June 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0851-1: moderate: Security update for xmlgraphics-batik
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for xmlgraphics-batik ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0851-1 Rating: moderate References: #1172961 Cross-References: CVE-2019-17566 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmlgraphics-batik fixes the following issues: - CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-851=1 Package List: - openSUSE Leap 15.1 (noarch): xmlgraphics-batik-1.9-lp151.6.3.1 xmlgraphics-batik-demo-1.9-lp151.6.3.1 xmlgraphics-batik-rasterizer-1.9-lp151.6.3.1 xmlgraphics-batik-slideshow-1.9-lp151.6.3.1 xmlgraphics-batik-squiggle-1.9-lp151.6.3.1 xmlgraphics-batik-svgpp-1.9-lp151.6.3.1 xmlgraphics-batik-ttf2svg-1.9-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-17566.html https://bugzilla.suse.com/1172961 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0849-1: important: Security update for fwupd
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for fwupd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0849-1 Rating: important References: #1172643 Cross-References: CVE-2020-10759 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fwupd fixes the following issues: - CVE-2020-10759: Fixed a potential PGP signature bypass, which could have led to installation of unsigned firmware (bsc#1172643) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-849=1 Package List: - openSUSE Leap 15.1 (x86_64): dfu-tool-1.0.9-lp151.2.3.1 dfu-tool-debuginfo-1.0.9-lp151.2.3.1 fwupd-1.0.9-lp151.2.3.1 fwupd-debuginfo-1.0.9-lp151.2.3.1 fwupd-debugsource-1.0.9-lp151.2.3.1 fwupd-devel-1.0.9-lp151.2.3.1 libfwupd2-1.0.9-lp151.2.3.1 libfwupd2-debuginfo-1.0.9-lp151.2.3.1 typelib-1_0-Fwupd-2_0-1.0.9-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): fwupd-lang-1.0.9-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10759.html https://bugzilla.suse.com/1172643 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0846-1: moderate: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 22 Jun '20

22 Jun '20

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0846-1 Rating: moderate References: #1172377 Cross-References: CVE-2020-13401 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Docker was updated to 19.03.11-ce runc was updated to version 1.0.0-rc10 containerd was updated to version 1.2.13 - CVE-2020-13401: Fixed an issue where an attacker with CAP_NET_RAW capability, could have crafted IPv6 router advertisements, and spoof external IPv6 hosts, resulting in obtaining sensitive information or causing denial of service (bsc#1172377). This update was imported from the SUSE:SLE-15:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-846=1 Package List: - openSUSE Leap 15.1 (x86_64): containerd-1.2.13-lp151.2.12.1 containerd-ctr-1.2.13-lp151.2.12.1 docker-19.03.11_ce-lp151.2.18.1 docker-debuginfo-19.03.11_ce-lp151.2.18.1 docker-libnetwork-0.7.0.1+gitr2902_153d0769a118-lp151.2.12.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2902_153d0769a118-lp151.2.12.1 docker-runc-1.0.0rc10+gitr3981_dc9208a3303f-lp151.3.21.1 docker-runc-debuginfo-1.0.0rc10+gitr3981_dc9208a3303f-lp151.3.21.1 docker-test-19.03.11_ce-lp151.2.18.1 docker-test-debuginfo-19.03.11_ce-lp151.2.18.1 golang-github-docker-libnetwork-0.7.0.1+gitr2902_153d0769a118-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): docker-bash-completion-19.03.11_ce-lp151.2.18.1 docker-zsh-completion-19.03.11_ce-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-13401.html https://bugzilla.suse.com/1172377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0836-1: moderate: Security update for rmt-server
by opensuse-security＠opensuse.org 19 Jun '20

19 Jun '20

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0836-1 Rating: moderate References: #1165548 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for rmt-server to version 2.5.7 fixes the following issues: - Fixed a local denial of service (bsc#1165548). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-836=1 Package List: - openSUSE Leap 15.1 (x86_64): rmt-server-2.5.7-lp151.2.15.1 rmt-server-config-2.5.7-lp151.2.15.1 rmt-server-debuginfo-2.5.7-lp151.2.15.1 rmt-server-debugsource-2.5.7-lp151.2.15.1 rmt-server-pubcloud-2.5.7-lp151.2.15.1 References: https://bugzilla.suse.com/1165548 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0832-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Jun '20

