June 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0865-1: moderate: Security update for uftpd
by opensuse-security＠opensuse.org 25 Jun '20

25 Jun '20

openSUSE Security Update: Security update for uftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0865-1 Rating: moderate References: #1172959 Cross-References: CVE-2020-14149 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for uftpd fixes the following issues: uftpd was updated to version 2.12. Changes: * Use common log message format and log level when user enters an invalid path. This unfortunately affects changes introduced in v2.11 to increase logging at default log level. Security fixes: - CVE-2020-14149: When entering an invalid directory with the FTP command CWD, a NULL ptr was deref. in a DBG() message even though the log level is set to a value lower than LOG_DEBUG. This caused uftpd to crash and cause denial of service. Depending on the init/inetd system used this could be permanent. (boo#1172959) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-865=1 Package List: - openSUSE Leap 15.1 (x86_64): uftpd-2.12-lp151.2.6.1 uftpd-debuginfo-2.12-lp151.2.6.1 uftpd-debugsource-2.12-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-14149.html https://bugzilla.suse.com/1172959 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0861-1: moderate: Security update for rubygem-bundler
by opensuse-security＠opensuse.org 24 Jun '20

24 Jun '20

openSUSE Security Update: Security update for rubygem-bundler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0861-1 Rating: moderate References: #1143436 Cross-References: CVE-2019-3881 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-bundler fixes the following issue: - CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-861=1 Package List: - openSUSE Leap 15.2 (x86_64): ruby2.5-rubygem-bundler-1.16.1-lp152.4.3.1 ruby2.5-rubygem-bundler-doc-1.16.1-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-3881.html https://bugzilla.suse.com/1143436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0856-1: important: Security update for chromium
by opensuse-security＠opensuse.org 24 Jun '20

24 Jun '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0856-1 Rating: important References: #1173029 #1173063 Cross-References: CVE-2020-6505 CVE-2020-6506 CVE-2020-6507 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 83.0.4103.106 (boo#1173029): * CVE-2020-6505: Use after free in speech * CVE-2020-6506: Insufficient policy enforcement in WebView * CVE-2020-6507: Out of bounds write in V8 - Enforce to not use system borders bsc#1173063 This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-856=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-83.0.4103.106-bp151.3.88.1 chromium-83.0.4103.106-bp151.3.88.1 References: https://www.suse.com/security/cve/CVE-2020-6505.html https://www.suse.com/security/cve/CVE-2020-6506.html https://www.suse.com/security/cve/CVE-2020-6507.html https://bugzilla.suse.com/1173029 https://bugzilla.suse.com/1173063 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2154-1: moderate: Security update for opera
by opensuse-security＠opensuse.org 24 Jun '20

24 Jun '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2154-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Opera was updated to version 63.0.3368.88: - DNA-79103 Saving link to bookmarks saves it to Other bookmarks folder - DNA-79455 Crash at views::MenuController:: FindNextSelectableMenuItem(views::MenuItemView*, int, views:: MenuController::SelectionIncrementDirectionType, bool) - DNA-79579 Continuous packages using new_mac_bundle_structure do not run - DNA-79611 Update opauto_paths.py:GetResourcesDir - DNA-79621 Add support for new bundle structure to old autoupdate clients - DNA-80131 Sign Opera Helper(GPU).app opera_components/tracking_data/tracking_data_paths.cc - DNA-80638 Cherry-pick fix for CreditCardTest. UpdateFromImportedCard_ExpiredVerifiedCardUpdatedWithSameName - DNA-80801 Very slow tab deletion process Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2019-2154=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-63.0.3368.88-lp152.2.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0841-1: important: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 24 Jun '20

