July 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1035-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1035-1 Rating: moderate References: #1173018 Cross-References: CVE-2020-14147 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis fixes the following issues: - CVE-2020-14147: Context dependent attackers with permission to run Lua code in a Redis session could have caused a denial of service (memory corruption and application crash) or possibly bypass sandbox restrictions (boo#1173018) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1035=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1035=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1035=1 Package List: - openSUSE Leap 15.1 (x86_64): redis-4.0.14-lp151.2.6.1 redis-debuginfo-4.0.14-lp151.2.6.1 redis-debugsource-4.0.14-lp151.2.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): redis-4.0.14-bp151.3.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): redis-4.0.14-24.1 References: https://www.suse.com/security/cve/CVE-2020-14147.html https://bugzilla.suse.com/1173018 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1037-1: important: Security update for singularity
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1037-1 Rating: important References: #1125369 #1128598 #1159550 #1174148 #1174150 #1174152 Cross-References: CVE-2019-11328 CVE-2019-19724 CVE-2020-13845 CVE-2020-13846 CVE-2020-13847 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for singularity fixes the following issues: - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems: - CVE-2020-13845, boo#1174150 In Singularity 3.x versions below 3.6.0, issues allow the ECL to be bypassed by a malicious user. - CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all / -a option to singularity verify returns success even when some objects in a SIF container are not signed, or cannot be verified. - CVE-2020-13847, boo#1174152 In Singularity 3.x versions below 3.6.0, Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file, allowing an attacker to cause unexpected behavior. A signed container may verify successfully, even when it has been modified in ways that could be exploited to cause malicious behavior. - New features / functionalities - A new '--legacy-insecure' flag to verify allows verification of SIF signatures in the old, insecure format. - A new '-l / --logs' flag for instance list that shows the paths to instance STDERR / STDOUT log files. - The --json output of instance list now include paths to STDERR / STDOUT log files. - Singularity now supports the execution of minimal Docker/OCI containers that do not contain /bin/sh, e.g. docker://hello-world. - A new cache structure is used that is concurrency safe on a filesystem that supports atomic rename. If you downgrade to Singularity 3.5 or older after using 3.6 you will need to run singularity cache clean. - A plugin system rework adds new hook points that will allow the development of plugins that modify behavior of the runtime. An image driver concept is introduced for plugins to support new ways of handling image and overlay mounts. Plugins built for <=3.5 are not compatible with 3.6. - The --bind flag can now bind directories from a SIF or ext3 image into a container. - The --fusemount feature to mount filesystems to a container via FUSE drivers is now a supported feature (previously an experimental hidden flag). - This permits users to mount e.g. sshfs and cvmfs filesystems to the container at runtime. - A new -c/--config flag allows an alternative singularity.conf to be specified by the root user, or all users in an unprivileged installation. - A new --env flag allows container environment variables to be set via the Singularity command line. - A new --env-file flag allows container environment variables to be set from a specified file. - A new --days flag for cache clean allows removal of items older than a specified number of days. Replaces the --name flag which is not generally useful as the cache entries are stored by hash, not a friendly name. - Changed defaults / behaviours - New signature format (see security fixes above). - Fixed spacing of singularity instance list to be dynamically changing based off of input lengths instead of fixed number of spaces to account for long instance names. - Environment variables prefixed with SINGULARITYENV_ always take precedence over variables without SINGULARITYENV_ prefix. - The %post build section inherits environment variables from the base image. - %files from ... will now follow symlinks for sources that are directly specified, or directly resolved from a glob pattern. It will not follow symlinks found through directory traversal. This mirrors Docker multi-stage COPY behaviour. - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated inside container and any symlinks in the CWD path are not resolved anymore to determine the destination path inside container. - The %test build section is executed the same manner as singularity test image. --fusemount with the container: default directive will foreground the FUSE process. Use container-daemon: for previous behavior. - Deprecate -a / --all option to sign/verify as new signature behavior makes this the default. - For more information about upstream changes, please check: https://github.com/hpcng/singularity/blob/master/CHANGELOG.md - Removed --name flag for cache clean; replaced with --days. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1037=1 Package List: - openSUSE Leap 15.1 (x86_64): singularity-3.6.0-lp151.2.6.1 singularity-debuginfo-3.6.0-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-11328.html https://www.suse.com/security/cve/CVE-2019-19724.html https://www.suse.com/security/cve/CVE-2020-13845.html https://www.suse.com/security/cve/CVE-2020-13846.html https://www.suse.com/security/cve/CVE-2020-13847.html https://bugzilla.suse.com/1125369 https://bugzilla.suse.com/1128598 https://bugzilla.suse.com/1159550 https://bugzilla.suse.com/1174148 https://bugzilla.suse.com/1174150 https://bugzilla.suse.com/1174152 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1035-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1035-1 Rating: moderate References: #1173018 Cross-References: CVE-2020-14147 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis fixes the following issues: - CVE-2020-14147: Context dependent attackers with permission to run Lua code in a Redis session could have caused a denial of service (memory corruption and application crash) or possibly bypass sandbox restrictions (boo#1173018) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1035=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): redis-4.0.14-24.1 References: https://www.suse.com/security/cve/CVE-2020-14147.html https://bugzilla.suse.com/1173018 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1034-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Jul '20

