June 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0806-1: moderate: Security update for libntlm
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libntlm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0806-1 Rating: moderate References: #1153669 Cross-References: CVE-2019-17455 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libntlm fixes the following issues: Update to release 1.6: * CVE-2019-17455: Fixed a buffer overflow in buildSmbNtlmAuth* function. (boo#1153669) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-806=1 Package List: - openSUSE Leap 15.1 (x86_64): libntlm-debugsource-1.6-lp151.3.3.1 libntlm-devel-1.6-lp151.3.3.1 libntlm0-1.6-lp151.3.3.1 libntlm0-debuginfo-1.6-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-17455.html https://bugzilla.suse.com/1153669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0819-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0819-1 Rating: moderate References: #1169039 #1169040 Cross-References: CVE-2019-20637 CVE-2020-11653 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for varnish fixes the following issues: - CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040) - CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-819=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libvarnishapi2-6.2.1-bp151.4.6.1 varnish-6.2.1-bp151.4.6.1 varnish-devel-6.2.1-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-20637.html https://www.suse.com/security/cve/CVE-2020-11653.html https://bugzilla.suse.com/1169039 https://bugzilla.suse.com/1169040 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0821-1: moderate: Security update for libupnp
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0821-1 Rating: moderate References: #1172625 Cross-References: CVE-2020-13848 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libupnp fixes the following issues: - CVE-2020-13848: A NULL ptr denial of service via crafted SSDP message was fixed (boo#1172625) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-821=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libupnp-devel-1.6.25-bp151.4.3.1 libupnp6-1.6.25-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libupnp6-64bit-1.6.25-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-13848.html https://bugzilla.suse.com/1172625 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0816-1: moderate: Security update for libntlm
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libntlm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0816-1 Rating: moderate References: #1153669 Cross-References: CVE-2019-17455 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libntlm fixes the following issues: Update to release 1.6: * CVE-2019-17455: Fixed a buffer overflow in buildSmbNtlmAuth* function. (boo#1153669) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-816=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libntlm-devel-1.6-bp151.4.3.1 libntlm0-1.6-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-17455.html https://bugzilla.suse.com/1153669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0820-1: moderate: Security update for prboom-plus
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for prboom-plus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0820-1 Rating: moderate References: #1171974 Cross-References: CVE-2019-20797 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prboom-plus fixes the following issues: - CVE-2019-20797: Fixed a buffer overflow in client and server code responsible for handling received UDP packets (boo#1171974) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-820=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): prboom-plus-2.5.1.4-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-20797.html https://bugzilla.suse.com/1171974 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0807-1: moderate: Security update for prboom-plus
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for prboom-plus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0807-1 Rating: moderate References: #1171974 Cross-References: CVE-2019-20797 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prboom-plus fixes the following issues: - CVE-2019-20797: Fixed a buffer overflow in client and server code responsible for handling received UDP packets (boo#1171974) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-807=1 Package List: - openSUSE Leap 15.1 (x86_64): prboom-plus-2.5.1.4-lp151.3.3.1 prboom-plus-debuginfo-2.5.1.4-lp151.3.3.1 prboom-plus-debugsource-2.5.1.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-20797.html https://bugzilla.suse.com/1171974 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0808-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0808-1 Rating: moderate References: #1169039 #1169040 Cross-References: CVE-2019-20637 CVE-2020-11653 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for varnish fixes the following issues: - CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040) - CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-808=1 Package List: - openSUSE Leap 15.1 (x86_64): libvarnishapi2-6.2.1-lp151.3.6.1 libvarnishapi2-debuginfo-6.2.1-lp151.3.6.1 varnish-6.2.1-lp151.3.6.1 varnish-debuginfo-6.2.1-lp151.3.6.1 varnish-debugsource-6.2.1-lp151.3.6.1 varnish-devel-6.2.1-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-20637.html https://www.suse.com/security/cve/CVE-2020-11653.html https://bugzilla.suse.com/1169039 https://bugzilla.suse.com/1169040 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0818-1: important: Security update for xen
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0818-1 Rating: important References: #1027519 #1157490 #1167007 #1172205 Cross-References: CVE-2020-0543 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for xen to version 4.12.3 fixes the following issues: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1172205). - Added support for new 64bit libxl memory API (bsc#1167007 and bsc#1157490). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-818=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.3_02-lp151.2.18.2 xen-devel-4.12.3_02-lp151.2.18.2 xen-libs-4.12.3_02-lp151.2.18.2 xen-libs-debuginfo-4.12.3_02-lp151.2.18.2 xen-tools-domU-4.12.3_02-lp151.2.18.2 xen-tools-domU-debuginfo-4.12.3_02-lp151.2.18.2 - openSUSE Leap 15.1 (x86_64): xen-4.12.3_02-lp151.2.18.2 xen-doc-html-4.12.3_02-lp151.2.18.2 xen-libs-32bit-4.12.3_02-lp151.2.18.2 xen-libs-32bit-debuginfo-4.12.3_02-lp151.2.18.2 xen-tools-4.12.3_02-lp151.2.18.2 xen-tools-debuginfo-4.12.3_02-lp151.2.18.2 References: https://www.suse.com/security/cve/CVE-2020-0543.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1157490 https://bugzilla.suse.com/1167007 https://bugzilla.suse.com/1172205 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0802-1: critical: Security update for nodejs8
by opensuse-security＠opensuse.org 13 Jun '20