24 Jun '20

openSUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0841-1 Rating: important References: #1169511 #1171352 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: java-1_8_0-openj9 was updated to Java 8.0 Service Refresh 6 Fix Pack 10 (bsc#1169511) - CVE-2020-2830: Improved Scanner conversions - CVE-2020-2805: Enhanced typing of methods - CVE-2020-2803: Enhanced buffering of byte buffers - CVE-2020-2800: Improved Headings for HTTP Servers - CVE-2020-2781: Improved TLS session handling - CVE-2020-2773: Fixed an issue which could have allowed an attacker to caise denial of service - CVE-2020-2757: Less Blocking Array Queues - CVE-2020-2756: Improved mapping of serial ENUMs - CVE-2020-2755: Improved Nashorn matching - CVE-2020-2754: Forwarded references to Nashorn - The pack200 and unpack200 alternatives should be slaves of java (bsc#1171352). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-841=1 Package List: - openSUSE Leap 15.2 (noarch): java-1_8_0-openj9-javadoc-1.8.0.252-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): java-1_8_0-openj9-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-accessibility-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-debuginfo-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-debugsource-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-demo-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-devel-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-headless-1.8.0.252-lp152.2.3.1 java-1_8_0-openj9-src-1.8.0.252-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-2754.html https://www.suse.com/security/cve/CVE-2020-2755.html https://www.suse.com/security/cve/CVE-2020-2756.html https://www.suse.com/security/cve/CVE-2020-2757.html https://www.suse.com/security/cve/CVE-2020-2773.html https://www.suse.com/security/cve/CVE-2020-2781.html https://www.suse.com/security/cve/CVE-2020-2800.html https://www.suse.com/security/cve/CVE-2020-2803.html https://www.suse.com/security/cve/CVE-2020-2805.html https://www.suse.com/security/cve/CVE-2020-2830.html https://bugzilla.suse.com/1169511 https://bugzilla.suse.com/1171352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0854-1: important: Security update for mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 24 Jun '20