18 Jun '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0832-1 Rating: important References: #1170107 #1171910 #1171975 #1172496 Cross-References: CVE-2020-6463 CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 CVE-2020-6493 CVE-2020-6494 CVE-2020-6495 CVE-2020-6496 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496): * CVE-2020-6463: Use after free in ANGLE (boo#1170107 boo#1171975). * CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21 * CVE-2020-6466: Use after free in media. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-04-26 * CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song on 2020-04-06 * CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake Corina of Seaside Security, Chani Jindal of Shellphish on 2020-04-30 * CVE-2020-6469: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-02 * CVE-2020-6470: Insufficient validation of untrusted input in clipboard. Reported by Michał Bentkowski of Securitum on 2020-03-30 * CVE-2020-6471: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-08 * CVE-2020-6472: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-25 * CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by Soroush Karami and Panagiotis Ilia on 2020-02-06 * CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-03-07 * CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil Zhani on 2019-10-31 * CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by Alexandre Le Borgne on 2019-12-18 * CVE-2020-6477: Inappropriate implementation in installer. Reported by RACK911 Labs on 2019-03-26 * CVE-2020-6478: Inappropriate implementation in full screen. Reported by Khalil Zhani on 2019-12-24 * CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong Zhaochen of andsecurity.cn on 2020-01-14 * CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by Marvin Witt on 2020-02-21 * CVE-2020-6481: Insufficient policy enforcement in URL formatting. Reported by Rayyan Bijoora on 2020-04-07 * CVE-2020-6482: Insufficient policy enforcement in developer tools. Reported by Abdulrahman Alqabandi (@qab) on 2017-12-17 * CVE-2020-6483: Insufficient policy enforcement in payments. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-23 * CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by Artem Zinenko on 2020-01-26 * CVE-2020-6485: Insufficient data validation in media router. Reported by Sergei Glazunov of Google Project Zero on 2020-01-30 * CVE-2020-6486: Insufficient policy enforcement in navigations. Reported by David Erceg on 2020-02-24 * CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by Jun Kokatsu (@shhnjk) on 2015-10-06 * CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by David Erceg on 2020-01-21 * CVE-2020-6489: Inappropriate implementation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-02-10 * CVE-2020-6490: Insufficient data validation in loader. Reported by Twitter on 2019-12-19 * CVE-2020-6491: Incorrect security UI in site information. Reported by Sultan Haikal M.A on 2020-02-07 * CVE-2020-6493: Use after free in WebAuthentication. * CVE-2020-6494: Incorrect security UI in payments. * CVE-2020-6495: Insufficient policy enforcement in developer tools. * CVE-2020-6496: Use after free in payments. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-832=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-83.0.4103.97-bp151.3.85.1 chromium-83.0.4103.97-bp151.3.85.1 References: https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6465.html https://www.suse.com/security/cve/CVE-2020-6466.html https://www.suse.com/security/cve/CVE-2020-6467.html https://www.suse.com/security/cve/CVE-2020-6468.html https://www.suse.com/security/cve/CVE-2020-6469.html https://www.suse.com/security/cve/CVE-2020-6470.html https://www.suse.com/security/cve/CVE-2020-6471.html https://www.suse.com/security/cve/CVE-2020-6472.html https://www.suse.com/security/cve/CVE-2020-6473.html https://www.suse.com/security/cve/CVE-2020-6474.html https://www.suse.com/security/cve/CVE-2020-6475.html https://www.suse.com/security/cve/CVE-2020-6476.html https://www.suse.com/security/cve/CVE-2020-6477.html https://www.suse.com/security/cve/CVE-2020-6478.html https://www.suse.com/security/cve/CVE-2020-6479.html https://www.suse.com/security/cve/CVE-2020-6480.html https://www.suse.com/security/cve/CVE-2020-6481.html https://www.suse.com/security/cve/CVE-2020-6482.html https://www.suse.com/security/cve/CVE-2020-6483.html https://www.suse.com/security/cve/CVE-2020-6484.html https://www.suse.com/security/cve/CVE-2020-6485.html https://www.suse.com/security/cve/CVE-2020-6486.html https://www.suse.com/security/cve/CVE-2020-6487.html https://www.suse.com/security/cve/CVE-2020-6488.html https://www.suse.com/security/cve/CVE-2020-6489.html https://www.suse.com/security/cve/CVE-2020-6490.html https://www.suse.com/security/cve/CVE-2020-6491.html https://www.suse.com/security/cve/CVE-2020-6493.html https://www.suse.com/security/cve/CVE-2020-6494.html https://www.suse.com/security/cve/CVE-2020-6495.html https://www.suse.com/security/cve/CVE-2020-6496.html https://bugzilla.suse.com/1170107 https://bugzilla.suse.com/1171910 https://bugzilla.suse.com/1171975 https://bugzilla.suse.com/1172496 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0827-1: important: Security update for adns
