May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0746-1: Security update for libmspack
by opensuse-security＠opensuse.org 31 May '20

31 May '20

openSUSE Security Update: Security update for libmspack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0746-1 Rating: low References: #1130489 #1141680 Cross-References: CVE-2019-1010305 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libmspack fixes the following issues: Security issue fixed: - CVE-2019-1010305: Fixed a buffer overflow triggered by a crafted chm file which could have led to information disclosure (bsc#1141680). Other issue addressed: - Enable build-time tests (bsc#1130489) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-746=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmspack-debugsource-0.6-lp151.4.3.1 libmspack-devel-0.6-lp151.4.3.1 libmspack0-0.6-lp151.4.3.1 libmspack0-debuginfo-0.6-lp151.4.3.1 mspack-tools-0.6-lp151.4.3.1 mspack-tools-debuginfo-0.6-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libmspack0-32bit-0.6-lp151.4.3.1 libmspack0-32bit-debuginfo-0.6-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-1010305.html https://bugzilla.suse.com/1130489 https://bugzilla.suse.com/1141680 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0741-1: moderate: Security update for freetds
by opensuse-security＠opensuse.org 29 May '20

29 May '20

openSUSE Security Update: Security update for freetds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0741-1 Rating: moderate References: #1141132 Cross-References: CVE-2019-13508 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freetds to 1.1.36 fixes the following issues: Security issue fixed: - CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 (bsc#1141132). Non-security issues fixed: - Enabled Kerberos support - Version update to 1.1.36: * Default TDS protocol version is now "auto" * Improved UTF-8 performances * TDS Pool Server is enabled * MARS support is enabled * NTLMv2 is enabled * See NEWS and ChangeLog for a complete list of changes This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-741=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetds-config-1.1.36-lp151.3.3.1 freetds-debuginfo-1.1.36-lp151.3.3.1 freetds-debugsource-1.1.36-lp151.3.3.1 freetds-devel-1.1.36-lp151.3.3.1 freetds-doc-1.1.36-lp151.3.3.1 freetds-tools-1.1.36-lp151.3.3.1 freetds-tools-debuginfo-1.1.36-lp151.3.3.1 libct4-1.1.36-lp151.3.3.1 libct4-debuginfo-1.1.36-lp151.3.3.1 libsybdb5-1.1.36-lp151.3.3.1 libsybdb5-debuginfo-1.1.36-lp151.3.3.1 libtdsodbc0-1.1.36-lp151.3.3.1 libtdsodbc0-debuginfo-1.1.36-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13508.html https://bugzilla.suse.com/1141132 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0744-1: moderate: Security update for trousers
by opensuse-security＠opensuse.org 29 May '20

29 May '20

openSUSE Security Update: Security update for trousers ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0744-1 Rating: moderate References: #1157651 Cross-References: CVE-2019-18898 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for trousers fixes the following issues: - CVE-2019-18898: Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package (bsc#1157651). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-744=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtspi1-0.3.14-lp151.4.6.1 libtspi1-debuginfo-0.3.14-lp151.4.6.1 trousers-0.3.14-lp151.4.6.1 trousers-debuginfo-0.3.14-lp151.4.6.1 trousers-debugsource-0.3.14-lp151.4.6.1 trousers-devel-0.3.14-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libtspi1-32bit-0.3.14-lp151.4.6.1 libtspi1-32bit-debuginfo-0.3.14-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-18898.html https://bugzilla.suse.com/1157651 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0734-1: Security update for jasper
by opensuse-security＠opensuse.org 29 May '20

29 May '20

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0734-1 Rating: low References: #1092115 Cross-References: CVE-2018-9154 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jasper fixes the following issues: - CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-734=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): jasper-2.0.14-lp151.4.6.1 jasper-debuginfo-2.0.14-lp151.4.6.1 jasper-debugsource-2.0.14-lp151.4.6.1 libjasper-devel-2.0.14-lp151.4.6.1 libjasper4-2.0.14-lp151.4.6.1 libjasper4-debuginfo-2.0.14-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libjasper4-32bit-2.0.14-lp151.4.6.1 libjasper4-32bit-debuginfo-2.0.14-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2018-9154.html https://bugzilla.suse.com/1092115 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0738-1: important: Security update for mariadb-connector-c
by opensuse-security＠opensuse.org 29 May '20

