May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0680-1: moderate: Security update for libvpx
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libvpx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0680-1 Rating: moderate References: #1166066 Cross-References: CVE-2020-0034 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvpx fixes the following issues: - CVE-2020-0034: Fixed an out-of-bounds read on truncated key frames (bsc#1166066). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-680=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libvpx-debugsource-1.6.1-lp151.5.6.1 libvpx-devel-1.6.1-lp151.5.6.1 libvpx4-1.6.1-lp151.5.6.1 libvpx4-debuginfo-1.6.1-lp151.5.6.1 vpx-tools-1.6.1-lp151.5.6.1 vpx-tools-debuginfo-1.6.1-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libvpx4-32bit-1.6.1-lp151.5.6.1 libvpx4-32bit-debuginfo-1.6.1-lp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2020-0034.html https://bugzilla.suse.com/1166066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0681-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0681-1 Rating: moderate References: #1159928 #1161517 #1161521 Cross-References: CVE-2019-19956 CVE-2019-20388 CVE-2020-7595 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521). - CVE-2019-19956: Fixed a memory leak (bsc#1159928). - CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-681=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxml2-2-2.9.7-lp151.5.9.1 libxml2-2-debuginfo-2.9.7-lp151.5.9.1 libxml2-debugsource-2.9.7-lp151.5.9.1 libxml2-devel-2.9.7-lp151.5.9.1 libxml2-tools-2.9.7-lp151.5.9.1 libxml2-tools-debuginfo-2.9.7-lp151.5.9.1 python-libxml2-python-debugsource-2.9.7-lp151.5.9.1 python2-libxml2-python-2.9.7-lp151.5.9.1 python2-libxml2-python-debuginfo-2.9.7-lp151.5.9.1 python3-libxml2-python-2.9.7-lp151.5.9.1 python3-libxml2-python-debuginfo-2.9.7-lp151.5.9.1 - openSUSE Leap 15.1 (x86_64): libxml2-2-32bit-2.9.7-lp151.5.9.1 libxml2-2-32bit-debuginfo-2.9.7-lp151.5.9.1 libxml2-devel-32bit-2.9.7-lp151.5.9.1 - openSUSE Leap 15.1 (noarch): libxml2-doc-2.9.7-lp151.5.9.1 References: https://www.suse.com/security/cve/CVE-2019-19956.html https://www.suse.com/security/cve/CVE-2019-20388.html https://www.suse.com/security/cve/CVE-2020-7595.html https://bugzilla.suse.com/1159928 https://bugzilla.suse.com/1161517 https://bugzilla.suse.com/1161521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0685-1: moderate: Security update for python-rpyc
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for python-rpyc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0685-1 Rating: moderate References: #1152987 Cross-References: CVE-2019-16328 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rpyc to 4.1.5 fixes the following issues: Security issue fixed: - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution (boo#1152987). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-685=1 Package List: - openSUSE Leap 15.1 (noarch): python2-rpyc-4.1.5-lp151.3.3.1 python3-rpyc-4.1.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-16328.html https://bugzilla.suse.com/1152987 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0693-1: moderate: Security update for dpdk
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0693-1 Rating: moderate References: #1171477 Cross-References: CVE-2020-10722 CVE-2020-10723 CVE-2020-10724 CVE-2020-10725 CVE-2020-10726 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for dpdk fixes the following issues: Security issues fixed: - CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477). - CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477). - CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477). - CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477). - CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-693=1 Package List: - openSUSE Leap 15.1 (x86_64): dpdk-18.11.3-lp151.3.4.1 dpdk-debuginfo-18.11.3-lp151.3.4.1 dpdk-debugsource-18.11.3-lp151.3.4.1 dpdk-devel-18.11.3-lp151.3.4.1 dpdk-devel-debuginfo-18.11.3-lp151.3.4.1 dpdk-examples-18.11.3-lp151.3.4.1 dpdk-examples-debuginfo-18.11.3-lp151.3.4.1 dpdk-kmp-default-18.11.3_k4.12.14_lp151.28.48-lp151.3.4.1 dpdk-kmp-default-debuginfo-18.11.3_k4.12.14_lp151.28.48-lp151.3.4.1 dpdk-tools-18.11.3-lp151.3.4.1 dpdk-tools-debuginfo-18.11.3-lp151.3.4.1 libdpdk-18_11-18.11.3-lp151.3.4.1 libdpdk-18_11-debuginfo-18.11.3-lp151.3.4.1 - openSUSE Leap 15.1 (noarch): dpdk-doc-18.11.3-lp151.3.4.1 References: https://www.suse.com/security/cve/CVE-2020-10722.html https://www.suse.com/security/cve/CVE-2020-10723.html https://www.suse.com/security/cve/CVE-2020-10724.html https://www.suse.com/security/cve/CVE-2020-10725.html https://www.suse.com/security/cve/CVE-2020-10726.html https://bugzilla.suse.com/1171477 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0677-1: moderate: Security update for file
