May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0668-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0668-1 Rating: moderate References: #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-668=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-18.0.4-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0667-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 17 May '20

17 May '20

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0667-1 Rating: moderate References: #1084320 #1171572 #1171579 Cross-References: CVE-2020-8154 CVE-2020-8155 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for nextcloud to 18.0.4 fixes the following issues: Security issues fixed: - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-667=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-18.0.4-22.1 References: https://www.suse.com/security/cve/CVE-2020-8154.html https://www.suse.com/security/cve/CVE-2020-8155.html https://bugzilla.suse.com/1084320 https://bugzilla.suse.com/1171572 https://bugzilla.suse.com/1171579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0661-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 15 May '20

15 May '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0661-1 Rating: moderate References: #1171363 #682920 Cross-References: CVE-2020-12108 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2020-12108: Fixed a content injection bug (boo#1171363). Non-security issue fixed: - Don't default to invalid hosts for DEFAULT_EMAIL_HOST (boo#682920) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-661=1 Package List: - openSUSE Leap 15.1 (x86_64): mailman-2.1.29-lp151.3.11.1 mailman-debuginfo-2.1.29-lp151.3.11.1 mailman-debugsource-2.1.29-lp151.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/682920 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0656-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 12 May '20

12 May '20

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0656-1 Rating: moderate References: #1171379 Cross-References: CVE-2020-11888 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-markdown2 fixes the following issues: - CVE-2020-11888: Fixed unsanitized input for cross-site scripting (boo#1171379) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-656=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-markdown2-2.3.7-bp151.2.3.1 python3-markdown2-2.3.7-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11888.html https://bugzilla.suse.com/1171379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0653-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0653-1 Rating: important References: #1170603 Cross-References: CVE-2020-12268 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript to version 9.52 fixes the following issues: - CVE-2020-12268: Fixed a heap-based buffer overflow in jbig2_image_compose (bsc#1170603). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-653=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.52-lp151.3.12.1 ghostscript-debuginfo-9.52-lp151.3.12.1 ghostscript-debugsource-9.52-lp151.3.12.1 ghostscript-devel-9.52-lp151.3.12.1 ghostscript-mini-9.52-lp151.3.12.1 ghostscript-mini-debuginfo-9.52-lp151.3.12.1 ghostscript-mini-debugsource-9.52-lp151.3.12.1 ghostscript-mini-devel-9.52-lp151.3.12.1 ghostscript-x11-9.52-lp151.3.12.1 ghostscript-x11-debuginfo-9.52-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): libspectre-debugsource-0.2.8-lp151.3.3.1 libspectre-devel-0.2.8-lp151.3.3.1 libspectre1-0.2.8-lp151.3.3.1 libspectre1-debuginfo-0.2.8-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12268.html https://bugzilla.suse.com/1170603 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.12-8.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0654-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0654-1 Rating: moderate References: #1163749 Cross-References: CVE-2020-7106 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: * CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure (boo#1163749) * Fix multiple graphing bugs and web UI issues * Fix multiple warnings, PHP Exceptions and errors * Content-Security-Policy prevents External Links from being opened * Prevent runtime memory issues by increasing memory limit * Improve SNMPv3 handling cacti-spine fixes: * Failed host lookup causes spine to crash Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-654=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-654=1 Package List: - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.12-lp151.3.9.1 cacti-spine-debuginfo-1.2.12-lp151.3.9.1 cacti-spine-debugsource-1.2.12-lp151.3.9.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.12-lp151.3.9.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.12-bp151.4.9.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.12-bp151.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-7106.html https://bugzilla.suse.com/1163749 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0651-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0651-1 Rating: moderate References: #1171379 Cross-References: CVE-2020-11888 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-markdown2 fixes the following issues: - CVE-2020-11888: Fixed unsanitized input for cross-site scripting (boo#1171379) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-651=1 Package List: - openSUSE Leap 15.1 (noarch): python2-markdown2-2.3.7-lp151.2.3.1 python3-markdown2-2.3.7-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11888.html https://bugzilla.suse.com/1171379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0648-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0648-1 Rating: important References: #1171247 Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to 81.0.4044.138 (boo#1171247): - CVE-2020-6831: Stack buffer overflow in SCTP - CVE-2020-6464: Type Confusion in Blink This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-648=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): chromedriver-81.0.4044.138-bp151.3.82.2 chromium-81.0.4044.138-bp151.3.82.2 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171247 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0620-1: important: Security update for chromium
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0620-1 Rating: important References: #1171247 Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to 81.0.4044.138 (boo#1171247): - CVE-2020-6831: Stack buffer overflow in SCTP - CVE-2020-6464: Type Confusion in Blink Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-620=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-81.0.4044.138-lp151.2.88.1 chromedriver-debuginfo-81.0.4044.138-lp151.2.88.1 chromium-81.0.4044.138-lp151.2.88.1 chromium-debuginfo-81.0.4044.138-lp151.2.88.1 chromium-debugsource-81.0.4044.138-lp151.2.88.1 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html https://bugzilla.suse.com/1171247 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0