29 May '20

openSUSE Security Update: Security update for mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0738-1 Rating: important References: #1171550 Cross-References: CVE-2020-13249 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mariadb-connector-c fixes the following issues: Security issue fixed: - CVE-2020-13249: Fixed an improper validation of OK packets received from clients (bsc#1171550). Non-security issues fixed: - Update to release 3.1.8 (bsc#1171550) * CONC-304: Rename the static library to libmariadb.a and other libmariadb files in a consistent manner * CONC-441: Default user name for C/C is wrong if login user is different from effective user * CONC-449: Check $MARIADB_HOME/my.cnf in addition to $MYSQL_HOME/my.cnf * CONC-457: mysql_list_processes crashes in unpack_fields * CONC-458: mysql_get_timeout_value crashes when used improper * CONC-464: Fix static build for auth_gssapi_client plugin This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-738=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.8-lp151.3.12.1 libmariadb-devel-debuginfo-3.1.8-lp151.3.12.1 libmariadb3-3.1.8-lp151.3.12.1 libmariadb3-debuginfo-3.1.8-lp151.3.12.1 libmariadb_plugins-3.1.8-lp151.3.12.1 libmariadb_plugins-debuginfo-3.1.8-lp151.3.12.1 libmariadbprivate-3.1.8-lp151.3.12.1 libmariadbprivate-debuginfo-3.1.8-lp151.3.12.1 mariadb-connector-c-debugsource-3.1.8-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.8-lp151.3.12.1 libmariadb3-32bit-debuginfo-3.1.8-lp151.3.12.1 References: https://www.suse.com/security/cve/CVE-2020-13249.html https://bugzilla.suse.com/1171550 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0736-1: Security update for sysstat
by opensuse-security＠opensuse.org 29 May '20

29 May '20

openSUSE Security Update: Security update for sysstat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0736-1 Rating: low References: #1159104 Cross-References: CVE-2019-19725 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sysstat fixes the following issues: - CVE-2019-19725: Fixed double free in check_file_actlst in sa_common.c (bsc#1159104). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-736=1 Package List: - openSUSE Leap 15.1 (x86_64): sysstat-12.0.2-lp151.3.15.1 sysstat-debuginfo-12.0.2-lp151.3.15.1 sysstat-debugsource-12.0.2-lp151.3.15.1 sysstat-isag-12.0.2-lp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2019-19725.html https://bugzilla.suse.com/1159104 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0731-1: moderate: Security update for libxslt
by opensuse-security＠opensuse.org 28 May '20

