July 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0994-1: important: Security update for slirp4netns
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for slirp4netns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0994-1 Rating: important References: #1172380 Cross-References: CVE-2020-10756 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slirp4netns fixes the following issues: - Update to 0.4.7 (bsc#1172380) * libslirp: update to v4.3.1 (Fix CVE-2020-10756) * Fix config_from_options() to correctly enable ipv6 This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-994=1 Package List: - openSUSE Leap 15.2 (x86_64): slirp4netns-0.4.7-lp152.2.3.1 slirp4netns-debuginfo-0.4.7-lp152.2.3.1 slirp4netns-debugsource-0.4.7-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10756.html https://bugzilla.suse.com/1172380 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0997-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0997-1 Rating: moderate References: #1171862 Cross-References: CVE-2020-12823 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: - CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-997=1 Package List: - openSUSE Leap 15.1 (x86_64): openconnect-7.08-lp151.6.9.1 openconnect-debuginfo-7.08-lp151.6.9.1 openconnect-debugsource-7.08-lp151.6.9.1 openconnect-devel-7.08-lp151.6.9.1 openconnect-doc-7.08-lp151.6.9.1 - openSUSE Leap 15.1 (noarch): openconnect-lang-7.08-lp151.6.9.1 References: https://www.suse.com/security/cve/CVE-2020-12823.html https://bugzilla.suse.com/1171862 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1001-1: moderate: Security update for rubygem-puma
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for rubygem-puma ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1001-1 Rating: moderate References: #1172175 #1172176 Cross-References: CVE-2020-11076 CVE-2020-11077 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-puma to version 4.3.5 fixes the following issues: - CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage (bsc#1172175). - CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header (bsc#1172176). - Disabled TLSv1.0 and TLSv1.1 (jsc#SLE-6965). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1001=1 Package List: - openSUSE Leap 15.2 (x86_64): ruby2.5-rubygem-puma-4.3.5-lp152.4.3.1 ruby2.5-rubygem-puma-debuginfo-4.3.5-lp152.4.3.1 ruby2.5-rubygem-puma-doc-4.3.5-lp152.4.3.1 rubygem-puma-debugsource-4.3.5-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-11076.html https://www.suse.com/security/cve/CVE-2020-11077.html https://bugzilla.suse.com/1172175 https://bugzilla.suse.com/1172176 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0996-1: important: Security update for google-compute-engine
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0996-1 Rating: important References: #1169978 #1173258 Cross-References: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for google-compute-engine fixes the following issues: - Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978) + Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-996=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): google-compute-engine-debugsource-20190801-lp151.2.25.1 google-compute-engine-oslogin-20190801-lp151.2.25.1 google-compute-engine-oslogin-debuginfo-20190801-lp151.2.25.1 - openSUSE Leap 15.1 (x86_64): google-compute-engine-oslogin-32bit-20190801-lp151.2.25.1 google-compute-engine-oslogin-32bit-debuginfo-20190801-lp151.2.25.1 - openSUSE Leap 15.1 (noarch): google-compute-engine-init-20190801-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2020-8903.html https://www.suse.com/security/cve/CVE-2020-8907.html https://www.suse.com/security/cve/CVE-2020-8933.html https://bugzilla.suse.com/1169978 https://bugzilla.suse.com/1173258 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0999-1: important: Security update for xrdp
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for xrdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0999-1 Rating: important References: #1173580 Cross-References: CVE-2020-4044 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xrdp fixes the following issues: - Security fixes (bsc#1173580, CVE-2020-4044): + Add patches: * xrdp-cve-2020-4044-fix-0.patch * xrdp-cve-2020-4044-fix-1.patch + Rebase SLE patch: * xrdp-fate318398-change-expired-password.patch This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-999=1 Package List: - openSUSE Leap 15.1 (x86_64): libpainter0-0.9.6-lp151.4.6.1 libpainter0-debuginfo-0.9.6-lp151.4.6.1 librfxencode0-0.9.6-lp151.4.6.1 librfxencode0-debuginfo-0.9.6-lp151.4.6.1 xrdp-0.9.6-lp151.4.6.1 xrdp-debuginfo-0.9.6-lp151.4.6.1 xrdp-debugsource-0.9.6-lp151.4.6.1 xrdp-devel-0.9.6-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-4044.html https://bugzilla.suse.com/1173580 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0987-1: important: Security update for slirp4netns
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for slirp4netns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0987-1 Rating: important References: #1172380 Cross-References: CVE-2020-10756 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slirp4netns fixes the following issues: - Update to 0.4.7 (bsc#1172380) * libslirp: update to v4.3.1 (Fix CVE-2020-10756) * Fix config_from_options() to correctly enable ipv6 This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-987=1 Package List: - openSUSE Leap 15.1 (x86_64): slirp4netns-0.4.7-lp151.2.12.1 slirp4netns-debuginfo-0.4.7-lp151.2.12.1 slirp4netns-debugsource-0.4.7-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-10756.html https://bugzilla.suse.com/1172380 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0990-1: moderate: Security update for rubygem-puma