22 Jul '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1034-1 Rating: moderate References: #1173948 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: - Mozilla Firefox 78.0.2 MFSA 2020-28 (bsc#1173948) * MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR * Fixed: Security fix * Fixed: Fixed an accessibility regression in reader mode (bmo#1650922) * Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981) * Fixed: Fixed a regression opening certain external applications (bmo#1650162) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1034=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.0.2-lp152.2.9.1 MozillaFirefox-branding-upstream-78.0.2-lp152.2.9.1 MozillaFirefox-buildsymbols-78.0.2-lp152.2.9.1 MozillaFirefox-debuginfo-78.0.2-lp152.2.9.1 MozillaFirefox-debugsource-78.0.2-lp152.2.9.1 MozillaFirefox-devel-78.0.2-lp152.2.9.1 MozillaFirefox-translations-common-78.0.2-lp152.2.9.1 MozillaFirefox-translations-other-78.0.2-lp152.2.9.1 References: https://bugzilla.suse.com/1173948 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1027-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 21 Jul '20

21 Jul '20

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1027-1 Rating: moderate References: #1171862 Cross-References: CVE-2020-12823 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: - CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1027=1 Package List: - openSUSE Leap 15.2 (noarch): openconnect-lang-7.08-lp152.9.4.2 - openSUSE Leap 15.2 (x86_64): openconnect-7.08-lp152.9.4.2 openconnect-debuginfo-7.08-lp152.9.4.2 openconnect-debugsource-7.08-lp152.9.4.2 openconnect-devel-7.08-lp152.9.4.2 openconnect-doc-7.08-lp152.9.4.2 References: https://www.suse.com/security/cve/CVE-2020-12823.html https://bugzilla.suse.com/1171862 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1025-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 21 Jul '20

21 Jul '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1025-1 Rating: important References: #1173477 #1173691 #1173694 #1173700 #1173701 #1173743 #1173874 #1173875 #1173876 #1173880 Cross-References: CVE-2017-18922 CVE-2018-21247 CVE-2019-20839 CVE-2019-20840 CVE-2020-14397 CVE-2020-14398 CVE-2020-14399 CVE-2020-14400 CVE-2020-14401 CVE-2020-14402 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: - security update - added patches fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. + LibVNCServer-CVE-2020-14402,14403,14404.patch fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1025=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp152.9.8.1 LibVNCServer-devel-0.9.10-lp152.9.8.1 libvncclient0-0.9.10-lp152.9.8.1 libvncclient0-debuginfo-0.9.10-lp152.9.8.1 libvncserver0-0.9.10-lp152.9.8.1 libvncserver0-debuginfo-0.9.10-lp152.9.8.1 References: https://www.suse.com/security/cve/CVE-2017-18922.html https://www.suse.com/security/cve/CVE-2018-21247.html https://www.suse.com/security/cve/CVE-2019-20839.html https://www.suse.com/security/cve/CVE-2019-20840.html https://www.suse.com/security/cve/CVE-2020-14397.html https://www.suse.com/security/cve/CVE-2020-14398.html https://www.suse.com/security/cve/CVE-2020-14399.html https://www.suse.com/security/cve/CVE-2020-14400.html https://www.suse.com/security/cve/CVE-2020-14401.html https://www.suse.com/security/cve/CVE-2020-14402.html https://bugzilla.suse.com/1173477 https://bugzilla.suse.com/1173691 https://bugzilla.suse.com/1173694 https://bugzilla.suse.com/1173700 https://bugzilla.suse.com/1173701 https://bugzilla.suse.com/1173743 https://bugzilla.suse.com/1173874 https://bugzilla.suse.com/1173875 https://bugzilla.suse.com/1173876 https://bugzilla.suse.com/1173880 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1023-1: important: Security update for ldb, samba
by opensuse-security＠opensuse.org 21 Jul '20