28 May '20

openSUSE Security Update: Security update for libxslt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0731-1 Rating: moderate References: #1140095 #1140101 #1154609 Cross-References: CVE-2019-13117 CVE-2019-13118 CVE-2019-18197 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxslt fixes the following issues: Security issues fixed: - CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101). - CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095). - CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may have led to information disclosure (bsc#1154609). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-731=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxslt-debugsource-1.1.32-lp151.3.6.1 libxslt-devel-1.1.32-lp151.3.6.1 libxslt-tools-1.1.32-lp151.3.6.1 libxslt-tools-debuginfo-1.1.32-lp151.3.6.1 libxslt1-1.1.32-lp151.3.6.1 libxslt1-debuginfo-1.1.32-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): libxslt-devel-32bit-1.1.32-lp151.3.6.1 libxslt-python-1.1.32-lp151.3.6.1 libxslt-python-debuginfo-1.1.32-lp151.3.6.1 libxslt-python-debugsource-1.1.32-lp151.3.6.1 libxslt1-32bit-1.1.32-lp151.3.6.1 libxslt1-32bit-debuginfo-1.1.32-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-13117.html https://www.suse.com/security/cve/CVE-2019-13118.html https://www.suse.com/security/cve/CVE-2019-18197.html https://bugzilla.suse.com/1140095 https://bugzilla.suse.com/1140101 https://bugzilla.suse.com/1154609 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0719-1: important: Security update for dom4j
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0719-1 Rating: important References: #1169760 Cross-References: CVE-2020-10683 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-719=1 Package List: - openSUSE Leap 15.1 (noarch): dom4j-1.6.1-lp151.6.3.1 dom4j-demo-1.6.1-lp151.6.3.1 dom4j-javadoc-1.6.1-lp151.6.3.1 dom4j-manual-1.6.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-10683.html https://bugzilla.suse.com/1169760 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0721-1: moderate: Security update for memcached
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for memcached ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0721-1 Rating: moderate References: #1133817 #1149110 Cross-References: CVE-2019-11596 CVE-2019-15026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for memcached fixes the following issues: Security issue fixed: - CVE-2019-11596: Fixed a NULL pointer dereference in process_lru_command (bsc#1133817). - CVE-2019-15026: Fixed a stack-based buffer over-read (bsc#1149110). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-721=1 Package List: - openSUSE Leap 15.1 (x86_64): memcached-1.5.6-lp151.4.3.1 memcached-debuginfo-1.5.6-lp151.4.3.1 memcached-debugsource-1.5.6-lp151.4.3.1 memcached-devel-1.5.6-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-11596.html https://www.suse.com/security/cve/CVE-2019-15026.html https://bugzilla.suse.com/1133817 https://bugzilla.suse.com/1149110 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0720-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0720-1 Rating: important References: #1171456 #1171457 #1171458 Cross-References: CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 to 2.3.10 fixes the following issues: Security issues fixed: - CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457). - CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458). - CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456). Non-security issues fixed: - The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-720=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debugsource-2.3.10-lp151.2.9.1 dovecot23-devel-2.3.10-lp151.2.9.1 dovecot23-fts-2.3.10-lp151.2.9.1 dovecot23-fts-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-solr-2.3.10-lp151.2.9.1 dovecot23-fts-solr-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-squat-2.3.10-lp151.2.9.1 dovecot23-fts-squat-debuginfo-2.3.10-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-10957.html https://www.suse.com/security/cve/CVE-2020-10958.html https://www.suse.com/security/cve/CVE-2020-10967.html https://bugzilla.suse.com/1171456 https://bugzilla.suse.com/1171457 https://bugzilla.suse.com/1171458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0716-1: moderate: Security update for gcc9
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for gcc9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0716-1 Rating: moderate References: #1114592 #1135254 #1141897 #1142649 #1142654 #1148517 #1149145 #1149995 #1152590 #1167898 Cross-References: CVE-2019-14250 CVE-2019-15847 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on: https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages. To use it, install "gcc9" or "gcc9-c++" or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it. Security issues fixed: - CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145) - CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649) Non-security issues fixed: - Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254) - Fixed miscompilation for vector shift on s390. (bsc#1141897) - Includes a fix for Internal compiler error when building HepMC (bsc#1167898) - Includes fix for binutils version parsing - Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10. - Add gcc9 autodetect -g at lto link (bsc#1149995) - Install go tool buildid for bootstrapping go Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-716=1 Package List: - openSUSE Leap 15.1 (noarch): gcc9-info-9.3.1+git1296-lp151.2.2 - openSUSE Leap 15.1 (x86_64): cpp9-9.3.1+git1296-lp151.2.2 cpp9-debuginfo-9.3.1+git1296-lp151.2.2 cross-nvptx-gcc9-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debuginfo-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debugsource-9.3.1+git1296-lp151.2.1 cross-nvptx-newlib9-devel-9.3.1+git1296-lp151.2.1 gcc9-32bit-9.3.1+git1296-lp151.2.2 gcc9-9.3.1+git1296-lp151.2.2 gcc9-ada-32bit-9.3.1+git1296-lp151.2.2 gcc9-ada-9.3.1+git1296-lp151.2.2 gcc9-ada-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-c++-32bit-9.3.1+git1296-lp151.2.2 gcc9-c++-9.3.1+git1296-lp151.2.2 gcc9-c++-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debugsource-9.3.1+git1296-lp151.2.2 gcc9-fortran-32bit-9.3.1+git1296-lp151.2.2 gcc9-fortran-9.3.1+git1296-lp151.2.2 gcc9-fortran-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-go-32bit-9.3.1+git1296-lp151.2.2 gcc9-go-9.3.1+git1296-lp151.2.2 gcc9-go-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-locale-9.3.1+git1296-lp151.2.2 libada9-32bit-9.3.1+git1296-lp151.2.2 libada9-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libada9-9.3.1+git1296-lp151.2.2 libada9-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-32bit-9.3.1+git1296-lp151.2.2 libasan5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-9.3.1+git1296-lp151.2.2 libasan5-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-32bit-9.3.1+git1296-lp151.2.2 libatomic1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-9.3.1+git1296-lp151.2.2 libatomic1-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-9.3.1+git1296-lp151.2.2 libgcc_s1-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-9.3.1+git1296-lp151.2.2 libgfortran5-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-32bit-9.3.1+git1296-lp151.2.2 libgo14-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-9.3.1+git1296-lp151.2.2 libgo14-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-32bit-9.3.1+git1296-lp151.2.2 libgomp1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-9.3.1+git1296-lp151.2.2 libgomp1-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-32bit-9.3.1+git1296-lp151.2.2 libitm1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-9.3.1+git1296-lp151.2.2 libitm1-debuginfo-9.3.1+git1296-lp151.2.2 liblsan0-9.3.1+git1296-lp151.2.2 liblsan0-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-9.3.1+git1296-lp151.2.2 libquadmath0-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-9.3.1+git1296-lp151.2.2 libstdc++6-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-9.3.1+git1296-lp151.2.2 libstdc++6-locale-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-9.3.1+git1296-lp151.2.2 libtsan0-9.3.1+git1296-lp151.2.2 libtsan0-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-32bit-9.3.1+git1296-lp151.2.2 libubsan1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-9.3.1+git1296-lp151.2.2 libubsan1-debuginfo-9.3.1+git1296-lp151.2.2 References: https://www.suse.com/security/cve/CVE-2019-14250.html https://www.suse.com/security/cve/CVE-2019-15847.html https://bugzilla.suse.com/1114592 https://bugzilla.suse.com/1135254 https://bugzilla.suse.com/1141897 https://bugzilla.suse.com/1142649 https://bugzilla.suse.com/1142654 https://bugzilla.suse.com/1148517 https://bugzilla.suse.com/1149145 https://bugzilla.suse.com/1149995 https://bugzilla.suse.com/1152590 https://bugzilla.suse.com/1167898 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0711-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 25 May '20

