May 2020 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2020:0623-1: important: Security update for squid
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0623-1 Rating: important References: #1162689 #1162691 #1167373 #1169659 #1170313 Cross-References: CVE-2019-12519 CVE-2019-12521 CVE-2019-12528 CVE-2019-18860 CVE-2020-11945 CVE-2020-8517 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for squid to version 4.11 fixes the following issues: - CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313). - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659). - CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691). - CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689). - CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-623=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.11-lp151.2.15.2 squid-debuginfo-4.11-lp151.2.15.2 squid-debugsource-4.11-lp151.2.15.2 References: https://www.suse.com/security/cve/CVE-2019-12519.html https://www.suse.com/security/cve/CVE-2019-12521.html https://www.suse.com/security/cve/CVE-2019-12528.html https://www.suse.com/security/cve/CVE-2019-18860.html https://www.suse.com/security/cve/CVE-2020-11945.html https://www.suse.com/security/cve/CVE-2020-8517.html https://bugzilla.suse.com/1162689 https://bugzilla.suse.com/1162691 https://bugzilla.suse.com/1167373 https://bugzilla.suse.com/1169659 https://bugzilla.suse.com/1170313 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0630-1: important: Security update for python-PyYAML
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for python-PyYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0630-1 Rating: important References: #1165439 Cross-References: CVE-2020-1747 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-PyYAML fixes the following issues: - CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-630=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-PyYAML-debuginfo-5.1.2-lp151.2.13.1 python-PyYAML-debugsource-5.1.2-lp151.2.13.1 python2-PyYAML-5.1.2-lp151.2.13.1 python2-PyYAML-debuginfo-5.1.2-lp151.2.13.1 python3-PyYAML-5.1.2-lp151.2.13.1 python3-PyYAML-debuginfo-5.1.2-lp151.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-1747.html https://bugzilla.suse.com/1165439 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0647-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0647-1 Rating: important References: #1170771 Cross-References: CVE-2020-12243 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openldap2 fixes the following issues: - CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-647=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libldap-2_4-2-2.4.46-lp151.10.9.1 libldap-2_4-2-debuginfo-2.4.46-lp151.10.9.1 openldap2-2.4.46-lp151.10.9.1 openldap2-back-meta-2.4.46-lp151.10.9.1 openldap2-back-meta-debuginfo-2.4.46-lp151.10.9.1 openldap2-back-perl-2.4.46-lp151.10.9.1 openldap2-back-perl-debuginfo-2.4.46-lp151.10.9.1 openldap2-back-sock-2.4.46-lp151.10.9.1 openldap2-back-sock-debuginfo-2.4.46-lp151.10.9.1 openldap2-back-sql-2.4.46-lp151.10.9.1 openldap2-back-sql-debuginfo-2.4.46-lp151.10.9.1 openldap2-client-2.4.46-lp151.10.9.1 openldap2-client-debuginfo-2.4.46-lp151.10.9.1 openldap2-contrib-2.4.46-lp151.10.9.1 openldap2-contrib-debuginfo-2.4.46-lp151.10.9.1 openldap2-debuginfo-2.4.46-lp151.10.9.1 openldap2-debugsource-2.4.46-lp151.10.9.1 openldap2-devel-2.4.46-lp151.10.9.1 openldap2-devel-static-2.4.46-lp151.10.9.1 openldap2-ppolicy-check-password-1.2-lp151.10.9.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp151.10.9.1 - openSUSE Leap 15.1 (x86_64): libldap-2_4-2-32bit-2.4.46-lp151.10.9.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp151.10.9.1 openldap2-devel-32bit-2.4.46-lp151.10.9.1 - openSUSE Leap 15.1 (noarch): libldap-data-2.4.46-lp151.10.9.1 openldap2-doc-2.4.46-lp151.10.9.1 References: https://www.suse.com/security/cve/CVE-2020-12243.html https://bugzilla.suse.com/1170771 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0646-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 11 May '20