24 Jun '20

openSUSE Security Update: Security update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0854-1 Rating: important References: #1159819 #1169746 #1171978 Cross-References: CVE-2019-17006 CVE-2020-12399 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53 - CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978). - CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819). Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_rele ase_notes mozilla-nspr to version 4.25 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-854=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.53-lp151.2.23.1 libfreebl3-debuginfo-3.53-lp151.2.23.1 libfreebl3-hmac-3.53-lp151.2.23.1 libsoftokn3-3.53-lp151.2.23.1 libsoftokn3-debuginfo-3.53-lp151.2.23.1 libsoftokn3-hmac-3.53-lp151.2.23.1 mozilla-nspr-4.25-lp151.2.9.1 mozilla-nspr-debuginfo-4.25-lp151.2.9.1 mozilla-nspr-debugsource-4.25-lp151.2.9.1 mozilla-nspr-devel-4.25-lp151.2.9.1 mozilla-nss-3.53-lp151.2.23.1 mozilla-nss-certs-3.53-lp151.2.23.1 mozilla-nss-certs-debuginfo-3.53-lp151.2.23.1 mozilla-nss-debuginfo-3.53-lp151.2.23.1 mozilla-nss-debugsource-3.53-lp151.2.23.1 mozilla-nss-devel-3.53-lp151.2.23.1 mozilla-nss-sysinit-3.53-lp151.2.23.1 mozilla-nss-sysinit-debuginfo-3.53-lp151.2.23.1 mozilla-nss-tools-3.53-lp151.2.23.1 mozilla-nss-tools-debuginfo-3.53-lp151.2.23.1 - openSUSE Leap 15.1 (x86_64): libfreebl3-32bit-3.53-lp151.2.23.1 libfreebl3-32bit-debuginfo-3.53-lp151.2.23.1 libfreebl3-hmac-32bit-3.53-lp151.2.23.1 libsoftokn3-32bit-3.53-lp151.2.23.1 libsoftokn3-32bit-debuginfo-3.53-lp151.2.23.1 libsoftokn3-hmac-32bit-3.53-lp151.2.23.1 mozilla-nspr-32bit-4.25-lp151.2.9.1 mozilla-nspr-32bit-debuginfo-4.25-lp151.2.9.1 mozilla-nss-32bit-3.53-lp151.2.23.1 mozilla-nss-32bit-debuginfo-3.53-lp151.2.23.1 mozilla-nss-certs-32bit-3.53-lp151.2.23.1 mozilla-nss-certs-32bit-debuginfo-3.53-lp151.2.23.1 mozilla-nss-sysinit-32bit-3.53-lp151.2.23.1 mozilla-nss-sysinit-32bit-debuginfo-3.53-lp151.2.23.1 References: https://www.suse.com/security/cve/CVE-2019-17006.html https://www.suse.com/security/cve/CVE-2020-12399.html https://bugzilla.suse.com/1159819 https://bugzilla.suse.com/1169746 https://bugzilla.suse.com/1171978 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0852-1: moderate: Security update for osc
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for osc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0852-1 Rating: moderate References: #1122675 Cross-References: CVE-2019-3681 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for osc to 0.169.1 fixes the following issues: Security issue fixed: - CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675). Non-security issues fixed: - Improved the speed and usability of osc bash completion. - improved some error messages. - osc add: support git@ (private github) or git:// URLs correctly. - Split dependson and whatdependson commands. - Added support for osc build --shell-cmd. - Added pkg-ccache support for osc build. - Added --ccache option to osc getbinaries This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-852=1 Package List: - openSUSE Leap 15.1 (noarch): osc-0.169.1-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2019-3681.html https://bugzilla.suse.com/1122675 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0847-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0847-1 Rating: moderate References: #1171999 Cross-References: CVE-2019-11048 