25 May '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0711-1 Rating: important References: #1171928 Cross-References: CVE-2020-9484 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt ) * CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a remote code execution via deserialization of the file under their control. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-711=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.35-lp151.3.18.1 tomcat-admin-webapps-9.0.35-lp151.3.18.1 tomcat-docs-webapp-9.0.35-lp151.3.18.1 tomcat-el-3_0-api-9.0.35-lp151.3.18.1 tomcat-embed-9.0.35-lp151.3.18.1 tomcat-javadoc-9.0.35-lp151.3.18.1 tomcat-jsp-2_3-api-9.0.35-lp151.3.18.1 tomcat-jsvc-9.0.35-lp151.3.18.1 tomcat-lib-9.0.35-lp151.3.18.1 tomcat-servlet-4_0-api-9.0.35-lp151.3.18.1 tomcat-webapps-9.0.35-lp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-9484.html https://bugzilla.suse.com/1171928 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0709-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 May '20

24 May '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0709-1 Rating: important References: Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 68.0.3618.104 - CHR-7909 Update chromium on desktop-stable-81-3618 to 81.0.4044.138 - CVE-2020-6831, CVE-2020-6464 - DNA-85609 [Mac] Tabs shrinking & disappearing - DNA-85629 Crash at opera::DownloadButtonPanel::ShouldShowCancelButton() - DNA-85669 Add mocking of AddressDropdownModel in AddressBarControllerTest - DNA-85678 Wrong badge icon on pages with mixed content on desktop-stable-81-3618 - DNA-85820 Flags are blue in default [D] state after restart - DNA-85822 Full screen snap on pkobp.pl - DNA-86077 Problem to upload .JPG file as an wallpaper - DNA-86165 Downloads list doesn’t returns to its original state after clearing search filter - DNA-86236 [Mac] Plus button click area too small - DNA-86241 X tab button is not visible - DNA-86217 Fix performance issue with Background Worker Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-709=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-68.0.3618.104-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0703-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0703-1 Rating: moderate References: #1100053 #1133997 #1134001 Cross-References: CVE-2018-10886 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053). Non-security issues fixed: - Add rhino to the ant-apache-bsf optional tasks (bsc#1134001). - Remove jakarta-commons-logging dependencies (bsc#1133997). - Use apache-commons-logging in optional tasks This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-703=1 Package List: - openSUSE Leap 15.1 (noarch): ant-1.9.10-lp151.4.3.1 ant-antlr-1.9.10-lp151.4.3.1 ant-apache-bcel-1.9.10-lp151.4.3.1 ant-apache-bsf-1.9.10-lp151.4.3.1 ant-apache-log4j-1.9.10-lp151.4.3.1 ant-apache-oro-1.9.10-lp151.4.3.1 ant-apache-regexp-1.9.10-lp151.4.3.1 ant-apache-resolver-1.9.10-lp151.4.3.1 ant-apache-xalan2-1.9.10-lp151.4.3.1 ant-commons-logging-1.9.10-lp151.4.3.1 ant-commons-net-1.9.10-lp151.4.3.1 ant-javamail-1.9.10-lp151.4.3.1 ant-jdepend-1.9.10-lp151.4.3.1 ant-jmf-1.9.10-lp151.4.3.1 ant-jsch-1.9.10-lp151.4.3.1 ant-junit-1.9.10-lp151.4.3.1 ant-manual-1.9.10-lp151.4.3.1 ant-scripts-1.9.10-lp151.4.3.1 ant-swing-1.9.10-lp151.4.3.1 ant-testutil-1.9.10-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10886.html https://bugzilla.suse.com/1100053 https://bugzilla.suse.com/1133997 https://bugzilla.suse.com/1134001 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0704-1: moderate: Security update for freetype2
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: #1079603 #1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for freetype2 to version 2.10.1 fixes the following issues: Security issue fixed: - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c (bsc#1079603). Non-security issues fixed: - Update to version 2.10.1 * The bytecode hinting of OpenType variation fonts was flawed, since the data in the `CVAR' table wasn't correctly applied. * Auto-hinter support for Mongolian. * The handling of the default character in PCF fonts as introduced in version 2.10.0 was partially broken, causing premature abortion of charmap iteration for many fonts. * If `FT_Set_Named_Instance' was called with the same arguments twice in a row, the function returned an incorrect error code the second time. * Direct rendering using FT_RASTER_FLAG_DIRECT crashed (bug introduced in version 2.10.0). * Increased precision while computing OpenType font variation instances. * The flattening algorithm of cubic Bezier curves was slightly changed to make it faster. This can cause very subtle rendering changes, which aren't noticeable by the eye, however. * The auto-hinter now disables hinting if there are blue zones defined for a `style' (i.e., a certain combination of a script and its related typographic features) but the font doesn't contain any characters needed to set up at least one blue zone. