May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0679-1: moderate: Security update for libbsd
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libbsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0679-1 Rating: moderate References: #1160551 Cross-References: CVE-2019-20367 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libbsd fixes the following issues: - CVE-2019-20367: Fixed an out-of-bounds read during a comparison for a symbol names from the string table (bsc#1160551). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-679=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libbsd-ctor-static-0.8.7-lp151.3.3.1 libbsd-debugsource-0.8.7-lp151.3.3.1 libbsd-devel-0.8.7-lp151.3.3.1 libbsd0-0.8.7-lp151.3.3.1 libbsd0-debuginfo-0.8.7-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-20367.html https://bugzilla.suse.com/1160551 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0673-1: moderate: Security update for imapfilter
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for imapfilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0673-1 Rating: moderate References: #1149931 Cross-References: CVE-2016-10937 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation (boo#1149931). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-673=1 Package List: - openSUSE Leap 15.1 (x86_64): imapfilter-2.6.16-lp151.3.3.1 imapfilter-debuginfo-2.6.16-lp151.3.3.1 imapfilter-debugsource-2.6.16-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-10937.html https://bugzilla.suse.com/1149931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0696-1: moderate: Security update for python
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0696-1 Rating: moderate References: #1155094 #1162825 Cross-References: CVE-2019-18348 CVE-2019-9674 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094). - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-696=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.17-lp151.10.17.1 libpython2_7-1_0-debuginfo-2.7.17-lp151.10.17.1 python-2.7.17-lp151.10.17.1 python-base-2.7.17-lp151.10.17.1 python-base-debuginfo-2.7.17-lp151.10.17.1 python-base-debugsource-2.7.17-lp151.10.17.1 python-curses-2.7.17-lp151.10.17.1 python-curses-debuginfo-2.7.17-lp151.10.17.1 python-debuginfo-2.7.17-lp151.10.17.1 python-debugsource-2.7.17-lp151.10.17.1 python-demo-2.7.17-lp151.10.17.1 python-devel-2.7.17-lp151.10.17.1 python-gdbm-2.7.17-lp151.10.17.1 python-gdbm-debuginfo-2.7.17-lp151.10.17.1 python-idle-2.7.17-lp151.10.17.1 python-tk-2.7.17-lp151.10.17.1 python-tk-debuginfo-2.7.17-lp151.10.17.1 python-xml-2.7.17-lp151.10.17.1 python-xml-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp151.10.17.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp151.10.17.1 python-32bit-2.7.17-lp151.10.17.1 python-32bit-debuginfo-2.7.17-lp151.10.17.1 python-base-32bit-2.7.17-lp151.10.17.1 python-base-32bit-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.17-lp151.10.17.1 python-doc-pdf-2.7.17-lp151.10.17.1 References: https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-9674.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1162825 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0670-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0670-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-670=1 Package List: - openSUSE Leap 15.1 (noarch): nextcloud-18.0.4-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0694-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0694-1 Rating: moderate References: #1170452 Cross-References: CVE-2020-12105 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: Security issue fixed: - CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-694=1 Package List: - openSUSE Leap 15.1 (noarch): openconnect-lang-7.08-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): openconnect-7.08-lp151.6.6.1 