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-847=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-mod_php7-7.2.5-lp151.6.28.1 apache2-mod_php7-debuginfo-7.2.5-lp151.6.28.1 php7-7.2.5-lp151.6.28.1 php7-bcmath-7.2.5-lp151.6.28.1 php7-bcmath-debuginfo-7.2.5-lp151.6.28.1 php7-bz2-7.2.5-lp151.6.28.1 php7-bz2-debuginfo-7.2.5-lp151.6.28.1 php7-calendar-7.2.5-lp151.6.28.1 php7-calendar-debuginfo-7.2.5-lp151.6.28.1 php7-ctype-7.2.5-lp151.6.28.1 php7-ctype-debuginfo-7.2.5-lp151.6.28.1 php7-curl-7.2.5-lp151.6.28.1 php7-curl-debuginfo-7.2.5-lp151.6.28.1 php7-dba-7.2.5-lp151.6.28.1 php7-dba-debuginfo-7.2.5-lp151.6.28.1 php7-debuginfo-7.2.5-lp151.6.28.1 php7-debugsource-7.2.5-lp151.6.28.1 php7-devel-7.2.5-lp151.6.28.1 php7-dom-7.2.5-lp151.6.28.1 php7-dom-debuginfo-7.2.5-lp151.6.28.1 php7-embed-7.2.5-lp151.6.28.1 php7-embed-debuginfo-7.2.5-lp151.6.28.1 php7-enchant-7.2.5-lp151.6.28.1 php7-enchant-debuginfo-7.2.5-lp151.6.28.1 php7-exif-7.2.5-lp151.6.28.1 php7-exif-debuginfo-7.2.5-lp151.6.28.1 php7-fastcgi-7.2.5-lp151.6.28.1 php7-fastcgi-debuginfo-7.2.5-lp151.6.28.1 php7-fileinfo-7.2.5-lp151.6.28.1 php7-fileinfo-debuginfo-7.2.5-lp151.6.28.1 php7-firebird-7.2.5-lp151.6.28.1 php7-firebird-debuginfo-7.2.5-lp151.6.28.1 php7-fpm-7.2.5-lp151.6.28.1 php7-fpm-debuginfo-7.2.5-lp151.6.28.1 php7-ftp-7.2.5-lp151.6.28.1 php7-ftp-debuginfo-7.2.5-lp151.6.28.1 php7-gd-7.2.5-lp151.6.28.1 php7-gd-debuginfo-7.2.5-lp151.6.28.1 php7-gettext-7.2.5-lp151.6.28.1 php7-gettext-debuginfo-7.2.5-lp151.6.28.1 php7-gmp-7.2.5-lp151.6.28.1 php7-gmp-debuginfo-7.2.5-lp151.6.28.1 php7-iconv-7.2.5-lp151.6.28.1 php7-iconv-debuginfo-7.2.5-lp151.6.28.1 php7-intl-7.2.5-lp151.6.28.1 php7-intl-debuginfo-7.2.5-lp151.6.28.1 php7-json-7.2.5-lp151.6.28.1 php7-json-debuginfo-7.2.5-lp151.6.28.1 php7-ldap-7.2.5-lp151.6.28.1 php7-ldap-debuginfo-7.2.5-lp151.6.28.1 php7-mbstring-7.2.5-lp151.6.28.1 php7-mbstring-debuginfo-7.2.5-lp151.6.28.1 php7-mysql-7.2.5-lp151.6.28.1 php7-mysql-debuginfo-7.2.5-lp151.6.28.1 php7-odbc-7.2.5-lp151.6.28.1 php7-odbc-debuginfo-7.2.5-lp151.6.28.1 php7-opcache-7.2.5-lp151.6.28.1 php7-opcache-debuginfo-7.2.5-lp151.6.28.1 php7-openssl-7.2.5-lp151.6.28.1 php7-openssl-debuginfo-7.2.5-lp151.6.28.1 php7-pcntl-7.2.5-lp151.6.28.1 php7-pcntl-debuginfo-7.2.5-lp151.6.28.1 php7-pdo-7.2.5-lp151.6.28.1 php7-pdo-debuginfo-7.2.5-lp151.6.28.1 php7-pgsql-7.2.5-lp151.6.28.1 php7-pgsql-debuginfo-7.2.5-lp151.6.28.1 php7-phar-7.2.5-lp151.6.28.1 php7-phar-debuginfo-7.2.5-lp151.6.28.1 php7-posix-7.2.5-lp151.6.28.1 php7-posix-debuginfo-7.2.5-lp151.6.28.1 php7-readline-7.2.5-lp151.6.28.1 php7-readline-debuginfo-7.2.5-lp151.6.28.1 php7-shmop-7.2.5-lp151.6.28.1 php7-shmop-debuginfo-7.2.5-lp151.6.28.1 php7-snmp-7.2.5-lp151.6.28.1 php7-snmp-debuginfo-7.2.5-lp151.6.28.1 php7-soap-7.2.5-lp151.6.28.1 php7-soap-debuginfo-7.2.5-lp151.6.28.1 php7-sockets-7.2.5-lp151.6.28.1 php7-sockets-debuginfo-7.2.5-lp151.6.28.1 php7-sodium-7.2.5-lp151.6.28.1 php7-sodium-debuginfo-7.2.5-lp151.6.28.1 php7-sqlite-7.2.5-lp151.6.28.1 php7-sqlite-debuginfo-7.2.5-lp151.6.28.1 php7-sysvmsg-7.2.5-lp151.6.28.1 php7-sysvmsg-debuginfo-7.2.5-lp151.6.28.1 php7-sysvsem-7.2.5-lp151.6.28.1 php7-sysvsem-debuginfo-7.2.5-lp151.6.28.1 php7-sysvshm-7.2.5-lp151.6.28.1 php7-sysvshm-debuginfo-7.2.5-lp151.6.28.1 php7-test-7.2.5-lp151.6.28.1 php7-tidy-7.2.5-lp151.6.28.1 php7-tidy-debuginfo-7.2.5-lp151.6.28.1 php7-tokenizer-7.2.5-lp151.6.28.1 php7-tokenizer-debuginfo-7.2.5-lp151.6.28.1 php7-wddx-7.2.5-lp151.6.28.1 