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * A bunch of new functions has been added to access and process COLR/CPAL data of OpenType fonts with color-layered glyphs. * As a GSoC 2018 project, Nikhil Ramakrishnan completely overhauled and modernized the API reference. * The logic for computing the global ascender, descender, and height of OpenType fonts has been slightly adjusted for consistency. * `TT_Set_MM_Blend' could fail if called repeatedly with the same arguments. * The precision of handling deltas in Variation Fonts has been increased.The problem did only show up with multidimensional designspaces. * New function `FT_Library_SetLcdGeometry' to set up the geometry of LCD subpixels. * FreeType now uses the `defaultChar' property of PCF fonts to set the glyph for the undefined character at glyph index 0 (as FreeType already does for all other supported font formats). As a consequence, the order of glyphs of a PCF font if accessed with FreeType can be different now compared to previous versions. This change doesn't affect PCF font access with cmaps. * `FT_Select_Charmap' has been changed to allow parameter value `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT formats to access built-in cmaps that don't have a predefined `FT_Encoding' value. * A previously reserved field in the `FT_GlyphSlotRec' structure now holds the glyph index. * The usual round of fuzzer bug fixes to better reject malformed fonts. * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have been removed.These two functions were public by oversight only and were never documented. * A new function `FT_Error_String' returns descriptions of error codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is defined. * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new functions limited to Adobe MultiMaster fonts to directly set and get the weight vector. - Enable subpixel rendering with infinality config: - Re-enable freetype-config, there is just too many fallouts. - Update to version 2.9.1 * Type 1 fonts containing flex features were not rendered correctly (bug introduced in version 2.9). * CVE-2018-6942: Older FreeType versions can crash with certain malformed variation fonts. * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage. * Emboldening of bitmaps didn't work correctly sometimes, showing various artifacts (bug introduced in version 2.8.1). * The auto-hinter script ranges have been updated for Unicode 11. No support for new scripts have been added, however, with the exception of Georgian Mtavruli. - freetype-config is now deprecated by upstream and not enabled by default. - Update to version 2.10.1 * The `ftmulti' demo program now supports multiple hidden axes with the same name tag. * `ftview', `ftstring', and `ftgrid' got a `-k' command line option to emulate a sequence of keystrokes at start-up. * `ftview', `ftstring', and `ftgrid' now support screen dumping to a PNG file. * The bytecode debugger, `ttdebug', now supports variation TrueType fonts; a variation font instance can be selected with the new `-d' command line option. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * The `ftdump' demo program has new options `-c' and `-C' to display charmaps in compact and detailed format, respectively. Option `-V' has been removed. * The `ftview', `ftstring', and `ftgrid' demo programs use a new command line option `-d' to specify the program window's width, height, and color depth. * The `ftview' demo program now displays red boxes for zero-width glyphs. * `ftglyph' has limited support to display fonts with color-layered glyphs.This will be improved later on. * `ftgrid' can now display bitmap fonts also. * The `ttdebug' demo program has a new option `-f' to select a member of a TrueType collection (TTC). * Other various improvements to the demo programs. - Remove "Supplements: fonts-config" to avoid accidentally pulling in Qt dependencies on some non-Qt based desktops.(bsc#1091109) fonts-config is fundamental but ft2demos seldom installs by end users. only fonts-config maintainers/debuggers may use ft2demos along to debug some issues. - Update to version 2.9.1 * No changelog upstream. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-704=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetype2-debugsource-2.10.1-lp151.4.3.1 freetype2-devel-2.10.1-lp151.4.3.1 libfreetype6-2.10.1-lp151.4.3.1 libfreetype6-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): freetype2-devel-32bit-2.10.1-lp151.4.3.1 ft2demos-2.10.1-lp151.4.3.1 ftbench-2.10.1-lp151.4.3.1 ftdiff-2.10.1-lp151.4.3.1 ftdump-2.10.1-lp151.4.3.1 ftgamma-2.10.1-lp151.4.3.1 ftgrid-2.10.1-lp151.4.3.1 ftinspect-2.10.1-lp151.4.3.1 ftlint-2.10.1-lp151.4.3.1 ftmulti-2.10.1-lp151.4.3.1 ftstring-2.10.1-lp151.4.3.1 ftvalid-2.10.1-lp151.4.3.1 ftview-2.10.1-lp151.4.3.1 libfreetype6-32bit-2.10.1-lp151.4.3.1 libfreetype6-32bit-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): freetype2-profile-tti35-2.10.