July 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1074-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1074-1 Rating: moderate References: #1159284 #1165572 #1167437 #1168340 #1169604 #1170104 #1170288 #1171906 #1172075 #1173072 #1174165 Cross-References: CVE-2018-15750 CVE-2018-15751 CVE-2020-11651 CVE-2020-11652 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for salt contains the following fixes: - Fix for TypeError in Tornado importer (bsc#1174165) - Require python3-distro only for TW (bsc#1173072) - Update to Salt version 3000: See release notes: https://docs.saltstack.com/en/latest/topics/releases/3000.html - Add docker.logout to docker execution module. (bsc#1165572) - Add option to enable/disable force refresh for zypper. - Add publish_batch to ClearFuncs exposed methods. - Adds test for zypper abbreviation fix. - Avoid segfault from "salt-api" under certain conditions of heavy load managing SSH minions. (bsc#1169604) - Avoid traceback on debug logging for swarm module. (bsc#1172075) - Batch mode now also correctly provides return value. (bsc#1168340) - Better import cache handline. - Do not make file.recurse state to fail when msgpack 0.5.4. (bsc#1167437) - Do not require vendored backports-abc. (bsc#1170288) - Fix errors from unit tests due NO_MOCK and NO_MOCK_REASON deprecation. - Fix for low rpm_lowpkg unit test. - Fix for temp folder definition in loader unit test. - Fix for unless requisite when pip is not installed. - Fix integration test failure for test_mod_del_repo_multiline_values. - Fix regression in service states with reload argument. - Fix tornado imports and missing _utils after rebasing patches. - Fix status attribute issue in aptpkg test. - Improved storage pool or network handling. - loop: fix variable names for until_no_eval. - Make "salt.ext.tornado.gen" to use "salt.ext.backports_abc" on Python 2. - Make setup.py script not to require setuptools greater than 9.1. - More robust remote port detection. - Prevent sporious "salt-api" stuck processes when managing SSH minions. because of logging deadlock. (bsc#1159284) - Python3.8 compatibility changes. - Removes unresolved merge conflict in yumpkg module. - Returns a the list of IPs filtered by the optional network list. - Revert broken changes to slspath made on Salt 3000 (saltstack/salt#56341). (bsc#1170104) - Sanitize grains loaded from roster_grains.json cache during "state.pkg". - Various virt backports from 3000.2. - zypperpkg: filter patterns that start with dot. (bsc#1171906) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1074=1 Package List: - openSUSE Leap 15.1 (noarch): salt-bash-completion-3000-lp151.5.21.1 salt-fish-completion-3000-lp151.5.21.1 salt-zsh-completion-3000-lp151.5.21.1 - openSUSE Leap 15.1 (x86_64): python2-salt-3000-lp151.5.21.1 python3-salt-3000-lp151.5.21.1 salt-3000-lp151.5.21.1 salt-api-3000-lp151.5.21.1 salt-cloud-3000-lp151.5.21.1 salt-doc-3000-lp151.5.21.1 salt-master-3000-lp151.5.21.1 salt-minion-3000-lp151.5.21.1 salt-proxy-3000-lp151.5.21.1 salt-ssh-3000-lp151.5.21.1 salt-standalone-formulas-configuration-3000-lp151.5.21.1 salt-syndic-3000-lp151.5.21.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://www.suse.com/security/cve/CVE-2020-11651.html https://www.suse.com/security/cve/CVE-2020-11652.html https://bugzilla.suse.com/1159284 https://bugzilla.suse.com/1165572 https://bugzilla.suse.com/1167437 https://bugzilla.suse.com/1168340 https://bugzilla.suse.com/1169604 https://bugzilla.suse.com/1170104 https://bugzilla.suse.com/1170288 https://bugzilla.suse.com/1171906 https://bugzilla.suse.com/1172075 https://bugzilla.suse.com/1173072 https://bugzilla.suse.com/1174165 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1061-1: important: Security update for chromium
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1061-1 Rating: important References: #1174189 Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1061=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-84.0.4147.89-bp151.3.94.1 chromium-84.0.4147.89-bp151.3.94.1 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html https://bugzilla.suse.com/1174189 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1060-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 25 Jul '20