openconnect-debuginfo-7.08-lp151.6.6.1 openconnect-debugsource-7.08-lp151.6.6.1 openconnect-devel-7.08-lp151.6.6.1 openconnect-doc-7.08-lp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-12105.html https://bugzilla.suse.com/1170452 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0668-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0668-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-668=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-18.0.4-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0667-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0667-1 Rating: moderate References: #1084320 #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-667=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-18.0.4-22.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1084320 https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0661-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 15 May '20

15 May '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0661-1 Rating: moderate References: #1171363 #682920 Cross-References: CVE-2020-12108 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2020-12108: Fixed a content injection bug (boo#1171363). Non-security issue fixed: - Don't default to invalid hosts for DEFAULT_EMAIL_HOST (boo#682920) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-661=1 Package List: - openSUSE Leap 15.1 (x86_64): mailman-2.1.29-lp151.3.11.1 mailman-debuginfo-2.1.29-lp151.3.11.1 mailman-debugsource-2.1.29-lp151.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/682920 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0656-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 12 May '20

12 May '20

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0656-1 Rating: moderate References: #1171379 Cross-References: CVE-2020-11888 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-markdown2 fixes the following issues: - CVE-2020-11888: Fixed unsanitized input for cross-site scripting (boo#1171379) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-656=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-markdown2-2.3.7-bp151.2.3.1 python3-markdown2-2.3.7-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11888.html https://bugzilla.suse.com/1171379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0653-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0653-1 Rating: important References: #1170603 Cross-References: CVE-2020-12268 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript to version 9.52 fixes the following issues: - CVE-2020-12268: Fixed a heap-based buffer overflow in jbig2_image_compose (bsc#1170603). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-653=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.52-lp151.3.12.1 ghostscript-debuginfo-9.52-lp151.3.12.1 ghostscript-debugsource-9.52-lp151.3.12.1 ghostscript-devel-9.52-lp151.3.12.1 ghostscript-mini-9.52-lp151.3.12.1 ghostscript-mini-debuginfo-9.52-lp151.3.12.1 ghostscript-mini-debugsource-9.52-lp151.3.12.1 ghostscript-mini-devel-9.52-lp151.3.12.1 ghostscript-x11-9.52-lp151.3.12.1 ghostscript-x11-debuginfo-9.52-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): libspectre-debugsource-0.2.8-lp151.3.3.1 libspectre-devel-0.2.8-lp151.3.3.1 libspectre1-0.2.8-lp151.3.3.1 libspectre1-debuginfo-0.2.8-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12268.html https://bugzilla.suse.com/1170603 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.12-8.