June 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0788-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 10 Jun '20

10 Jun '20

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0788-1 Rating: moderate References: #1171271 Cross-References: CVE-2020-12672 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2020-12672: heap-based buffer overflow in ReadMNGImage in coders/png.c. (boo#1171271) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-788=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): GraphicsMagick-1.3.29-bp151.5.15.1 GraphicsMagick-devel-1.3.29-bp151.5.15.1 libGraphicsMagick++-Q16-12-1.3.29-bp151.5.15.1 libGraphicsMagick++-devel-1.3.29-bp151.5.15.1 libGraphicsMagick-Q16-3-1.3.29-bp151.5.15.1 libGraphicsMagick3-config-1.3.29-bp151.5.15.1 libGraphicsMagickWand-Q16-2-1.3.29-bp151.5.15.1 perl-GraphicsMagick-1.3.29-bp151.5.15.1 References: https://www.suse.com/security/cve/CVE-2020-12672.html https://bugzilla.suse.com/1171271 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0786-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0786-1 Rating: moderate References: #1160687 #1165870 #1167463 #1171997 Cross-References: CVE-2020-12801 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for libreoffice to 6.4.4.2 fixes the following issues: Security issue fixed: - CVE-2020-12801: Fixed an issue with encrypted MSOffice documents that could be accidentally saved unencrypted (bsc#1171997). Non-security issues fixed: - Elements on title page mixed up (bsc#1160687). - Image shadow that should be invisible shown as extraneous line below (bsc#1165870). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-786=1 Package List: - openSUSE Leap 15.1 (x86_64): libreoffice-6.4.4.2-lp151.3.15.1 libreoffice-base-6.4.4.2-lp151.3.15.1 libreoffice-base-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-base-drivers-firebird-6.4.4.2-lp151.3.15.1 libreoffice-base-drivers-firebird-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-base-drivers-postgresql-6.4.4.2-lp151.3.15.1 libreoffice-base-drivers-postgresql-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-calc-6.4.4.2-lp151.3.15.1 libreoffice-calc-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-calc-extensions-6.4.4.2-lp151.3.15.1 libreoffice-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-debugsource-6.4.4.2-lp151.3.15.1 libreoffice-draw-6.4.4.2-lp151.3.15.1 libreoffice-draw-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-filters-optional-6.4.4.2-lp151.3.15.1 libreoffice-gnome-6.4.4.2-lp151.3.15.1 libreoffice-gnome-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-gtk3-6.4.4.2-lp151.3.15.1 libreoffice-gtk3-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-impress-6.4.4.2-lp151.3.15.1 libreoffice-impress-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-librelogo-6.4.4.2-lp151.3.15.1 libreoffice-mailmerge-6.4.4.2-lp151.3.15.1 libreoffice-math-6.4.4.2-lp151.3.15.1 libreoffice-math-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-officebean-6.4.4.2-lp151.3.15.1 libreoffice-officebean-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-pyuno-6.4.4.2-lp151.3.15.1 libreoffice-pyuno-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-qt5-6.4.4.2-lp151.3.15.1 libreoffice-qt5-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-sdk-6.4.4.2-lp151.3.15.1 libreoffice-sdk-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-sdk-doc-6.4.4.2-lp151.3.15.1 libreoffice-writer-6.4.4.2-lp151.3.15.1 libreoffice-writer-debuginfo-6.4.4.2-lp151.3.15.1 libreoffice-writer-extensions-6.4.4.2-lp151.3.15.1 libreofficekit-6.4.4.2-lp151.3.15.1 libreofficekit-devel-6.4.4.2-lp151.3.15.1 - openSUSE Leap 15.1 (noarch): libreoffice-branding-upstream-6.4.4.2-lp151.3.15.1 libreoffice-gdb-pretty-printers-6.4.4.2-lp151.3.15.1 libreoffice-glade-6.4.4.2-lp151.3.15.1 libreoffice-icon-themes-6.4.4.2-lp151.3.15.1 libreoffice-l10n-af-6.4.4.2-lp151.3.15.1 libreoffice-l10n-am-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ar-6.4.4.2-lp151.3.15.1 libreoffice-l10n-as-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ast-6.4.4.2-lp151.3.15.1 libreoffice-l10n-be-6.4.4.2-lp151.3.15.1 libreoffice-l10n-bg-6.4.4.2-lp151.3.15.1 libreoffice-l10n-bn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-bn_IN-6.4.4.2-lp151.3.15.1 libreoffice-l10n-bo-6.4.4.2-lp151.3.15.1 libreoffice-l10n-br-6.4.4.2-lp151.3.15.1 libreoffice-l10n-brx-6.4.4.2-lp151.3.15.1 