11 May '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0646-1 Rating: important References: #1170643 Cross-References: CVE-2020-3899 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution (bsc#1170643). Non-security issues fixed: - Update to version 2.28.2 (bsc#1170643): + Fix excessive CPU usage due to GdkFrameClock not being stopped. + Fix UI process crash when EGL_WL_bind_wayland_display extension is not available. + Fix position of select popup menus in X11. + Fix playing of Youtube 'live stream'/H264 URLs. + Fix a crash under X11 when cairo uses xcb. + Fix several crashes and rendering issues. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-646=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.28.2-lp151.2.18.1 libjavascriptcoregtk-4_0-18-debuginfo-2.28.2-lp151.2.18.1 libwebkit2gtk-4_0-37-2.28.2-lp151.2.18.1 libwebkit2gtk-4_0-37-debuginfo-2.28.2-lp151.2.18.1 typelib-1_0-JavaScriptCore-4_0-2.28.2-lp151.2.18.1 typelib-1_0-WebKit2-4_0-2.28.2-lp151.2.18.1 typelib-1_0-WebKit2WebExtension-4_0-2.28.2-lp151.2.18.1 webkit-jsc-4-2.28.2-lp151.2.18.1 webkit-jsc-4-debuginfo-2.28.2-lp151.2.18.1 webkit2gtk-4_0-injected-bundles-2.28.2-lp151.2.18.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.28.2-lp151.2.18.1 webkit2gtk3-debugsource-2.28.2-lp151.2.18.1 webkit2gtk3-devel-2.28.2-lp151.2.18.1 webkit2gtk3-minibrowser-2.28.2-lp151.2.18.1 webkit2gtk3-minibrowser-debuginfo-2.28.2-lp151.2.18.1 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.28.2-lp151.2.18.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.28.2-lp151.2.18.1 libwebkit2gtk-4_0-37-32bit-2.28.2-lp151.2.18.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.28.2-lp151.2.18.1 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.28.2-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-3899.html https://bugzilla.suse.com/1170643 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0615-1: important: Security update for chromium
by opensuse-security＠opensuse.org 06 May '20

06 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0615-1 Rating: important References: #1170107 Cross-References: CVE-2020-0561 CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 CVE-2020-6462 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 81.0.4044.129 (boo#1170107): - CVE-2020-0561: Fixed a use after free in storage - CVE-2020-6462: Fixed a use after free in task scheduling - CVE-2020-6459: Fixed a use after free in payments - CVE-2020-6460: Fixed an insufficient data validation in URL formatting - CVE-2020-6458: Fixed an out of bounds read and write in PDFium This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-615=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-81.0.4044.129-bp151.3.79.1 chromium-81.0.4044.129-bp151.3.79.1 References: https://www.suse.com/security/cve/CVE-2020-0561.html https://www.suse.com/security/cve/CVE-2020-6458.html https://www.suse.com/security/cve/CVE-2020-6459.html https://www.suse.com/security/cve/CVE-2020-6460.html https://www.suse.com/security/cve/CVE-2020-6462.html https://bugzilla.suse.com/1170107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0612-1: important: Security update for sqliteodbc
by opensuse-security＠opensuse.org 05 May '20

05 May '20

openSUSE Security Update: Security update for sqliteodbc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0612-1 Rating: important References: #1171041 Cross-References: CVE-2020-12050 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sqliteodbc fixes the following issues: Security issue fixed: - CVE-2020-12050: Fixed a privilege escalation vulnerability (boo#1171041). Non-security issues fixed: - Update to version 0.9996 * update to SQLite 3.22.0 * fixes in handling DDL in SQLExecDirect() et.al., thanks Andre Mikulec for testing * cleanup utf8/unicode conversion functions Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-612=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sqliteodbc-0.9996-bp151.4.3.1 sqliteodbc-doc-0.9996-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-12050.html https://bugzilla.suse.com/1171041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0609-1: Security update for python-typed-ast
by opensuse-security＠opensuse.org 04 May '20