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0651-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0651-1 Rating: moderate References: #1171379 Cross-References: CVE-2020-11888 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-markdown2 fixes the following issues: - CVE-2020-11888: Fixed unsanitized input for cross-site scripting (boo#1171379) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-651=1 Package List: - openSUSE Leap 15.1 (noarch): python2-markdown2-2.3.7-lp151.2.3.1 python3-markdown2-2.3.7-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11888.html https://bugzilla.suse.com/1171379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0648-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0648-1 Rating: important References: #1171247 Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to 81.0.4044.138 (boo#1171247): - CVE-2020-6831: Stack buffer overflow in SCTP - CVE-2020-6464: Type Confusion in Blink This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-648=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): chromedriver-81.0.4044.138-bp151.3.82.2 chromium-81.0.4044.138-bp151.3.82.2 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171247 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0620-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0620-1 Rating: important References: #1171247 Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to 81.0.4044.138 (boo#1171247): - CVE-2020-6831: Stack buffer overflow in SCTP - CVE-2020-6464: Type Confusion in Blink Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-620=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-81.0.4044.138-lp151.2.88.1 chromedriver-debuginfo-81.0.4044.138-lp151.2.88.1 chromium-81.0.4044.138-lp151.2.88.1 chromium-debuginfo-81.0.4044.138-lp151.2.88.1 chromium-debugsource-81.0.4044.138-lp151.2.88.1 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171247 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0635-1: important: Security update for opera
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0635-1 Rating: important References: Cross-References: CVE-2020-6457 CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 CVE-2020-6461 CVE-2020-6462 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 68.0.3618.63 - CHR-7889 Update chromium on desktop-stable-81-3618 to 81.0.4044.122 - CHR-7896 Update chromium on desktop-stable-81-3618 to 81.0.4044.129 - DNA-85287 Set standard spacing for Yandex prompt - DNA-85416 [Mac] Animation of tab insert is glitchy on slow machines - DNA-85568 Verify API for triggering “unread” mode with Instagram. - DNA-86027 Present Now not working in google meet after canceling it once - DNA-86028 Add a back and forward button in the Instagram panel - DNA-86029 Investigate and implement re-freshing of the instagram panel content - Update chromium to 81.0.4044.122 fixes CVE-2020-6458, CVE-2020-6459, CVE-2020-6460 - Update chromium to 81.0.4044.129 fixes CVE-2020-6461, CVE-2020-6462 Update to version 68.0.3618.56 - DNA-85256 [Win] Cookies section on site pages is white in dark mode - DNA-85474 [Mac] Dragging tabs to the left with hidden sidebar is broken - DNA-85771 DNS-over-HTTPS example in settings is wrong - DNA-85976 Change page display time when navigating from opera:startpage - CHR-7878 Update chromium on desktop-stable-81-3618 to 81.0.4044.113 (CVE-2020-6457) - DNA-78158 PATCH-1272 should be removed - DNA-84721 Weather widget is overlapped when ‘Use bigger tiles’ - DNA-85246 Implement 0-state dialog and onboarding - DNA-85354 O-menu is misplaced when opened with maximized opera - DNA-85405 Add link to Privacy Policy on the 0-state dialog - DNA-85409 Ask for geolocation EULA once - DNA-85426 Crash at opera::DownloadActionButton::Update() - DNA-85454 Add id’s to elements for testing - DNA-85493 Add “Show Weather” toggle to “Start Page” section in Easy Setup - DNA-85501 Set timestamps in geolocation exception record - DNA-85514 Add fallback when geolocation fails - DNA-85713 Report consent for geolocation on start page - DNA-85753 Fetch news configuration from new endpoint - DNA-85798 Incorrect padding in Search in