libreoffice-l10n-bs-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ca-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ca_valencia-6.4.4.2-lp151.3.15.1 libreoffice-l10n-cs-6.4.4.2-lp151.3.15.1 libreoffice-l10n-cy-6.4.4.2-lp151.3.15.1 libreoffice-l10n-da-6.4.4.2-lp151.3.15.1 libreoffice-l10n-de-6.4.4.2-lp151.3.15.1 libreoffice-l10n-dgo-6.4.4.2-lp151.3.15.1 libreoffice-l10n-dsb-6.4.4.2-lp151.3.15.1 libreoffice-l10n-dz-6.4.4.2-lp151.3.15.1 libreoffice-l10n-el-6.4.4.2-lp151.3.15.1 libreoffice-l10n-en-6.4.4.2-lp151.3.15.1 libreoffice-l10n-en_GB-6.4.4.2-lp151.3.15.1 libreoffice-l10n-en_ZA-6.4.4.2-lp151.3.15.1 libreoffice-l10n-eo-6.4.4.2-lp151.3.15.1 libreoffice-l10n-es-6.4.4.2-lp151.3.15.1 libreoffice-l10n-et-6.4.4.2-lp151.3.15.1 libreoffice-l10n-eu-6.4.4.2-lp151.3.15.1 libreoffice-l10n-fa-6.4.4.2-lp151.3.15.1 libreoffice-l10n-fi-6.4.4.2-lp151.3.15.1 libreoffice-l10n-fr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-fy-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ga-6.4.4.2-lp151.3.15.1 libreoffice-l10n-gd-6.4.4.2-lp151.3.15.1 libreoffice-l10n-gl-6.4.4.2-lp151.3.15.1 libreoffice-l10n-gu-6.4.4.2-lp151.3.15.1 libreoffice-l10n-gug-6.4.4.2-lp151.3.15.1 libreoffice-l10n-he-6.4.4.2-lp151.3.15.1 libreoffice-l10n-hi-6.4.4.2-lp151.3.15.1 libreoffice-l10n-hr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-hsb-6.4.4.2-lp151.3.15.1 libreoffice-l10n-hu-6.4.4.2-lp151.3.15.1 libreoffice-l10n-id-6.4.4.2-lp151.3.15.1 libreoffice-l10n-is-6.4.4.2-lp151.3.15.1 libreoffice-l10n-it-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ja-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ka-6.4.4.2-lp151.3.15.1 libreoffice-l10n-kab-6.4.4.2-lp151.3.15.1 libreoffice-l10n-kk-6.4.4.2-lp151.3.15.1 libreoffice-l10n-km-6.4.4.2-lp151.3.15.1 libreoffice-l10n-kmr_Latn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-kn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ko-6.4.4.2-lp151.3.15.1 libreoffice-l10n-kok-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ks-6.4.4.2-lp151.3.15.1 libreoffice-l10n-lb-6.4.4.2-lp151.3.15.1 libreoffice-l10n-lo-6.4.4.2-lp151.3.15.1 libreoffice-l10n-lt-6.4.4.2-lp151.3.15.1 libreoffice-l10n-lv-6.4.4.2-lp151.3.15.1 libreoffice-l10n-mai-6.4.4.2-lp151.3.15.1 libreoffice-l10n-mk-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ml-6.4.4.2-lp151.3.15.1 libreoffice-l10n-mn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-mni-6.4.4.2-lp151.3.15.1 libreoffice-l10n-mr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-my-6.4.4.2-lp151.3.15.1 libreoffice-l10n-nb-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ne-6.4.4.2-lp151.3.15.1 libreoffice-l10n-nl-6.4.4.2-lp151.3.15.1 libreoffice-l10n-nn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-nr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-nso-6.4.4.2-lp151.3.15.1 libreoffice-l10n-oc-6.4.4.2-lp151.3.15.1 libreoffice-l10n-om-6.4.4.2-lp151.3.15.1 libreoffice-l10n-or-6.4.4.2-lp151.3.15.1 libreoffice-l10n-pa-6.4.4.2-lp151.3.15.1 libreoffice-l10n-pl-6.4.4.2-lp151.3.15.1 libreoffice-l10n-pt_BR-6.4.4.2-lp151.3.15.1 libreoffice-l10n-pt_PT-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ro-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ru-6.4.4.2-lp151.3.15.1 libreoffice-l10n-rw-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sa_IN-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sat-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sd-6.4.4.2-lp151.3.15.1 libreoffice-l10n-si-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sid-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sk-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sl-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sq-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ss-6.4.4.2-lp151.3.15.1 libreoffice-l10n-st-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sv-6.4.4.2-lp151.3.15.1 libreoffice-l10n-sw_TZ-6.4.4.2-lp151.3.15.1 libreoffice-l10n-szl-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ta-6.4.4.2-lp151.3.15.1 libreoffice-l10n-te-6.4.4.2-lp151.3.15.1 libreoffice-l10n-tg-6.4.4.2-lp151.3.15.1 libreoffice-l10n-th-6.4.4.2-lp151.3.15.1 libreoffice-l10n-tn-6.4.4.2-lp151.3.15.1 libreoffice-l10n-tr-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ts-6.4.4.2-lp151.3.15.1 libreoffice-l10n-tt-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ug-6.4.4.2-lp151.3.15.1 libreoffice-l10n-uk-6.4.4.2-lp151.3.15.1 libreoffice-l10n-uz-6.4.4.2-lp151.3.15.1 libreoffice-l10n-ve-6.4.4.2-lp151.3.15.1 libreoffice-l10n-vec-6.4.4.2-lp151.3.15.1 libreoffice-l10n-vi-6.4.4.2-lp151.3.15.1 libreoffice-l10n-xh-6.4.4.2-lp151.3.15.1 libreoffice-l10n-zh_CN-6.4.4.2-lp151.3.15.1 libreoffice-l10n-zh_TW-6.4.4.2-lp151.3.15.1 libreoffice-l10n-zu-6.4.4.2-lp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-12801.html https://bugzilla.suse.com/1160687 https://bugzilla.suse.com/1165870 https://bugzilla.suse.com/1167463 https://bugzilla.suse.com/1171997 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0785-1: moderate: Security update for axel