21 Jul '20

openSUSE Security Update: Security update for ldb, samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1023-1 Rating: important References: #1141320 #1162680 #1169095 #1169521 #1169850 #1169851 #1171437 #1172307 #1173159 #1173160 #1173161 #1173359 #1174120 Cross-References: CVE-2020-10700 CVE-2020-10704 CVE-2020-10730 CVE-2020-10745 CVE-2020-10760 CVE-2020-14303 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 7 fixes is now available. Description: This update for ldb, samba fixes the following issues: Changes in samba: - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227). - Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307); - Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437); - Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521); Changes in ldb: - Update to version 2.0.12 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159). + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + lib/ldb: add unit test for ldb_ldap internal code. - Update to version 2.0.11 + lib ldb: lmdb init var before calling mdb_reader_check. + lib ldb: lmdb clear stale readers on write txn start; (bso#14330). + ldb tests: Confirm lmdb free list handling This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1023=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ctdb-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ctdb-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ctdb-pcp-pmda-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ctdb-pcp-pmda-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ctdb-tests-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ctdb-tests-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 ldb-debugsource-2.0.12-lp152.2.3.1 ldb-tools-2.0.12-lp152.2.3.1 ldb-tools-debuginfo-2.0.12-lp152.2.3.1 libdcerpc-binding0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-binding0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-samr-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-samr0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-samr0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libldb-devel-2.0.12-lp152.2.3.1 libldb2-2.0.12-lp152.2.3.1 libldb2-debuginfo-2.0.12-lp152.2.3.1 libndr-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-krb5pac-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-krb5pac0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-krb5pac0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-nbt-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-nbt0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-nbt0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-standard-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-standard0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-standard0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-credentials-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-credentials0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-credentials0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-errors-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-errors0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-errors0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-hostconfig-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-hostconfig0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-hostconfig0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-passdb-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-passdb0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-passdb0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy-python3-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy0-python3-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy0-python3-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-util-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-util0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-util0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamdb-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamdb0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamdb0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbclient-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbclient0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbclient0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbconf-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbconf0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbconf0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbldap-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbldap2-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbldap2-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libtevent-util-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libtevent-util0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libtevent-util0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libwbclient-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libwbclient0-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libwbclient0-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 python3-ldb-2.0.12-lp152.2.3.1 python3-ldb-debuginfo-2.0.12-lp152.2.3.1 python3-ldb-devel-2.0.12-lp152.2.3.1 samba-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-ad-dc-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-ad-dc-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-client-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-client-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-core-devel-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-debugsource-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-dsdb-modules-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-dsdb-modules-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-python3-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-python3-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-python3-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-python3-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-test-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-test-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-winbind-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-winbind-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): libdcerpc-binding0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-binding0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-samr0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc-samr0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libdcerpc0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libldb2-32bit-2.0.12-lp152.2.3.1 