25 Jul '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1060-1 Rating: moderate References: #1115436 #1154087 #1173090 Cross-References: CVE-2020-11022 CVE-2020-11023 CVE-2020-13625 CVE-2020-14295 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: - cacti 1.2.13: * Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023) * Lack of escaping on some pages can lead to XSS exposure * Update PHPMailer to 6.1.6 (CVE-2020-13625) * SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090) * Lack of escaping on template import can lead to XSS exposure - switch from cron to systemd timers (boo#1115436): + cacti-cron.timer + cacti-cron.service - avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation - rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1060=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1060=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1060=1 Package List: - openSUSE Leap 15.2 (noarch): cacti-1.2.13-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): cacti-spine-1.2.13-lp152.2.3.1 cacti-spine-debuginfo-1.2.13-lp152.2.3.1 cacti-spine-debugsource-1.2.13-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.13-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.13-lp151.3.12.1 cacti-spine-debuginfo-1.2.13-lp151.3.12.1 cacti-spine-debugsource-1.2.13-lp151.3.12.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.13-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le x86_64): cacti-spine-debuginfo-1.2.13-8.1 cacti-spine-debugsource-1.2.13-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.13-11.1 References: https://www.suse.com/security/cve/CVE-2020-11022.html https://www.suse.com/security/cve/CVE-2020-11023.html https://www.suse.com/security/cve/CVE-2020-13625.html https://www.suse.com/security/cve/CVE-2020-14295.html https://bugzilla.suse.com/1115436 https://bugzilla.suse.com/1154087 https://bugzilla.suse.com/1173090 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1060-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 25 Jul '20

25 Jul '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1060-1 Rating: moderate References: #1115436 #1154087 #1173090 Cross-References: CVE-2020-11022 CVE-2020-11023 CVE-2020-13625 CVE-2020-14295 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: - cacti 1.2.13: * Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023) * Lack of escaping on some pages can lead to XSS exposure * Update PHPMailer to 6.1.6 (CVE-2020-13625) * SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090) * Lack of escaping on template import can lead to XSS exposure - switch from cron to systemd timers (boo#1115436): + cacti-cron.timer + cacti-cron.service - avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation - rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1060=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1060=1 Package List: - openSUSE Leap 15.2 (noarch): cacti-1.2.13-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): cacti-spine-1.2.13-lp152.2.3.1 cacti-spine-debuginfo-1.2.13-lp152.2.3.1 cacti-spine-debugsource-1.2.13-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): cacti-1.2.13-lp151.3.12.1 - openSUSE Leap 15.1 (x86_64): cacti-spine-1.2.13-lp151.3.12.1 cacti-spine-debuginfo-1.2.13-lp151.3.12.1 cacti-spine-debugsource-1.2.13-lp151.3.12.1 References: https://www.suse.com/security/cve/CVE-2020-11022.html https://www.suse.com/security/cve/CVE-2020-11023.html https://www.suse.com/security/cve/CVE-2020-13625.html https://www.suse.com/security/cve/CVE-2020-14295.html https://bugzilla.suse.com/1115436 https://bugzilla.suse.com/1154087 https://bugzilla.suse.com/1173090 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1056-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 24 Jul '20

24 Jul '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1056-1 Rating: important References: #1173477 #1173691 #1173694 #1173700 #1173701 #1173743 #1173874 #1173875 #1173876 #1173880 Cross-References: CVE-2017-18922 CVE-2018-21247 CVE-2019-20839 CVE-2019-20840 CVE-2020-14397 CVE-2020-14398 CVE-2020-14399 CVE-2020-14400 CVE-2020-14401 CVE-2020-14402 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: - security update - added patches fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. + LibVNCServer-CVE-2020-14402,14403,14404.patch fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1056=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp152.9.4.2 LibVNCServer-devel-0.9.10-lp152.9.4.2 libvncclient0-0.9.10-lp152.9.4.2 libvncclient0-debuginfo-0.9.10-lp152.9.4.2 libvncserver0-0.9.10-lp152.9.4.2 libvncserver0-debuginfo-0.9.10-lp152.9.4.2 References: https://www.suse.com/security/cve/CVE-2017-18922.html https://www.suse.com/security/cve/CVE-2018-21247.html https://www.suse.com/security/cve/CVE-2019-20839.html https://www.suse.com/security/cve/CVE-2019-20840.html https://www.suse.com/security/cve/CVE-2020-14397.html https://www.suse.com/security/cve/CVE-2020-14398.html https://www.suse.com/security/cve/CVE-2020-14399.html https://www.suse.com/security/cve/CVE-2020-14400.html https://www.suse.com/security/cve/CVE-2020-14401.html https://www.suse.com/security/cve/CVE-2020-14402.html https://bugzilla.suse.com/1173477 https://bugzilla.suse.com/1173691 https://bugzilla.suse.com/1173694 https://bugzilla.suse.com/1173700 https://bugzilla.suse.com/1173701 https://bugzilla.suse.com/1173743 https://bugzilla.suse.com/1173874 https://bugzilla.suse.com/1173875 https://bugzilla.suse.com/1173876 https://bugzilla.suse.com/1173880 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1050-1: moderate: Security update for cni-plugins