php7-wddx-debuginfo-7.2.5-lp151.6.28.1 php7-xmlreader-7.2.5-lp151.6.28.1 php7-xmlreader-debuginfo-7.2.5-lp151.6.28.1 php7-xmlrpc-7.2.5-lp151.6.28.1 php7-xmlrpc-debuginfo-7.2.5-lp151.6.28.1 php7-xmlwriter-7.2.5-lp151.6.28.1 php7-xmlwriter-debuginfo-7.2.5-lp151.6.28.1 php7-xsl-7.2.5-lp151.6.28.1 php7-xsl-debuginfo-7.2.5-lp151.6.28.1 php7-zip-7.2.5-lp151.6.28.1 php7-zip-debuginfo-7.2.5-lp151.6.28.1 php7-zlib-7.2.5-lp151.6.28.1 php7-zlib-debuginfo-7.2.5-lp151.6.28.1 - openSUSE Leap 15.1 (noarch): php7-pear-7.2.5-lp151.6.28.1 php7-pear-Archive_Tar-7.2.5-lp151.6.28.1 References: https://www.suse.com/security/cve/CVE-2019-11048.html https://bugzilla.suse.com/1171999 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0850-1: important: Security update for perl
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0850-1 Rating: important References: #1171863 #1171864 #1171866 #1172348 Cross-References: CVE-2020-10543 CVE-2020-10878 CVE-2020-12723 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: - CVE-2020-10543: Fixed a heap buffer overflow in regular expression compiler which could have allowed overwriting of allocated memory with attacker's data (bsc#1171863). - CVE-2020-10878: Fixed multiple integer overflows which could have allowed the insertion of instructions into the compiled form of Perl regular expression (bsc#1171864). - CVE-2020-12723: Fixed an attacker's corruption of the intermediate language state of a compiled regular expression (bsc#1171866). - Fixed a bad warning in features.ph (bsc#1172348). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-850=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): perl-5.26.1-lp151.9.6.1 perl-base-5.26.1-lp151.9.6.1 perl-base-debuginfo-5.26.1-lp151.9.6.1 perl-debuginfo-5.26.1-lp151.9.6.1 perl-debugsource-5.26.1-lp151.9.6.1 - openSUSE Leap 15.1 (x86_64): perl-32bit-5.26.1-lp151.9.6.1 perl-32bit-debuginfo-5.26.1-lp151.9.6.1 perl-base-32bit-5.26.1-lp151.9.6.1 perl-base-32bit-debuginfo-5.26.1-lp151.9.6.1 - openSUSE Leap 15.1 (noarch): perl-doc-5.26.1-lp151.9.6.1 References: https://www.suse.com/security/cve/CVE-2020-10543.html https://www.suse.com/security/cve/CVE-2020-10878.html https://www.suse.com/security/cve/CVE-2020-12723.html https://bugzilla.suse.com/1171863 https://bugzilla.suse.com/1171864 https://bugzilla.suse.com/1171866 https://bugzilla.suse.com/1172348 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0845-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0845-1 Rating: important References: #1173029 #1173063 Cross-References: CVE-2020-6505 CVE-2020-6506 CVE-2020-6507 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 83.0.4103.106 (boo#1173029): * CVE-2020-6505: Use after free in speech * CVE-2020-6506: Insufficient policy enforcement in WebView * CVE-2020-6507: Out of bounds write in V8 - Enforce to not use system borders bsc#1173063 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-845=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-83.0.4103.106-lp151.2.101.1 chromedriver-debuginfo-83.0.4103.106-lp151.2.101.1 chromium-83.0.4103.106-lp151.2.101.1 chromium-debuginfo-83.0.4103.106-lp151.2.101.1 chromium-debugsource-83.0.4103.106-lp151.2.101.1 References: https://www.suse.com/security/cve/CVE-2020-6505.html https://www.suse.com/security/cve/CVE-2020-6506.html https://www.suse.com/security/cve/CVE-2020-6507.html https://bugzilla.suse.com/1173029 https://bugzilla.suse.com/1173063 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0