Tabs window - DNA-85801 Disable notification on instagram panel - DNA-85809 Update instagram icon in the Sidebar Setup - DNA-85854 Change Instagram panel size, to fit desktop version - Complete Opera 68.0 changelog at: https://blogs.opera.com/desktop/changelog-for-68/ Update to version 67.0.3575.137 - CHR-7852 Update chromium on desktop-stable-80-3575 to 80.0.3987.163 - DNA-82540 Crash at remote_cocoa::NativeWidgetNSWindowBridge:: SetVisibilityState(remote_cocoa::mojom::WindowVisibilityState) - DNA-84951 New PiP is completely black for some 2 GPU setups - DNA-85284 Chrome “Open link in same tab, pop-up as tab [Free]” extension is no longer working in Opera - DNA-85415 [Mac] Inspect Popup not working - DNA-85530 Create API for displaying and triggering “unread” mode for messengers from in-app - DNA-85537 Let addons.opera.com interact with sidebar messengers Update to version 67.0.3575.115 - CHR-7833 Update chromium on desktop-stable-80-3575 to 80.0.3987.149 - DNA-74423 [Mac] Search/Copy popup stuck on top left of screen - DNA-82975 Crash at blink::DocumentLifecycle::EnsureStateAtMost (blink::DocumentLifecycle::LifecycleState) - DNA-83834 Crash at base::MessagePumpNSApplication:: DoRun (base::MessagePump::Delegate*) - DNA-84632 macOS 10.15.2 fail on creating testlist.json - DNA-84713 Switching through tabs broken when using workspaces Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-635=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-68.0.3618.63-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-6457.html https://www.suse.com/security/cve/CVE-2020-6458.html https://www.suse.com/security/cve/CVE-2020-6459.html https://www.suse.com/security/cve/CVE-2020-6460.html https://www.suse.com/security/cve/CVE-2020-6461.html https://www.suse.com/security/cve/CVE-2020-6462.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0624-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0624-1 Rating: important References: #1155419 #1160471 #1170441 Cross-References: CVE-2019-15681 CVE-2019-15690 CVE-2019-20788 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: - CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471). - CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419). - CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-624=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp151.7.3.1 LibVNCServer-devel-0.9.10-lp151.7.3.1 libvncclient0-0.9.10-lp151.7.3.1 libvncclient0-debuginfo-0.9.10-lp151.7.3.1 libvncserver0-0.9.10-lp151.7.3.1 libvncserver0-debuginfo-0.9.10-lp151.7.3.1 References: https://www.suse.com/security/cve/CVE-2019-15681.html https://www.suse.com/security/cve/CVE-2019-15690.html https://www.suse.com/security/cve/CVE-2019-20788.html https://bugzilla.suse.com/1155419 https://bugzilla.suse.com/1160471 https://bugzilla.suse.com/1170441 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0628-1: important: Security update for sqliteodbc
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for sqliteodbc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0628-1 Rating: important References: #1171041 Cross-References: CVE-2020-12050 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sqliteodbc fixes the following issues: Security issue fixed: - CVE-2020-12050: Fixed a privilege escalation vulnerability (boo#1171041). Non-security issues fixed: - Update to version 0.9996 * update to SQLite 3.22.0 * fixes in handling DDL in SQLExecDirect() et.al., thanks Andre Mikulec for testing * cleanup utf8/unicode conversion functions Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-628=1 Package List: - openSUSE Leap 15.1 (x86_64): sqliteodbc-0.9996-lp151.3.3.1 sqliteodbc-debuginfo-0.9996-lp151.3.3.1 sqliteodbc-debugsource-0.9996-lp151.3.3.1 sqliteodbc-doc-0.9996-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12050.html https://bugzilla.suse.com/1171041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0642-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0642-1 Rating: moderate References: #1168326 #1168352 Cross-References: CVE-2020-7064 CVE-2020-7066 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php7 fixes the following issues: - CVE-2020-7064: Fixed a one byte read of uninitialized memory in exif_read_data() (bsc#1168326). - CVE-2020-7066: Fixed URL truncation get_headers() if the URL contains zero (\0) character (bsc#1168352). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-642=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-mod_php7-7.2.5-lp151.6.25.1 apache2-mod_php7-debuginfo-7.2.5-lp151.6.25.1 libtidy-devel-5.4.0-lp151.3.3.1 libtidy5-5.4.0-lp151.3.3.1 libtidy5-debuginfo-5.4.0-lp151.3.3.1 php7-7.2.5-lp151.6.25.1 php7-bcmath-7.2.5-lp151.6.25.1 php7-bcmath-debuginfo-7.2.5-lp151.6.25.1 php7-bz2-7.2.5-lp151.6.25.1 php7-bz2-debuginfo-7.2.5-lp151.6.25.1 php7-calendar-7.2.5-lp151.6.25.1 php7-calendar-debuginfo-7.2.5-lp151.6.25.1 php7-ctype-7.2.5-lp151.6.25.1 php7-ctype-debuginfo-7.2.5-lp151.6.25.1 php7-curl-7.2.5-lp151.6.25.1 php7-curl-debuginfo-7.2.5-lp151.6.25.1 php7-dba-7.2.5-lp151.6.25.1 php7-dba-debuginfo-7.2.5-lp151.6.25.1 php7-debuginfo-7.2.5-lp151.6.25.1 php7-debugsource-7.2.5-lp151.6.25.1 php7-devel-7.2.5-lp151.6.25.1 php7-dom-7.2.5-lp151.6.25.1 php7-dom-debuginfo-7.2.5-lp151.6.25.1 php7-embed-7.2.5-lp151.6.25.1 php7-embed-debuginfo-7.2.5-lp151.6.25.1 php7-enchant-7.2.5-lp151.6.25.1 php7-enchant-debuginfo-7.2.5-lp151.6.25.1 php7-exif-7.2.5-lp151.6.25.1 php7-exif-debuginfo-7.2.5-lp151.6.25.1 php7-fastcgi-7.2.5-lp151.6.25.1 php7-fastcgi-debuginfo-7.2.5-lp151.6.25.1 php7-fileinfo-7.2.5-lp151.6.25.1 php7-fileinfo-debuginfo-7.2.5-lp151.6.25.1 php7-firebird-7.2.5-lp151.6.25.1 php7-firebird-debuginfo-7.2.5-lp151.6.25.1 php7-fpm-7.2.5-lp151.6.25.1 php7-fpm-debuginfo-7.2.5-lp151.6.25.1 php7-ftp-7.2.5-lp151.6.25.1 php7-ftp-debuginfo-7.2.5-lp151.6.25.1 php7-gd-7.2.5-lp151.6.25.1 php7-gd-debuginfo-7.2.5-lp151.6.25.1 php7-gettext-7.2.5-lp151.6.25.1 php7-gettext-debuginfo-7.2.5-lp151.6.25.1 php7-gmp-7.2.5-lp151.6.25.1 php7-gmp-debuginfo-7.2.5-lp151.6.25.1 php7-iconv-7.2.5-lp151.6.25.1 php7-iconv-debuginfo-7.2.5-lp151.6.25.1 php7-intl-7.2.5-lp151.6.25.1 php7-intl-debuginfo-7.2.5-lp151.6.25.1 php7-json-7.2.5-lp151.6.25.1 php7-json-debuginfo-7.2.5-lp151.6.25.1 php7-ldap-7.2.5-lp151.6.25.1 php7-ldap-debuginfo-7.2.5-lp151.6.25.1 php7-mbstring-7.2.5-lp151.6.25.1 php7-mbstring-debuginfo-7.2.5-lp151.6.25.1 php7-mysql-7.2.5-lp151.6.25.1 php7-mysql-debuginfo-7.2.5-lp151.6.25.1 php7-odbc-7.2.5-lp151.6.25.1 php7-odbc-debuginfo-7.2.5-lp151.6.25.1 php7-opcache-7.2.5-lp151.6.25.1 php7-opcache-debuginfo-7.2.5-lp151.6.25.1 php7-openssl-7.2.5-lp151.6.25.1 php7-openssl-debuginfo-7.2.5-lp151.6.25.1 php7-pcntl-7.2.5-lp151.6.25.1 php7-pcntl-debuginfo-7.2.5-lp151.6.25.1 php7-pdo-7.2.5-lp151.6.25.1 php7-pdo-debuginfo-7.2.5-lp151.6.25.1 php7-pgsql-7.2.5-lp151.6.25.1 php7-pgsql-debuginfo-7.2.5-lp151.6.25.1 php7-phar-7.2.5-lp151.6.25.1 php7-phar-debuginfo-7.2.5-lp151.6.25.1 php7-posix-7.2.5-lp151.6.25.1 php7-posix-debuginfo-7.2.5-lp151.6.25.1 php7-readline-7.2.5-lp151.6.25.1 php7-readline-debuginfo-7.2.5-lp151.6.25.1 php7-shmop-7.2.5-lp151.6.25.1 php7-shmop-debuginfo-7.2.5-lp151.6.25.1 php7-snmp-7.2.5-lp151.6.25.1 php7-snmp-debuginfo-7.2.5-lp151.6.25.1 php7-soap-7.2.5-lp151.6.25.1 php7-soap-debuginfo-7.2.5-lp151.6.25.1 php7-sockets-7.2.5-lp151.6.25.1 php7-sockets-debuginfo-7.2.5-lp151.6.25.1 php7-sodium-7.2.5-lp151.6.25.1 php7-sodium-debuginfo-7.2.5-lp151.6.25.1 php7-sqlite-7.2.5-lp151.6.25.1 php7-sqlite-debuginfo-7.2.5-lp151.6.25.1 php7-sysvmsg-7.2.5-lp151.6.25.1 php7-sysvmsg-debuginfo-7.2.5-lp151.6.25.1 php7-sysvsem-7.2.5-lp151.6.25.1 php7-sysvsem-debuginfo-7.2.5-lp151.6.25.1 