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for adns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0827-1 Rating: important References: #1172265 Cross-References: CVE-2017-9103 CVE-2017-9104 CVE-2017-9105 CVE-2017-9106 CVE-2017-9107 CVE-2017-9108 CVE-2017-9109 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for adns fixes the following issues: - CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver which could have led to remote code execution (bsc#1172265). - CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of service (bsc#1172265). - CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265). - CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-827=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): adns-1.5.1-lp151.3.3.1 adns-debuginfo-1.5.1-lp151.3.3.1 adns-debugsource-1.5.1-lp151.3.3.1 libadns-devel-1.5.1-lp151.3.3.1 libadns1-1.5.1-lp151.3.3.1 libadns1-debuginfo-1.5.1-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libadns-devel-32bit-1.5.1-lp151.3.3.1 libadns1-32bit-1.5.1-lp151.3.3.1 libadns1-32bit-debuginfo-1.5.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-9103.html https://www.suse.com/security/cve/CVE-2017-9104.html https://www.suse.com/security/cve/CVE-2017-9105.html https://www.suse.com/security/cve/CVE-2017-9106.html https://www.suse.com/security/cve/CVE-2017-9107.html https://www.suse.com/security/cve/CVE-2017-9108.html https://www.suse.com/security/cve/CVE-2017-9109.html https://bugzilla.suse.com/1172265 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0831-1: important: Security update for libEMF
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for libEMF ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0831-1 Rating: important References: #1171496 #1171497 #1171498 #1171499 Cross-References: CVE-2020-11863 CVE-2020-11864 CVE-2020-11865 CVE-2020-11866 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libEMF fixes the following issues: - CVE-2020-11863: Fixed an issue which could have led to denial of service (bsc#1171496). - CVE-2020-11864: Fixed an issue which could have led to denial of service (bsc#1171499). - CVE-2020-11865: Fixed an out of bounds memory access (bsc#1171497). - CVE-2020-11866: Fixed a use after free (bsc#1171498). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-831=1 Package List: - openSUSE Leap 15.1 (x86_64): libEMF-debuginfo-1.0.7-lp151.3.3.1 libEMF-debugsource-1.0.7-lp151.3.3.1 libEMF-devel-1.0.7-lp151.3.3.1 libEMF-utils-1.0.7-lp151.3.3.1 libEMF-utils-debuginfo-1.0.7-lp151.3.3.1 libEMF1-1.0.7-lp151.3.3.1 libEMF1-debuginfo-1.0.7-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-11863.html https://www.suse.com/security/cve/CVE-2020-11864.html https://www.suse.com/security/cve/CVE-2020-11865.html https://www.suse.com/security/cve/CVE-2020-11866.html https://bugzilla.suse.com/1171496 https://bugzilla.suse.com/1171497 https://bugzilla.suse.com/1171498 https://bugzilla.suse.com/1171499 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0825-1: Security update for file-roller
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for file-roller ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0825-1 Rating: low References: #1151585 #1169428 Cross-References: CVE-2019-16680 CVE-2020-11736 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for file-roller fixes the following issues: - CVE-2020-11736: Fixed a directory traversal vulnerability due to improper checking whether a file's parent is an external symlink (bsc#1169428). - CVE-2019-16680: Fixed a path traversal vulnerability which could have allowed an overwriting of a file during extraction (bsc#1151585). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-825=1 Package List: - openSUSE Leap 15.1 (x86_64): file-roller-3.26.2-lp151.4.3.1 file-roller-debuginfo-3.26.2-lp151.4.3.1 file-roller-debugsource-3.26.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): file-roller-lang-3.26.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16680.html https://www.suse.com/security/cve/CVE-2020-11736.html https://bugzilla.suse.com/1151585 https://bugzilla.suse.com/1169428 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0823-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0823-1 Rating: important References: #1170107 #1171910 #1171975 #1172496 Cross-References: CVE-2020-6463 CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 CVE-2020-6493 CVE-2020-6494 CVE-2020-6495 CVE-2020-6496 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496): * CVE-2020-6463: Use after free in ANGLE (boo#1170107 boo#1171975). * CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21 * CVE-2020-6466: Use after free in media. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-04-26 * CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song on 2020-04-06 * CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake Corina of Seaside Security, Chani Jindal of Shellphish on 2020-04-30 * CVE-2020-6469: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-02 * CVE-2020-6470: Insufficient validation of untrusted input in clipboard. Reported by Michał Bentkowski of Securitum on 2020-03-30 * CVE-2020-6471: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-08 * CVE-2020-6472: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-25 * CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by Soroush Karami and Panagiotis Ilia on 2020-02-06 * CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-03-07 * CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil Zhani on 2019-10-31 * CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by Alexandre Le Borgne on 2019-12-18 * CVE-2020-6477: Inappropriate implementation in installer. Reported by RACK911 Labs on 2019-03-26 * CVE-2020-6478: Inappropriate implementation in full screen. Reported by Khalil Zhani on 2019-12-24 * CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong Zhaochen of andsecurity.cn on 2020-01-14 * CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by Marvin Witt on 2020-02-21 * CVE-2020-6481: Insufficient policy enforcement in URL formatting. Reported by Rayyan Bijoora on 2020-04-07 * CVE-2020-6482: Insufficient policy enforcement in developer tools. Reported by Abdulrahman Alqabandi (@qab) on 2017-12-17 * CVE-2020-6483: Insufficient policy enforcement in payments. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-23 * CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by Artem Zinenko on 2020-01-26 * CVE-2020-6485: Insufficient data validation in media router. Reported by Sergei Glazunov of Google Project Zero on 2020-01-30 * CVE-2020-6486: Insufficient policy enforcement in navigations. Reported by David Erceg on 2020-02-24 * CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by Jun Kokatsu (@shhnjk) on 2015-10-06 * CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by David Erceg on 2020-01-21 * CVE-2020-6489: Inappropriate implementation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-02-10 * CVE-2020-6490: Insufficient data validation in loader. Reported by Twitter on 2019-12-19 * CVE-2020-6491: Incorrect security UI in site information. Reported by Sultan Haikal M.A on 2020-02-07 * CVE-2020-6493: Use after free in WebAuthentication. * CVE-2020-6494: Incorrect security UI in payments. * CVE-2020-6495: Insufficient policy enforcement in developer tools. * CVE-2020-6496: Use after free in payments. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-823=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-83.0.4103.97-lp151.2.96.1 chromedriver-debuginfo-83.0.4103.97-lp151.2.96.1 chromium-83.0.4103.97-lp151.2.96.1 chromium-debuginfo-83.0.4103.97-lp151.2.96.1 chromium-debugsource-83.0.4103.97-lp151.2.96.1 References: https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6465.html https://www.suse.com/security/cve/CVE-2020-6466.html https://www.suse.com/security/cve/CVE-2020-6467.html https://www.suse.com/security/cve/CVE-2020-6468.html https://www.suse.com/security/cve/CVE-2020-6469.html https://www.suse.com/security/cve/CVE-2020-6470.html https://www.suse.com/security/cve/CVE-2020-6471.html https://www.suse.com/security/cve/CVE-2020-6472.html https://www.suse.com/security/cve/CVE-2020-6473.html https://www.suse.com/security/cve/CVE-2020-6474.html https://www.suse.com/security/cve/CVE-2020-6475.html https://www.suse.com/security/cve/CVE-2020-6476.html https://www.suse.com/security/cve/CVE-2020-6477.html https://www.suse.com/security/cve/CVE-2020-6478.html https://www.suse.com/security/cve/CVE-2020-6479.html https://www.suse.com/security/cve/CVE-2020-6480.html https://www.suse.com/security/cve/CVE-2020-6481.html https://www.suse.com/security/cve/CVE-2020-6482.html https://www.suse.com/security/cve/CVE-2020-6483.html https://www.suse.com/security/cve/CVE-2020-6484.html https://www.suse.com/security/cve/CVE-2020-6485.html https://www.suse.com/security/cve/CVE-2020-6486.html https://www.suse.com/security/cve/CVE-2020-6487.html https://www.suse.com/security/cve/CVE-2020-6488.html https://www.suse.com/security/cve/CVE-2020-6489.html https://www.suse.com/security/cve/CVE-2020-6490.html https://www.suse.com/security/cve/CVE-2020-6491.html https://www.suse.com/security/cve/CVE-2020-6493.html https://www.suse.com/security/cve/CVE-2020-6494.html https://www.suse.com/security/cve/CVE-2020-6495.html https://www.suse.com/security/cve/CVE-2020-6496.html https://bugzilla.suse.com/1170107 https://bugzilla.suse.com/1171910 https://bugzilla.suse.com/1171975 https://bugzilla.suse.com/1172496 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0805-1: moderate: Security update for libupnp
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0805-1 Rating: moderate References: #1172625 Cross-References: CVE-2020-13848 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libupnp fixes the following issues: - CVE-2020-13848: A NULL ptr denial of service via crafted SSDP message was fixed (boo#1172625) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-805=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libupnp-debugsource-1.6.25-lp151.3.3.1 libupnp-devel-1.6.25-lp151.3.3.1 libupnp6-1.6.25-lp151.3.3.1 libupnp6-debuginfo-1.6.25-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libupnp6-32bit-1.6.25-lp151.3.3.1 libupnp6-32bit-debuginfo-1.6.25-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13848.html https://bugzilla.suse.com/1172625 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0