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0677-1 Rating: moderate References: #1154661 #1169512 Cross-References: CVE-2019-18218 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for file fixes the following issues: Security issues fixed: - CVE-2019-18218: Fixed a heap-based buffer overflow in cdf_read_property_info() (bsc#1154661). Non-security issue fixed: - Fixed broken '--help' output (bsc#1169512). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-677=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): file-5.32-lp151.8.3.1 file-debuginfo-5.32-lp151.8.3.1 file-debugsource-5.32-lp151.8.3.1 file-devel-5.32-lp151.8.3.1 libmagic1-5.32-lp151.8.3.1 libmagic1-debuginfo-5.32-lp151.8.3.1 python2-magic-5.32-lp151.8.3.1 python3-magic-5.32-lp151.8.3.1 - openSUSE Leap 15.1 (x86_64): file-devel-32bit-5.32-lp151.8.3.1 libmagic1-32bit-5.32-lp151.8.3.1 libmagic1-32bit-debuginfo-5.32-lp151.8.3.1 - openSUSE Leap 15.1 (noarch): file-magic-5.32-lp151.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-18218.html https://bugzilla.suse.com/1154661 https://bugzilla.suse.com/1169512 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0679-1: moderate: Security update for libbsd
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for libbsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0679-1 Rating: moderate References: #1160551 Cross-References: CVE-2019-20367 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libbsd fixes the following issues: - CVE-2019-20367: Fixed an out-of-bounds read during a comparison for a symbol names from the string table (bsc#1160551). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-679=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libbsd-ctor-static-0.8.7-lp151.3.3.1 libbsd-debugsource-0.8.7-lp151.3.3.1 libbsd-devel-0.8.7-lp151.3.3.1 libbsd0-0.8.7-lp151.3.3.1 libbsd0-debuginfo-0.8.7-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-20367.html https://bugzilla.suse.com/1160551 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0673-1: moderate: Security update for imapfilter
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for imapfilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0673-1 Rating: moderate References: #1149931 Cross-References: CVE-2016-10937 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation (boo#1149931). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-673=1 Package List: - openSUSE Leap 15.1 (x86_64): imapfilter-2.6.16-lp151.3.3.1 imapfilter-debuginfo-2.6.16-lp151.3.3.1 imapfilter-debugsource-2.6.16-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-10937.html https://bugzilla.suse.com/1149931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0696-1: moderate: Security update for python
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0696-1 Rating: moderate References: #1155094 #1162825 Cross-References: CVE-2019-18348 CVE-2019-9674 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094). - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-696=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.17-lp151.10.17.1 libpython2_7-1_0-debuginfo-2.7.17-lp151.10.17.1 python-2.7.17-lp151.10.17.1 python-base-2.7.17-lp151.10.17.1 python-base-debuginfo-2.7.17-lp151.10.17.1 python-base-debugsource-2.7.17-lp151.10.17.1 python-curses-2.7.17-lp151.10.17.1 python-curses-debuginfo-2.7.17-lp151.10.17.1 python-debuginfo-2.7.17-lp151.10.17.1 python-debugsource-2.7.17-lp151.10.17.1 python-demo-2.7.17-lp151.10.17.1 python-devel-2.7.17-lp151.10.17.1 python-gdbm-2.7.17-lp151.10.17.1 python-gdbm-debuginfo-2.7.17-lp151.10.17.1 python-idle-2.7.17-lp151.10.17.1 python-tk-2.7.17-lp151.10.17.1 python-tk-debuginfo-2.7.17-lp151.10.17.1 python-xml-2.7.17-lp151.10.17.1 python-xml-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.17-lp151.10.17.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-lp151.10.17.1 python-32bit-2.7.17-lp151.10.17.1 python-32bit-debuginfo-2.7.17-lp151.10.17.1 python-base-32bit-2.7.17-lp151.10.17.1 python-base-32bit-debuginfo-2.7.17-lp151.10.17.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.17-lp151.10.17.1 python-doc-pdf-2.7.17-lp151.10.17.1 References: https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-9674.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1162825 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0670-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0670-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-670=1 Package List: - openSUSE Leap 15.1 (noarch): nextcloud-18.0.4-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0694-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 22 May '20

22 May '20

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0694-1 Rating: moderate References: #1170452 Cross-References: CVE-2020-12105 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: Security issue fixed: - CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-694=1 Package List: - openSUSE Leap 15.1 (noarch): openconnect-lang-7.08-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): openconnect-7.08-lp151.6.6.1 openconnect-debuginfo-7.08-lp151.6.6.1 openconnect-debugsource-7.08-lp151.6.6.1 openconnect-devel-7.08-lp151.6.6.1 openconnect-doc-7.08-lp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-12105.html https://bugzilla.suse.com/1170452 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0