php7-sysvshm-7.2.5-lp151.6.25.1 php7-sysvshm-debuginfo-7.2.5-lp151.6.25.1 php7-test-7.2.5-lp151.6.25.1 php7-tidy-7.2.5-lp151.6.25.1 php7-tidy-debuginfo-7.2.5-lp151.6.25.1 php7-tokenizer-7.2.5-lp151.6.25.1 php7-tokenizer-debuginfo-7.2.5-lp151.6.25.1 php7-wddx-7.2.5-lp151.6.25.1 php7-wddx-debuginfo-7.2.5-lp151.6.25.1 php7-xmlreader-7.2.5-lp151.6.25.1 php7-xmlreader-debuginfo-7.2.5-lp151.6.25.1 php7-xmlrpc-7.2.5-lp151.6.25.1 php7-xmlrpc-debuginfo-7.2.5-lp151.6.25.1 php7-xmlwriter-7.2.5-lp151.6.25.1 php7-xmlwriter-debuginfo-7.2.5-lp151.6.25.1 php7-xsl-7.2.5-lp151.6.25.1 php7-xsl-debuginfo-7.2.5-lp151.6.25.1 php7-zip-7.2.5-lp151.6.25.1 php7-zip-debuginfo-7.2.5-lp151.6.25.1 php7-zlib-7.2.5-lp151.6.25.1 php7-zlib-debuginfo-7.2.5-lp151.6.25.1 tidy-5.4.0-lp151.3.3.1 tidy-debuginfo-5.4.0-lp151.3.3.1 tidy-debugsource-5.4.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): php7-pear-7.2.5-lp151.6.25.1 php7-pear-Archive_Tar-7.2.5-lp151.6.25.1 tidy-doc-5.4.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-7064.html https://www.suse.com/security/cve/CVE-2020-7066.html https://bugzilla.suse.com/1168326 https://bugzilla.suse.com/1168352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0643-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0643-1 Rating: important References: #1171186 Cross-References: CVE-2020-12387 CVE-2020-12392 CVE-2020-12393 CVE-2020-12395 CVE-2020-12397 CVE-2020-6831 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to 68.8.0 ESR MFSA 2020-18 (bsc#1171186) * CVE-2020-12397 (bmo#1617370) Sender Email Address Spoofing using encoded Unicode characters * CVE-2020-12387 (bmo#1545345) Use-after-free during worker shutdown * CVE-2020-6831 (bmo#1632241) Buffer overflow in SCTP chunk input validation * CVE-2020-12392 (bmo#1614468) Arbitrary local file access with 'Copy as cURL' * CVE-2020-12393 (bmo#1615471) Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection * CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704, bmo#1624098, bmo#1625749, bmo#1626382, bmo#1628076, bmo#1631508) Memory safety bugs fixed in Thunderbird 68.8.0 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-643=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.8.0-lp151.2.38.2 MozillaThunderbird-debuginfo-68.8.0-lp151.2.38.2 MozillaThunderbird-debugsource-68.8.0-lp151.2.38.2 MozillaThunderbird-translations-common-68.8.0-lp151.2.38.2 MozillaThunderbird-translations-other-68.8.0-lp151.2.38.2 References: https://www.suse.com/security/cve/CVE-2020-12387.html https://www.suse.com/security/cve/CVE-2020-12392.html https://www.suse.com/security/cve/CVE-2020-12393.html https://www.suse.com/security/cve/CVE-2020-12395.html https://www.suse.com/security/cve/CVE-2020-12397.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171186 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0631-1: moderate: Security update for rpmlint
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0631-1 Rating: moderate References: #1129452 #1169365 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the following issues: - whitelist certmonger (bsc#1169365, bsc#1129452) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-631=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): rpmlint-mini-1.10-lp151.5.13.1 rpmlint-mini-debuginfo-1.10-lp151.5.13.1 rpmlint-mini-debugsource-1.10-lp151.5.13.1 - openSUSE Leap 15.1 (noarch): rpmlint-1.10-lp151.9.6.1 - openSUSE Leap 15.1 (x86_64): rpmlint-tests-debugsource-84.87+git20181018.60e0249-lp151.9.6.1 References: https://bugzilla.suse.com/1129452 https://bugzilla.suse.com/1169365 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0636-1: important: Security update for slirp4netns