13 Jun '20

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0802-1 Rating: critical References: #1166916 #1172442 #1172443 Cross-References: CVE-2020-11080 CVE-2020-7598 CVE-2020-8174 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: - CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443). - CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). - CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-802=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs8-8.17.0-lp151.2.15.1 nodejs8-debuginfo-8.17.0-lp151.2.15.1 nodejs8-debugsource-8.17.0-lp151.2.15.1 nodejs8-devel-8.17.0-lp151.2.15.1 npm8-8.17.0-lp151.2.15.1 - openSUSE Leap 15.1 (noarch): nodejs8-docs-8.17.0-lp151.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-11080.html https://www.suse.com/security/cve/CVE-2020-7598.html https://www.suse.com/security/cve/CVE-2020-8174.html https://bugzilla.suse.com/1166916 https://bugzilla.suse.com/1172442 https://bugzilla.suse.com/1172443 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0800-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 13 Jun '20

13 Jun '20

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0800-1 Rating: important References: #1160398 #1169511 #1171352 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version jdk8u252 fixes the following issues: - CVE-2020-2754: Forward references to Nashorn (bsc#1169511) - CVE-2020-2755: Improve Nashorn matching (bsc#1169511) - CVE-2020-2756: Better mapping of serial ENUMs (bsc#1169511) - CVE-2020-2757: Less Blocking Array Queues (bsc#1169511) - CVE-2020-2773: Better signatures in XML (bsc#1169511) - CVE-2020-2781: Improve TLS session handling (bsc#1169511) - CVE-2020-2800: Better Headings for HTTP Servers (bsc#1169511) - CVE-2020-2803: Enhance buffering of byte buffers (bsc#1169511) - CVE-2020-2805: Enhance typing of methods (bsc#1169511) - CVE-2020-2830: Better Scanner conversions (bsc#1169511) - Ignore whitespaces after the header or footer in PEM X.509 cert (bsc#1171352) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-800=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-accessibility-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-debuginfo-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-debugsource-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-demo-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-devel-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-headless-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.252-lp151.2.12.1 java-1_8_0-openjdk-src-1.8.0.252-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.252-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-2754.html https://www.suse.com/security/cve/CVE-2020-2755.html https://www.suse.com/security/cve/CVE-2020-2756.html https://www.suse.com/security/cve/CVE-2020-2757.html https://www.suse.com/security/cve/CVE-2020-2773.html https://www.suse.com/security/cve/CVE-2020-2781.html https://www.suse.com/security/cve/CVE-2020-2800.html https://www.suse.com/security/cve/CVE-2020-2803.html https://www.suse.com/security/cve/CVE-2020-2805.html https://www.suse.com/security/cve/CVE-2020-2830.html https://bugzilla.suse.com/1160398 https://bugzilla.suse.com/1169511 https://bugzilla.suse.com/1171352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0