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for axel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0785-1 Rating: moderate References: #1172159 Cross-References: CVE-2020-13614 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for axel fixes the following issues: axel was updated to 2.17.8: * CVE-2020-13614: SSL Certificate Hostnames were not verified (boo#1172159) * Replaced progressbar line clearing with terminal control sequence * Fixed parsing of Content-Disposition HTTP header * Fixed User-Agent HTTP header never being included Update to version 2.17.7: - Buildsystem fixes - Fixed release date for man-pages on BSD - Explicitly close TCP sockets on SSL connections too - Fixed HTTP basic auth header generation - Changed the default progress report to "alternate output mode" - Improved English in README.md Update to version 2.17.6: - Fixed handling of non-recoverable HTTP errors - Cleanup of connection setup code - Fixed manpage reproducibility issue - Use tracker instead of PTS from Debian Update to version 2.17.5: - Fixed progress indicator misalignment - Cleaned up the wget-like progress output code - Improved progress output flushing Update to version 2.17.4: - Fixed build with bionic libc (Android) - TCP Fast Open support on Linux - TCP code cleanup - Removed dependency on libm - Data types and format strings cleanup - String handling cleanup - Format string checking GCC attributes added - Buildsystem fixes and improvements - Updates to the documentation - Updated all translations - Fixed Footnotes in documentation - Fixed a typo in README.md Update to version 2.17.3: - Builds now use canonical host triplet instead of `uname -s` - Fixed build on Darwin / Mac OS X - Fixed download loops caused by last byte pointer being off by one - Fixed linking issues (i18n and posix threads) - Updated build instructions - Code cleanup - Added autoconf-archive to building instructions Update to version 2.17.2: - Fixed HTTP request-ranges to be zero-based - Fixed typo "too may" -> "too many" - Replaced malloc + memset calls with calloc - Sanitize progress bar buffer len passed to memset Update to version 2.17.1: - Fixed comparison error in axel_divide - Make sure maxconns is at least 1 Update to version 2.17: - Fixed composition of URLs in redirections - Fixed request range calculation - Updated all translations - Updated build documentation - Major code cleanup - Cleanup of alternate progress output - Removed global string buffers - Fixed min and max macros - Moved User-Agent header to conf->add_header - Use integers for speed ratio and delay calculation - Added support for parsing IPv6 literal hostname - Fixed filename extraction from URL - Fixed request-target message to proxy - Handle secure protocol's schema even with SSL disabled - Fixed Content-Disposition filename value decoding - Strip leading hyphens in extracted filenames This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-785=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): axel-2.17.8-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-13614.html https://bugzilla.suse.com/1172159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0784-1: moderate: Security update for xawtv