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for slirp4netns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0636-1 Rating: important References: #1170940 Cross-References: CVE-2020-1983 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slirp4netns fixes the following issues: Security issue fixed: - CVE-2020-1983: Fixed a use-after-free in ip_reass (bsc#1170940). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-636=1 Package List: - openSUSE Leap 15.1 (x86_64): slirp4netns-0.4.5-lp151.2.9.1 slirp4netns-debuginfo-0.4.5-lp151.2.9.1 slirp4netns-debugsource-0.4.5-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-1983.html https://bugzilla.suse.com/1170940 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0621-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0621-1 Rating: important References: #1171186 Cross-References: CVE-2020-12387 CVE-2020-12388 CVE-2020-12389 CVE-2020-12392 CVE-2020-12393 CVE-2020-12395 CVE-2020-6831 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to version 68.8.0 ESR (bsc#1171186): - CVE-2020-12387: Use-after-free during worker shutdown - CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens - CVE-2020-12389: Sandbox escape with improperly separated process types - CVE-2020-6831: Buffer overflow in SCTP chunk input validation - CVE-2020-12392: Arbitrary local file access with 'Copy as cURL' - CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection - CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-621=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.8.0-lp151.2.45.1 MozillaFirefox-branding-upstream-68.8.0-lp151.2.45.1 MozillaFirefox-buildsymbols-68.8.0-lp151.2.45.1 MozillaFirefox-debuginfo-68.8.0-lp151.2.45.1 MozillaFirefox-debugsource-68.8.0-lp151.2.45.1 MozillaFirefox-devel-68.8.0-lp151.2.45.1 MozillaFirefox-translations-common-68.8.0-lp151.2.45.1 MozillaFirefox-translations-other-68.8.0-lp151.2.45.1 References: https://www.suse.com/security/cve/CVE-2020-12387.html https://www.suse.com/security/cve/CVE-2020-12388.html https://www.suse.com/security/cve/CVE-2020-12389.html https://www.suse.com/security/cve/CVE-2020-12392.html https://www.suse.com/security/cve/CVE-2020-12393.html https://www.suse.com/security/cve/CVE-2020-12395.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171186 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0622-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0622-1 Rating: moderate References: #1163927 Cross-References: CVE-2019-14559 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: - CVE-2019-14559: Fixed a memory leak in ArpOnFrameRcvdDpc() (bsc#1163927). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-622=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp151.11.6.1 ovmf-tools-2017+git1510945757.b2662641d5-lp151.11.6.1 - openSUSE Leap 15.1 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp151.11.6.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp151.11.6.1 - openSUSE Leap 15.1 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp151.11.6.1 References: https://www.suse.com/security/cve/CVE-2019-14559.html https://bugzilla.suse.com/1163927 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0627-1: moderate: Security update for rubygem-actionview-5_1
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for rubygem-actionview-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0627-1 Rating: moderate References: #1167240 Cross-References: CVE-2020-5267 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionview-5_1 fixes the following issues: - CVE-2020-5267: Fixed an XSS vulnerability in ActionView's JavaScript literal escape helpers (bsc#1167240). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-627=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-actionview-5_1-5.1.4-lp151.3.3.1 ruby2.5-rubygem-actionview-doc-5_1-5.1.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-5267.html https://bugzilla.suse.com/1167240 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0