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for rubygem-puma ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0990-1 Rating: moderate References: #1172175 #1172176 Cross-References: CVE-2020-11076 CVE-2020-11077 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-puma to version 4.3.5 fixes the following issues: - CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage (bsc#1172175). - CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header (bsc#1172176). - Disabled TLSv1.0 and TLSv1.1 (jsc#SLE-6965). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-990=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-puma-4.3.5-lp151.3.3.1 ruby2.5-rubygem-puma-debuginfo-4.3.5-lp151.3.3.1 ruby2.5-rubygem-puma-doc-4.3.5-lp151.3.3.1 rubygem-puma-debugsource-4.3.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-11076.html https://www.suse.com/security/cve/CVE-2020-11077.html https://bugzilla.suse.com/1172175 https://bugzilla.suse.com/1172176 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0988-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0988-1 Rating: important References: #1173477 #1173691 #1173694 #1173700 #1173701 #1173743 #1173874 #1173875 #1173876 #1173880 Cross-References: CVE-2017-18922 CVE-2018-21247 CVE-2019-20839 CVE-2019-20840 CVE-2020-14397 CVE-2020-14398 CVE-2020-14399 CVE-2020-14400 CVE-2020-14401 CVE-2020-14402 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: - security update - added patches fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. + LibVNCServer-CVE-2020-14402,14403,14404.patch fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-988=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp151.7.9.1 LibVNCServer-devel-0.9.10-lp151.7.9.1 libvncclient0-0.9.10-lp151.7.9.1 libvncclient0-debuginfo-0.9.10-lp151.7.9.1 libvncserver0-0.9.10-lp151.7.9.1 libvncserver0-debuginfo-0.9.10-lp151.7.9.1 References: https://www.suse.com/security/cve/CVE-2017-18922.html https://www.suse.com/security/cve/CVE-2018-21247.html https://www.suse.com/security/cve/CVE-2019-20839.html https://www.suse.com/security/cve/CVE-2019-20840.html https://www.suse.com/security/cve/CVE-2020-14397.html https://www.suse.com/security/cve/CVE-2020-14398.html https://www.suse.com/security/cve/CVE-2020-14399.html https://www.suse.com/security/cve/CVE-2020-14400.html https://www.suse.com/security/cve/CVE-2020-14401.html https://www.suse.com/security/cve/CVE-2020-14402.html https://bugzilla.suse.com/1173477 https://bugzilla.suse.com/1173691 https://bugzilla.suse.com/1173694 https://bugzilla.suse.com/1173700 https://bugzilla.suse.com/1173701 https://bugzilla.suse.com/1173743 https://bugzilla.suse.com/1173874 https://bugzilla.suse.com/1173875 https://bugzilla.suse.com/1173876 https://bugzilla.suse.com/1173880 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0989-1: important: Security update for python-ipaddress
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for python-ipaddress ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0989-1 Rating: important References: #1173274 Cross-References: CVE-2020-14422 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-ipaddress fixes the following issues: - Add CVE-2020-14422-ipaddress-hash-collision.patch fixing CVE-2020-14422 (bsc#1173274, bpo#41004), where hash collisions in IPv4Interface and IPv6Interface could lead to DOS. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-989=1 Package List: - openSUSE Leap 15.1 (noarch): python-ipaddress-1.0.18-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-14422.html https://bugzilla.suse.com/1173274 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0985-1: important: Security update for xen
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0985-1 Rating: important References: #1027519 #1172205 #1173376 #1173377 #1173378 #1173380 Cross-References: CVE-2020-0543 CVE-2020-15563 CVE-2020-15565 CVE-2020-15566 CVE-2020-15567 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377). - CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378). - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376). - CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380). - CVE-2020-0543: Special Register Buffer Data Sampling (SRBDS) aka "CrossTalk" (bsc#1172205). Additional upstream bug fixes (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-985=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.1_04-lp152.2.3.1 xen-devel-4.13.1_04-lp152.2.3.1 xen-libs-4.13.1_04-lp152.2.3.1 xen-libs-debuginfo-4.13.1_04-lp152.2.3.1 xen-tools-domU-4.13.1_04-lp152.2.3.1 xen-tools-domU-debuginfo-4.13.1_04-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.1_04-lp152.2.3.1 xen-doc-html-4.13.1_04-lp152.2.3.1 xen-libs-32bit-4.13.1_04-lp152.2.3.1 xen-libs-32bit-debuginfo-4.13.1_04-lp152.2.3.1 xen-tools-4.13.1_04-lp152.2.3.1 xen-tools-debuginfo-4.13.1_04-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.1_04-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-0543.html https://www.suse.com/security/cve/CVE-2020-15563.html https://www.suse.com/security/cve/CVE-2020-15565.html https://www.suse.com/security/cve/CVE-2020-15566.html https://www.suse.com/security/cve/CVE-2020-15567.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1172205 https://bugzilla.suse.com/1173376 https://bugzilla.suse.com/1173377 https://bugzilla.suse.com/1173378 https://bugzilla.suse.com/1173380 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0