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-6942.html https://bugzilla.suse.com/1079603 https://bugzilla.suse.com/1091109 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0698-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0698-1 Rating: moderate References: #1171553 Cross-References: CVE-2020-10030 CVE-2020-10995 CVE-2020-12244 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: - update to 4.1.16 * fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553) * fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553) * fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553) For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-698=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-698=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-698=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-recursor-4.1.12-lp151.3.3.1 pdns-recursor-debuginfo-4.1.12-lp151.3.3.1 pdns-recursor-debugsource-4.1.12-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.12-bp151.4.3.1 pdns-recursor-debuginfo-4.1.12-bp151.4.3.1 pdns-recursor-debugsource-4.1.12-bp151.4.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.16-19.1 References: https://www.suse.com/security/cve/CVE-2020-10030.html https://www.suse.com/security/cve/CVE-2020-10995.html https://www.suse.com/security/cve/CVE-2020-12244.html https://bugzilla.suse.com/1171553 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0698-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0698-1 Rating: moderate References: #1171553 Cross-References: CVE-2020-10030 CVE-2020-10995 CVE-2020-12244 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns-recursor fixes the following issues: - update to 4.1.16 * fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553) * fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553) * fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553) For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-698=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-698=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-recursor-4.1.12-lp151.3.3.1 pdns-recursor-debuginfo-4.1.12-lp151.3.3.1 pdns-recursor-debugsource-4.1.12-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.12-bp151.4.3.1 pdns-recursor-debuginfo-4.1.12-bp151.4.3.1 pdns-recursor-debugsource-4.1.12-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-10030.html https://www.suse.com/security/cve/CVE-2020-10995.html https://www.suse.com/security/cve/CVE-2020-12244.html https://bugzilla.suse.com/1171553 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0682-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0682-1 Rating: moderate References: #1146648 #1169549 #1169573 #1169574 #1169575 #1169576 #1169578 #1169580 Cross-References: CVE-2020-11758 CVE-2020-11760 CVE-2020-11761 CVE-2020-11762 CVE-2020-11763 CVE-2020-11764 CVE-2020-11765 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for openexr provides the following fix: Security issues fixed: - CVE-2020-11765: Fixed an off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier (bsc#1169575). - CVE-2020-11764: Fixed an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574). - CVE-2020-11763: Fixed an out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp (bsc#1169576). - CVE-2020-11762: Fixed an out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case (bsc#1169549). - CVE-2020-11761: Fixed an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp (bsc#1169578). - CVE-2020-11760: Fixed an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp (bsc#1169580). - CVE-2020-11758: Fixed an out-of-bounds read in ImfOptimizedPixelReading.h (bsc#1169573). Non-security issue fixed: - Enable tests when building the package on x86_64. (bsc#1146648) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-682=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.9.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.9.1 openexr-2.2.1-lp151.4.9.1 openexr-debuginfo-2.2.1-lp151.4.9.1 openexr-debugsource-2.2.1-lp151.4.9.1 openexr-devel-2.2.1-lp151.4.9.1 openexr-doc-2.2.1-lp151.4.9.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.9.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.9.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-11758.html https://www.suse.com/security/cve/CVE-2020-11760.html https://www.suse.com/security/cve/CVE-2020-11761.html https://www.suse.com/security/cve/CVE-2020-11762.html https://www.suse.com/security/cve/CVE-2020-11763.html https://www.suse.com/security/cve/CVE-2020-11764.html https://www.suse.com/security/cve/CVE-2020-11765.html https://bugzilla.suse.com/1146648 https://bugzilla.suse.com/1169549 https://bugzilla.suse.com/1169573 https://bugzilla.suse.com/1169574 https://bugzilla.suse.com/1169575 https://bugzilla.suse.com/1169576 https://bugzilla.suse.com/1169578 https://bugzilla.suse.com/1169580 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0676-1: moderate: Security update for autoyast2