libldb2-32bit-debuginfo-2.0.12-lp152.2.3.1 libndr-krb5pac0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-krb5pac0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-nbt0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-nbt0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-standard0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr-standard0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libndr0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi-devel-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libnetapi0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-credentials0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-credentials0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-errors0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-errors0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-hostconfig0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-hostconfig0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-passdb0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-passdb0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy0-python3-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-policy0-python3-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-util0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamba-util0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamdb0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsamdb0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbclient0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbclient0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbconf0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbconf0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbldap2-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libsmbldap2-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libtevent-util0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libtevent-util0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libwbclient0-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 libwbclient0-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 python3-ldb-32bit-2.0.12-lp152.2.3.1 python3-ldb-32bit-debuginfo-2.0.12-lp152.2.3.1 samba-ad-dc-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-ad-dc-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-ceph-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-ceph-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-client-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-client-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-python3-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-libs-python3-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-winbind-32bit-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 samba-winbind-32bit-debuginfo-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): samba-doc-4.11.11+git.180.2cf3b203f07-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-10700.html https://www.suse.com/security/cve/CVE-2020-10704.html https://www.suse.com/security/cve/CVE-2020-10730.html https://www.suse.com/security/cve/CVE-2020-10745.html https://www.suse.com/security/cve/CVE-2020-10760.html https://www.suse.com/security/cve/CVE-2020-14303.html https://bugzilla.suse.com/1141320 https://bugzilla.suse.com/1162680 https://bugzilla.suse.com/1169095 https://bugzilla.suse.com/1169521 https://bugzilla.suse.com/1169850 https://bugzilla.suse.com/1169851 https://bugzilla.suse.com/1171437 https://bugzilla.suse.com/1172307 https://bugzilla.suse.com/1173159 https://bugzilla.suse.com/1173160 https://bugzilla.suse.com/1173161 https://bugzilla.suse.com/1173359 https://bugzilla.suse.com/1174120 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1022-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1022-1 Rating: moderate References: #1171696 Cross-References: CVE-2020-1945 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ant fixes the following issues: - CVE-2020-1945: Fixed an inseure temorary file vulnerability which could have potentially leaked sensitive information (bsc#1171696). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1022=1 Package List: - openSUSE Leap 15.2 (noarch): ant-1.10.7-lp152.2.3.1 ant-antlr-1.10.7-lp152.2.3.1 ant-apache-bcel-1.10.7-lp152.2.3.1 ant-apache-bsf-1.10.7-lp152.2.3.1 ant-apache-log4j-1.10.7-lp152.2.3.1 ant-apache-oro-1.10.7-lp152.2.3.1 ant-apache-regexp-1.10.7-lp152.2.3.1 ant-apache-resolver-1.10.7-lp152.2.3.1 ant-apache-xalan2-1.10.7-lp152.2.3.1 ant-commons-logging-1.10.7-lp152.2.3.1 ant-commons-net-1.10.7-lp152.2.3.1 ant-imageio-1.10.7-lp152.2.3.1 ant-javamail-1.10.7-lp152.2.3.1 ant-jdepend-1.10.7-lp152.2.3.1 ant-jmf-1.10.7-lp152.2.3.1 ant-jsch-1.10.7-lp152.2.3.1 ant-junit-1.10.7-lp152.2.3.1 ant-junit5-1.10.7-lp152.2.3.1 ant-manual-1.10.7-lp152.2.3.1 ant-scripts-1.10.7-lp152.2.3.1 ant-swing-1.10.7-lp152.2.3.1 ant-testutil-1.10.7-lp152.2.3.1 ant-xz-1.10.7-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-1945.html https://bugzilla.suse.com/1171696 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1021-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1021-1 Rating: important References: #1174189 Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1021=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-84.0.4147.89-lp151.2.109.1 chromedriver-debuginfo-84.0.4147.89-lp151.2.109.1 chromium-84.0.4147.89-lp151.2.109.1 chromium-debuginfo-84.0.4147.89-lp151.2.109.1 chromium-debugsource-84.0.4147.89-lp151.2.109.1 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html https://bugzilla.suse.com/1174189 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1020-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Jul '20

20 Jul '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1020-1 Rating: important References: #1174189 Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1020=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-84.0.4147.89-lp152.2.6.2 chromedriver-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-84.0.4147.89-lp152.2.6.2 chromium-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-debugsource-84.0.4147.89-lp152.2.6.2 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html https://bugzilla.suse.com/1174189 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0