04 May '20

openSUSE Security Update: Security update for python-typed-ast ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0609-1 Rating: low References: #1161562 #1161563 #1163532 Cross-References: CVE-2019-19274 CVE-2019-19275 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package (bsc#1163532). Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read (bsc#1161562). - CVE-2019-19275: Fixed an out-of-bounds read (bsc#1161563). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-609=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): python3-typed-ast-1.3.1-bp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-19274.html https://www.suse.com/security/cve/CVE-2019-19275.html https://bugzilla.suse.com/1161562 https://bugzilla.suse.com/1161563 https://bugzilla.suse.com/1163532 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0607-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 03 May '20

03 May '20

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0607-1 Rating: moderate References: #1072697 #1100694 Cross-References: CVE-2017-13098 CVE-2018-1000613 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bouncycastle fixes the following issues: Version update to 1.60: * CVE-2018-1000613: Use of Externally-ControlledInput to Select Classes or Code (boo#1100694) * Release notes: http://www.bouncycastle.org/releasenotes.html Version update to 1.59: * CVE-2017-13098: Fix against Bleichenbacher oracle when not using the lightweight APIs (boo#1072697). * Release notes: http://www.bouncycastle.org/releasenotes.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-607=1 Package List: - openSUSE Leap 15.1 (noarch): bouncycastle-1.60-lp151.3.3.1 bouncycastle-javadoc-1.60-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-13098.html https://www.suse.com/security/cve/CVE-2018-1000613.html https://bugzilla.suse.com/1072697 https://bugzilla.suse.com/1100694 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0606-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 03 May '20

03 May '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0606-1 Rating: moderate References: #1162687 #1162689 #1162691 Cross-References: CVE-2019-12528 CVE-2020-8449 CVE-2020-8450 CVE-2020-8517 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for squid to version 4.10 fixes the following issues: Security issues fixed: - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway (bsc#1162689). - CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8450: Fixed a buffer overflow when squid is acting as reverse-proxy (bsc#1162687). - CVE-2020-8517: Fixed a buffer overflow in ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691). Non-security issue fixed: - Improved cache handling with chunked responses. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-606=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.10-lp151.2.14.1 squid-debuginfo-4.10-lp151.2.14.1 squid-debugsource-4.10-lp151.2.14.1 References: https://www.suse.com/security/cve/CVE-2019-12528.html https://www.suse.com/security/cve/CVE-2020-8449.html https://www.suse.com/security/cve/CVE-2020-8450.html https://www.suse.com/security/cve/CVE-2020-8517.html https://bugzilla.suse.com/1162687 https://bugzilla.suse.com/1162689 https://bugzilla.suse.com/1162691 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0604-1: important: Security update for chromium
by opensuse-security＠opensuse.org 03 May '20

03 May '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0604-1 Rating: important References: #1170107 Cross-References: CVE-2020-0561 CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 CVE-2020-6462 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 81.0.4044.129 (boo#1170107): - CVE-2020-0561: Fixed a use after free in storage - CVE-2020-6462: Fixed a use after free in task scheduling - CVE-2020-6459: Fixed a use after free in payments - CVE-2020-6460: Fixed an insufficient data validation in URL formatting - CVE-2020-6458: Fixed an out of bounds read and write in PDFium Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-604=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-604=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-81.0.4044.129-lp151.2.85.1 chromedriver-debuginfo-81.0.4044.129-lp151.2.85.1 chromium-81.0.4044.129-lp151.2.85.1 chromium-debuginfo-81.0.4044.129-lp151.2.85.1 chromium-debugsource-81.0.4044.129-lp151.2.85.1 - openSUSE Backports SLE-15-SP1 (x86_64): chromedriver-81.0.4044.129-bp151.3.75.1 chromedriver-debuginfo-81.0.4044.129-bp151.3.75.1 chromium-81.0.4044.129-bp151.3.75.1 chromium-debuginfo-81.0.4044.129-bp151.3.75.1 chromium-debugsource-81.0.4044.129-bp151.3.75.1 References: https://www.suse.com/security/cve/CVE-2020-0561.html https://www.suse.com/security/cve/CVE-2020-6458.html https://www.suse.com/security/cve/CVE-2020-6459.html https://www.suse.com/security/cve/CVE-2020-6460.html https://www.suse.com/security/cve/CVE-2020-6462.html https://bugzilla.suse.com/1170107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0