus-alerts-14.2.5.389+gb0f23ac248-lp151.2.13.1 - openSUSE Leap 15.1 (x86_64): ceph-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-base-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-base-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-common-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-common-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-debugsource-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-fuse-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-fuse-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mds-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mds-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mgr-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mon-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-mon-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-osd-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-osd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-radosgw-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-radosgw-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-resource-agents-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 ceph-test-debugsource-14.2.5.389+gb0f23ac248-lp151.2.13.1 cephfs-shell-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs2-14.2.5.389+gb0f23ac248-lp151.2.13.1 libcephfs2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados-devel-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados2-14.2.5.389+gb0f23ac248-lp151.2.13.1 librados2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradospp-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper1-14.2.5.389+gb0f23ac248-lp151.2.13.1 libradosstriper1-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd1-14.2.5.389+gb0f23ac248-lp151.2.13.1 librbd1-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw2-14.2.5.389+gb0f23ac248-lp151.2.13.1 librgw2-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-ceph-argparse-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-cephfs-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-cephfs-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rados-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rados-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rbd-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rbd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rgw-14.2.5.389+gb0f23ac248-lp151.2.13.1 python3-rgw-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rados-objclass-devel-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-fuse-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-fuse-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-mirror-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-mirror-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-nbd-14.2.5.389+gb0f23ac248-lp151.2.13.1 rbd-nbd-debuginfo-14.2.5.389+gb0f23ac248-lp151.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-1759.html https://www.suse.com/security/cve/CVE-2020-1760.html https://bugzilla.suse.com/1166403 https://bugzilla.suse.com/1166484 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0493-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0493-1 Rating: important References: #1168874 Cross-References: CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 CVE-2020-6827 CVE-2020-6828 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues: - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method (bsc#1168874). - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images (bsc#1168874). - CVE-2020-6825: Fixed Memory safety bugs (bsc#1168874). - CVE-2020-6827: Custom Tabs could have the URI spoofed (bsc#1168874). - CVE-2020-6828: Preference overwrite via crafted Intent (bsc#1168874). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-493=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.7.0-lp151.2.42.1 MozillaFirefox-branding-upstream-68.7.0-lp151.2.42.1 MozillaFirefox-buildsymbols-68.7.0-lp151.2.42.1 MozillaFirefox-debuginfo-68.7.0-lp151.2.42.1 MozillaFirefox-debugsource-68.7.0-lp151.2.42.1 MozillaFirefox-devel-68.7.0-lp151.2.42.1 MozillaFirefox-translations-common-68.7.0-lp151.2.42.1 MozillaFirefox-translations-other-68.7.0-lp151.2.42.1 References: https://www.suse.com/security/cve/CVE-2020-6821.html https://www.suse.com/security/cve/CVE-2020-6822.html https://www.suse.com/security/cve/CVE-2020-6825.html https://www.suse.com/security/cve/CVE-2020-6827.html https://www.suse.com/security/cve/CVE-2020-6828.html https://bugzilla.suse.com/1168874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0490-1: moderate: Security update for gnuhealth
by opensuse-security＠opensuse.org 09 Apr '20

09 Apr '20

openSUSE Security Update: Security update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0490-1 Rating: moderate References: #1167126 #1167128 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - Fixed a local privilege escalation in gnuhealth-control, use of static tmp file/http transport (bsc#1167126) - Fixed a local DoS of backup functionality in gnuhealth-control due to use of static tmp files (bsc#1167128) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-490=1 Package List: - openSUSE Leap 15.1 (noarch): gnuhealth-3.4.1-lp151.2.11.1 References: https://bugzilla.suse.com/1167126 https://bugzilla.suse.com/1167128 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0491-1: moderate: Security update for exim
by opensuse-security＠opensuse.org 09 Apr '20

09 Apr '20

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0491-1 Rating: moderate References: #1154183 #1160726 Cross-References: CVE-2020-8015 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for exim fixes the following issues: - CVE-2020-8015: Fixed a local privilege escalation from user mail to root (boo#1154183). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-491=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.12.1 exim-debuginfo-4.88-lp151.4.12.1 exim-debugsource-4.88-lp151.4.12.1 eximon-4.88-lp151.4.12.1 eximon-debuginfo-4.88-lp151.4.12.1 eximstats-html-4.88-lp151.4.12.1 References: https://www.suse.com/security/cve/CVE-2020-8015.html https://bugzilla.suse.com/1154183 https://bugzilla.suse.com/1160726 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0482-1: moderate: Security update for exiv2
by opensuse-security＠opensuse.org 08 Apr '20

08 Apr '20

openSUSE Security Update: Security update for exiv2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0482-1 Rating: moderate References: #1040973 #1068873 #1088424 #1097599 #1097600 #1109175 #1109176 #1109299 #1115364 #1117513 #1142684 Cross-References: CVE-2017-1000126 CVE-2017-9239 CVE-2018-12264 CVE-2018-12265 CVE-2018-17229 CVE-2018-17230 CVE-2018-17282 CVE-2018-19108 CVE-2018-19607 CVE-2018-9305 CVE-2019-13114 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for exiv2 fixes the following issues: exiv2 was updated to latest 0.26 branch, fixing bugs and security issues: - CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873). - CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973). - CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which might have led to an out-of-bounds read (bsc#1097600). - CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have led to memory corruption (bsc#1097599). - CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175). - CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176). - CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299). - CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have led to infinite loop (bsc#1115364). - CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial of service (bsc#1117513). - CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to to information leak or denial of service (bsc#1088424). - CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via a crafted response of an malicious http server (bsc#1142684). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-482=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): exiv2-0.26-lp151.7.3.1 exiv2-debuginfo-0.26-lp151.7.3.1 exiv2-debugsource-0.26-lp151.7.3.1 libexiv2-26-0.26-lp151.7.3.1 libexiv2-26-debuginfo-0.26-lp151.7.3.1 libexiv2-devel-0.26-lp151.7.3.1 libexiv2-doc-0.26-lp151.7.3.1 - openSUSE Leap 15.1 (x86_64): libexiv2-26-32bit-0.26-lp151.7.3.1 libexiv2-26-32bit-debuginfo-0.26-lp151.7.3.1 - openSUSE Leap 15.1 (noarch): exiv2-lang-0.26-lp151.7.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000126.html https://www.suse.com/security/cve/CVE-2017-9239.html https://www.suse.com/security/cve/CVE-2018-12264.html https://www.suse.com/security/cve/CVE-2018-12265.html https://www.suse.com/security/cve/CVE-2018-17229.html https://www.suse.com/security/cve/CVE-2018-17230.html https://www.suse.com/security/cve/CVE-2018-17282.html https://www.suse.com/security/cve/CVE-2018-19108.html https://www.suse.com/security/cve/CVE-2018-19607.html https://www.suse.com/security/cve/CVE-2018-9305.html https://www.suse.com/security/cve/CVE-2019-13114.html https://bugzilla.suse.com/1040973 https://bugzilla.suse.com/1068873 https://bugzilla.suse.com/1088424 https://bugzilla.suse.com/1097599 https://bugzilla.suse.com/1097600 https://bugzilla.suse.com/1109175 https://bugzilla.suse.com/1109176 https://bugzilla.suse.com/1109299 https://bugzilla.suse.com/1115364 https://bugzilla.suse.com/1117513 https://bugzilla.suse.com/1142684 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0