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for cni-plugins ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1050-1 Rating: moderate References: #1172410 Cross-References: CVE-2020-10749 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cni-plugins fixes the following issues: cni-plugins updated to version 0.8.6 - CVE-2020-10749: Fixed a potential Man-in-the-Middle attacks in IPv4 clusters by spoofing IPv6 router advertisements (bsc#1172410). Release notes: https://github.com/containernetworking/plugins/releases/tag/v0.8.6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1050=1 Package List: - openSUSE Leap 15.2 (x86_64): cni-plugins-0.8.6-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-10749.html https://bugzilla.suse.com/1172410 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1051-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1051-1 Rating: important References: #1173389 Cross-References: CVE-2020-11996 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: Tomcat was updated to 9.0.36 See changelog at - CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1051=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.36-lp151.3.24.1 tomcat-admin-webapps-9.0.36-lp151.3.24.1 tomcat-docs-webapp-9.0.36-lp151.3.24.1 tomcat-el-3_0-api-9.0.36-lp151.3.24.1 tomcat-embed-9.0.36-lp151.3.24.1 tomcat-javadoc-9.0.36-lp151.3.24.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.24.1 tomcat-jsvc-9.0.36-lp151.3.24.1 tomcat-lib-9.0.36-lp151.3.24.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.24.1 tomcat-webapps-9.0.36-lp151.3.24.1 References: https://www.suse.com/security/cve/CVE-2020-11996.html https://bugzilla.suse.com/1173389 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1049-1: moderate: Security update for cni-plugins
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for cni-plugins ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1049-1 Rating: moderate References: #1172410 Cross-References: CVE-2020-10749 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cni-plugins fixes the following issues: cni-plugins updated to version 0.8.6 - CVE-2020-10749: Fixed a potential Man-in-the-Middle attacks in IPv4 clusters by spoofing IPv6 router advertisements (bsc#1172410). Release notes: https://github.com/containernetworking/plugins/releases/tag/v0.8.6 This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1049=1 Package List: - openSUSE Leap 15.1 (x86_64): cni-plugins-0.8.6-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-10749.html https://bugzilla.suse.com/1172410 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1043-1: moderate: Security update for xmlgraphics-batik
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for xmlgraphics-batik ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1043-1 Rating: moderate References: #1172961 Cross-References: CVE-2019-17566 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmlgraphics-batik fixes the following issues: - CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961). This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1043=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): xmlgraphics-batik-1.9-bp151.2.3.1 xmlgraphics-batik-demo-1.9-bp151.2.3.1 xmlgraphics-batik-rasterizer-1.9-bp151.2.3.1 xmlgraphics-batik-slideshow-1.9-bp151.2.3.1 xmlgraphics-batik-squiggle-1.9-bp151.2.3.1 xmlgraphics-batik-svgpp-1.9-bp151.2.3.1 xmlgraphics-batik-ttf2svg-1.9-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-17566.html https://bugzilla.suse.com/1172961 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1042-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1042-1 Rating: moderate References: #1173948 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: - Mozilla Firefox 78.0.2 MFSA 2020-28 (bsc#1173948) * MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR * Fixed: Security fix * Fixed: Fixed an accessibility regression in reader mode (bmo#1650922) * Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981) * Fixed: Fixed a regression opening certain external applications (bmo#1650162) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1042=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.0.2-lp151.2.57.1 MozillaFirefox-branding-upstream-78.0.2-lp151.2.57.1 MozillaFirefox-buildsymbols-78.0.2-lp151.2.57.1 MozillaFirefox-debuginfo-78.0.2-lp151.2.57.1 MozillaFirefox-debugsource-78.0.2-lp151.2.57.1 MozillaFirefox-devel-78.0.2-lp151.2.57.1 MozillaFirefox-translations-common-78.0.2-lp151.2.57.1 MozillaFirefox-translations-other-78.0.2-lp151.2.57.1 References: https://bugzilla.suse.com/1173948 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0