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0676-1 Rating: moderate References: #1109310 #1133045 #1140711 #1164105 #1168123 #1168281 #1170082 Cross-References: CVE-2019-18905 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all "--gpg-auto-import-keys" options from zypper commands (bsc#1140711). Non-security issue fixed: - Fix desktop files updating some icons and groups (bsc#1168123). - Restored some missing icons (bsc#1168123, bsc#1109310 and bsc#1168281). - Service for init scripts: Try to start "network-online.target" before starting the autoyast init scripts in order to get a working network (bsc#1164105). - Always re-probe storage after pre-scripts (bsc#1170082, bsc#1133045). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-676=1 Package List: - openSUSE Leap 15.1 (noarch): autoyast2-4.1.15-lp151.2.12.1 autoyast2-installation-4.1.15-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-18905.html https://bugzilla.suse.com/1109310 https://bugzilla.suse.com/1133045 https://bugzilla.suse.com/1140711 https://bugzilla.suse.com/1164105 https://bugzilla.suse.com/1168123 https://bugzilla.suse.com/1168281 https://bugzilla.suse.com/1170082 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0678-1: important: Security update for gstreamer-plugins-base
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for gstreamer-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0678-1 Rating: important References: #1133375 Cross-References: CVE-2019-9928 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-plugins-base fixes the following issue: Security issue fixed: - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-678=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gstreamer-plugins-base-1.12.5-lp151.3.3.1 gstreamer-plugins-base-debuginfo-1.12.5-lp151.3.3.1 gstreamer-plugins-base-debugsource-1.12.5-lp151.3.3.1 gstreamer-plugins-base-devel-1.12.5-lp151.3.3.1 gstreamer-plugins-base-doc-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstapp-1_0-0-1.12.5-lp151.3.3.1 libgstapp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstfft-1_0-0-1.12.5-lp151.3.3.1 libgstfft-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstriff-1_0-0-1.12.5-lp151.3.3.1 libgstriff-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgsttag-1_0-0-1.12.5-lp151.3.3.1 libgsttag-1_0-0-debuginfo-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-debuginfo-1.12.5-lp151.3.3.1 typelib-1_0-GstAllocators-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstApp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstAudio-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstFft-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstPbutils-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstRtp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstRtsp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstSdp-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstTag-1_0-1.12.5-lp151.3.3.1 typelib-1_0-GstVideo-1_0-1.12.5-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): gstreamer-plugins-base-lang-1.12.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): gstreamer-plugins-base-32bit-1.12.5-lp151.3.3.1 gstreamer-plugins-base-32bit-debuginfo-1.12.5-lp151.3.3.1 gstreamer-plugins-base-devel-32bit-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstallocators-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstapp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstapp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstaudio-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstfft-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstfft-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstpbutils-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstriff-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstriff-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstrtp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstrtsp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstsdp-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgsttag-1_0-0-32bit-1.12.5-lp151.3.3.1 libgsttag-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-32bit-1.12.5-lp151.3.3.1 libgstvideo-1_0-0-32bit-debuginfo-1.12.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9928.html https://bugzilla.suse.com/1133375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0680-1: moderate: Security update for libvpx
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libvpx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0680-1 Rating: moderate References: #1166066 Cross-References: CVE-2020-0034 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvpx fixes the following issues: - CVE-2020-0034: Fixed an out-of-bounds read on truncated key frames (bsc#1166066). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-680=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libvpx-debugsource-1.6.1-lp151.5.6.1 libvpx-devel-1.6.1-lp151.5.6.1 libvpx4-1.6.1-lp151.5.6.1 libvpx4-debuginfo-1.6.1-lp151.5.6.1 vpx-tools-1.6.1-lp151.5.6.1 vpx-tools-debuginfo-1.6.1-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libvpx4-32bit-1.6.1-lp151.5.6.1 libvpx4-32bit-debuginfo-1.6.1-lp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2020-0034.html https://bugzilla.suse.com/1166066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0681-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0681-1 Rating: moderate References: #1159928 #1161517 #1161521 Cross-References: CVE-2019-19956 CVE-2019-20388 CVE-2020-7595 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521). - CVE-2019-19956: Fixed a memory leak (bsc#1159928). - CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-681=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxml2-2-2.9.7-lp151.5.9.1 libxml2-2-debuginfo-2.9.7-lp151.5.9.1 libxml2-debugsource-2.9.7-lp151.5.9.1 libxml2-devel-2.9.7-lp151.5.9.1 libxml2-tools-2.9.7-lp151.5.9.1 libxml2-tools-debuginfo-2.9.7-lp151.5.9.1 python-libxml2-python-debugsource-2.9.7-lp151.5.9.1 python2-libxml2-python-2.9.7-lp151.5.9.1 python2-libxml2-python-debuginfo-2.9.7-lp151.5.9.1 python3-libxml2-python-2.9.7-lp151.5.9.1 python3-libxml2-python-debuginfo-2.9.7-lp151.5.9.1 - openSUSE Leap 15.1 (x86_64): libxml2-2-32bit-2.9.7-lp151.5.9.1 libxml2-2-32bit-debuginfo-2.9.7-lp151.5.9.1 libxml2-devel-32bit-2.9.7-lp151.5.9.1 - openSUSE Leap 15.1 (noarch): libxml2-doc-2.9.7-lp151.5.9.1 References: https://www.suse.com/security/cve/CVE-2019-19956.html https://www.suse.com/security/cve/CVE-2019-20388.html https://www.suse.com/security/cve/CVE-2020-7595.html https://bugzilla.suse.com/1159928 https://bugzilla.suse.com/1161517 https://bugzilla.suse.com/1161521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0685-1: moderate: Security update for python-rpyc
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for python-rpyc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0685-1 Rating: moderate References: #1152987 Cross-References: CVE-2019-16328 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rpyc to 4.1.5 fixes the following issues: Security issue fixed: - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution (boo#1152987). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-685=1 Package List: - openSUSE Leap 15.1 (noarch): python2-rpyc-4.1.5-lp151.3.3.1 python3-rpyc-4.1.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-16328.html https://bugzilla.suse.com/1152987 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0693-1: moderate: Security update for dpdk
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0693-1 Rating: moderate References: #1171477 Cross-References: CVE-2020-10722 CVE-2020-10723 CVE-2020-10724 CVE-2020-10725 CVE-2020-10726 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for dpdk fixes the following issues: Security issues fixed: - CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477). - CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477). - CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477). - CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477). - CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-693=1 Package List: - openSUSE Leap 15.1 (x86_64): dpdk-18.11.3-lp151.3.4.1 dpdk-debuginfo-18.11.3-lp151.3.4.1 dpdk-debugsource-18.11.3-lp151.3.4.1 dpdk-devel-18.11.3-lp151.3.4.1 dpdk-devel-debuginfo-18.11.3-lp151.3.4.1 dpdk-examples-18.11.3-lp151.3.4.1 dpdk-examples-debuginfo-18.11.3-lp151.3.4.1 dpdk-kmp-default-18.11.3_k4.12.14_lp151.28.48-lp151.3.4.1 dpdk-kmp-default-debuginfo-18.11.3_k4.12.14_lp151.28.48-lp151.3.4.1 dpdk-tools-18.11.3-lp151.3.4.1 dpdk-tools-debuginfo-18.11.3-lp151.3.4.1 libdpdk-18_11-18.11.3-lp151.3.4.1 libdpdk-18_11-debuginfo-18.11.3-lp151.3.4.1 - openSUSE Leap 15.1 (noarch): dpdk-doc-18.11.3-lp151.3.4.1 References: https://www.suse.com/security/cve/CVE-2020-10722.html https://www.suse.com/security/cve/CVE-2020-10723.html https://www.suse.com/security/cve/CVE-2020-10724.html https://www.suse.com/security/cve/CVE-2020-10725.html https://www.suse.com/security/cve/CVE-2020-10726.html https://bugzilla.suse.com/1171477 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0677-1: moderate: Security update for file
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0677-1 Rating: moderate References: #1154661 #1169512 Cross-References: CVE-2019-18218 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for file fixes the following issues: Security issues fixed: - CVE-2019-18218: Fixed a heap-based buffer overflow in cdf_read_property_info() (bsc#1154661). Non-security issue fixed: - Fixed broken '--help' output (bsc#1169512). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-677=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): file-5.32-lp151.8.3.1 file-debuginfo-5.32-lp151.8.3.1 file-debugsource-5.32-lp151.8.3.1 file-devel-5.32-lp151.8.3.1 libmagic1-5.32-lp151.8.3.1 libmagic1-debuginfo-5.32-lp151.8.3.1 python2-magic-5.32-lp151.8.3.1 python3-magic-5.32-lp151.8.3.1 - openSUSE Leap 15.1 (x86_64): file-devel-32bit-5.32-lp151.8.3.1 libmagic1-32bit-5.32-lp151.8.3.1 libmagic1-32bit-debuginfo-5.32-lp151.8.3.1 - openSUSE Leap 15.1 (noarch): file-magic-5.32-lp151.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-18218.html https://bugzilla.suse.com/1154661 https://bugzilla.suse.com/1169512 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0