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for xawtv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0784-1 Rating: moderate References: #1171655 Cross-References: CVE-2020-13696 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xawtv fixes the following issues: - CVE-2020-13696: Fixed an issue in setuid-root program that which could have allowed arbitrary file existence tests and open() with O_RDWR (boo#1171655). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-784=1 Package List: - openSUSE Leap 15.1 (x86_64): alevtd-3.103-lp151.3.3.1 alevtd-debuginfo-3.103-lp151.3.3.1 motv-3.103-lp151.3.3.1 motv-debuginfo-3.103-lp151.3.3.1 pia-3.103-lp151.3.3.1 pia-debuginfo-3.103-lp151.3.3.1 tv-common-3.103-lp151.3.3.1 tv-common-debuginfo-3.103-lp151.3.3.1 v4l-conf-3.103-lp151.3.3.1 v4l-conf-debuginfo-3.103-lp151.3.3.1 v4l-tools-3.103-lp151.3.3.1 v4l-tools-debuginfo-3.103-lp151.3.3.1 xawtv-3.103-lp151.3.3.1 xawtv-debuginfo-3.103-lp151.3.3.1 xawtv-debugsource-3.103-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13696.html https://bugzilla.suse.com/1171655 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0779-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0779-1 Rating: moderate References: #1171271 Cross-References: CVE-2020-12672 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2020-12672: heap-based buffer overflow in ReadMNGImage in coders/png.c. (boo#1171271) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-779=1 Package List: - openSUSE Leap 15.1 (x86_64): GraphicsMagick-1.3.29-lp151.4.20.1 GraphicsMagick-debuginfo-1.3.29-lp151.4.20.1 GraphicsMagick-debugsource-1.3.29-lp151.4.20.1 GraphicsMagick-devel-1.3.29-lp151.4.20.1 libGraphicsMagick++-Q16-12-1.3.29-lp151.4.20.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp151.4.20.1 libGraphicsMagick++-devel-1.3.29-lp151.4.20.1 libGraphicsMagick-Q16-3-1.3.29-lp151.4.20.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp151.4.20.1 libGraphicsMagick3-config-1.3.29-lp151.4.20.1 libGraphicsMagickWand-Q16-2-1.3.29-lp151.4.20.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp151.4.20.1 perl-GraphicsMagick-1.3.29-lp151.4.20.1 perl-GraphicsMagick-debuginfo-1.3.29-lp151.4.20.1 References: https://www.suse.com/security/cve/CVE-2020-12672.html https://bugzilla.suse.com/1171271 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0780-1: Security update for libcroco
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for libcroco ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0780-1 Rating: low References: #1043898 #1043899 Cross-References: CVE-2017-8834 CVE-2017-8871 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcroco fixes the following issues: Security issues fixed: - CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898). - CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-780=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libcroco-0.6.12-lp151.4.3.1 libcroco-0_6-3-0.6.12-lp151.4.3.1 libcroco-0_6-3-debuginfo-0.6.12-lp151.4.3.1 libcroco-debuginfo-0.6.12-lp151.4.3.1 libcroco-debugsource-0.6.12-lp151.4.3.1 libcroco-devel-0.6.12-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libcroco-0_6-3-32bit-0.6.12-lp151.4.3.1 libcroco-0_6-3-32bit-debuginfo-0.6.12-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-8834.html https://www.suse.com/security/cve/CVE-2017-8871.html https://bugzilla.suse.com/1043898 https://bugzilla.suse.com/1043899 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0778-1: moderate: Security update for axel
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for axel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0778-1 Rating: moderate References: #1172159 Cross-References: CVE-2020-13614 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for axel fixes the following issues: axel was updated to 2.17.8: * CVE-2020-13614: SSL Certificate Hostnames were not verified (boo#1172159) * Replaced progressbar line clearing with terminal control sequence * Fixed parsing of Content-Disposition HTTP header * Fixed User-Agent HTTP header never being included Update to version 2.17.7: - Buildsystem fixes - Fixed release date for man-pages on BSD - Explicitly close TCP sockets on SSL connections too - Fixed HTTP basic auth header generation - Changed the default progress report to "alternate output mode" - Improved English in README.md Update to version 2.17.6: - Fixed handling of non-recoverable HTTP errors - Cleanup of connection setup code - Fixed manpage reproducibility issue - Use tracker instead of PTS from Debian Update to version 2.17.5: - Fixed progress indicator misalignment - Cleaned up the wget-like progress output code - Improved progress output flushing Update to version 2.17.4: - Fixed build with bionic libc (Android) - TCP Fast Open support on Linux - TCP code cleanup - Removed dependency on libm - Data types and format strings cleanup - String handling cleanup - Format string checking GCC attributes added - Buildsystem fixes and improvements - Updates to the documentation - Updated all translations - Fixed Footnotes in documentation - Fixed a typo in README.md Update to version 2.17.3: - Builds now use canonical host triplet instead of `uname -s` - Fixed build on Darwin / Mac OS X - Fixed download loops caused by last byte pointer being off by one - Fixed linking issues (i18n and posix threads) - Updated build instructions - Code cleanup - Added autoconf-archive to building instructions Update to version 2.17.2: - Fixed HTTP request-ranges to be zero-based - Fixed typo "too may" -> "too many" - Replaced malloc + memset calls with calloc - Sanitize progress bar buffer len passed to memset Update to version 2.17.1: - Fixed comparison error in axel_divide - Make sure maxconns is at least 1 Update to version 2.17: - Fixed composition of URLs in redirections - Fixed request range calculation - Updated all translations - Updated build documentation - Major code cleanup - Cleanup of alternate progress output - Removed global string buffers - Fixed min and max macros - Moved User-Agent header to conf->add_header - Use integers for speed ratio and delay calculation - Added support for parsing IPv6 literal hostname - Fixed filename extraction from URL - Fixed request-target message to proxy - Handle secure protocol's schema even with SSL disabled - Fixed Content-Disposition filename value decoding - Strip leading hyphens in extracted filenames Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-778=1 Package List: - openSUSE Leap 15.1 (x86_64): axel-2.17.8-lp151.3.3.1 axel-debuginfo-2.17.8-lp151.3.3.1 axel-debugsource-2.17.8-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13614.html https://bugzilla.suse.com/1172159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0781-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 08 Jun '20

08 Jun '20

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0781-1 Rating: moderate References: #1172021 Cross-References: CVE-2019-19956 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxml2 fixes the following issues: - CVE-2019-19956: Reverted the upstream fix for this memory leak because it introduced other, more severe vulnerabilities (bsc#1172021). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-781=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxml2-2-2.9.7-lp151.5.12.1 libxml2-2-debuginfo-2.9.7-lp151.5.12.1 libxml2-debugsource-2.9.7-lp151.5.12.1 libxml2-devel-2.9.7-lp151.5.12.1 libxml2-tools-2.9.7-lp151.5.12.1 libxml2-tools-debuginfo-2.9.7-lp151.5.12.1 python-libxml2-python-debugsource-2.9.7-lp151.5.12.1 python2-libxml2-python-2.9.7-lp151.5.12.1 python2-libxml2-python-debuginfo-2.9.7-lp151.5.12.1 python3-libxml2-python-2.9.7-lp151.5.12.1 python3-libxml2-python-debuginfo-2.9.7-lp151.5.12.1 - openSUSE Leap 15.1 (x86_64): libxml2-2-32bit-2.9.7-lp151.5.12.1 libxml2-2-32bit-debuginfo-2.9.7-lp151.5.12.1 libxml2-devel-32bit-2.9.7-lp151.5.12.1 - openSUSE Leap 15.1 (noarch): libxml2-doc-2.9.7-lp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2019-19956.html https://bugzilla.suse.com/1172021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0763-1: moderate: Security update for python-rpyc
by opensuse-security＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Security Update: Security update for python-rpyc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0763-1 Rating: moderate References: #1152987 Cross-References: CVE-2019-16328 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rpyc to 4.1.5 fixes the following issues: Security issue fixed: - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution (boo#1152987). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-763=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-rpyc-4.1.5-bp151.2.3.1 python3-rpyc-4.1.5-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-16328.html https://bugzilla.suse.com/1152987 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0764-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0764-1 Rating: moderate References: #1171363 #682920 Cross-References: CVE-2020-12108 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2020-12108: Fixed a content injection bug (boo#1171363). Non-security issue fixed: - Don't default to invalid hosts for DEFAULT_EMAIL_HOST (boo#682920) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-764=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mailman-2.1.29-bp151.5.9.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/682920 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0