July 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:0984-1: important: Security update for samba
by opensuse-security＠opensuse.org 18 Jul '20

18 Jul '20

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0984-1 Rating: important References: #1171437 #1172307 #1173159 #1173160 #1173161 #1173359 Cross-References: CVE-2020-10730 CVE-2020-10745 CVE-2020-10760 CVE-2020-14303 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for samba fixes the following issues: - CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160). - CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359). - CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159). - CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161). - Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307). - Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-984=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ctdb-4.9.5+git.343.4bc358522a9-lp151.2.27.1 ctdb-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 ctdb-pcp-pmda-4.9.5+git.343.4bc358522a9-lp151.2.27.1 ctdb-pcp-pmda-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 ctdb-tests-4.9.5+git.343.4bc358522a9-lp151.2.27.1 ctdb-tests-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-binding0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-binding0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-samr-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-samr0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-samr0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-krb5pac-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-krb5pac0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-krb5pac0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-nbt-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-nbt0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-nbt0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-standard-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-standard0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-standard0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-credentials-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-credentials0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-credentials0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-errors-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-errors0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-errors0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-hostconfig-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-hostconfig0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-hostconfig0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-passdb-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-passdb0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-passdb0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy-python-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy-python3-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-python3-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-python3-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-util-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-util0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-util0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamdb-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamdb0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamdb0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbclient-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbclient0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbclient0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbconf-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbconf0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbconf0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbldap-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbldap2-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbldap2-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libtevent-util-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libtevent-util0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libtevent-util0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libwbclient-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libwbclient0-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libwbclient0-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ad-dc-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ad-dc-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-client-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-client-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-core-devel-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-debugsource-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-dsdb-modules-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-dsdb-modules-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python3-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python3-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-pidl-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-python-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-python-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-python3-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-python3-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-test-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-test-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-winbind-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-winbind-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 - openSUSE Leap 15.1 (noarch): samba-doc-4.9.5+git.343.4bc358522a9-lp151.2.27.1 - openSUSE Leap 15.1 (x86_64): libdcerpc-binding0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-binding0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-samr0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc-samr0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libdcerpc0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-krb5pac0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-krb5pac0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-nbt0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-nbt0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-standard0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr-standard0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libndr0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi-devel-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libnetapi0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-credentials0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-credentials0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-errors0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-errors0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-hostconfig0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-hostconfig0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-passdb0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-passdb0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-python3-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-policy0-python3-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-util0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamba-util0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamdb0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsamdb0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbclient0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbclient0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbconf0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbconf0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbldap2-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libsmbldap2-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libtevent-util0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libtevent-util0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libwbclient0-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 libwbclient0-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ad-dc-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ad-dc-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ceph-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-ceph-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-client-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-client-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python3-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-libs-python3-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-winbind-32bit-4.9.5+git.343.4bc358522a9-lp151.2.27.1 samba-winbind-32bit-debuginfo-4.9.5+git.343.4bc358522a9-lp151.2.27.1 References: https://www.suse.com/security/cve/CVE-2020-10730.html https://www.suse.com/security/cve/CVE-2020-10745.html https://www.suse.com/security/cve/CVE-2020-10760.html https://www.suse.com/security/cve/CVE-2020-14303.html https://bugzilla.suse.com/1171437 https://bugzilla.suse.com/1172307 https://bugzilla.suse.com/1173159 https://bugzilla.suse.com/1173160 https://bugzilla.suse.com/1173161 https://bugzilla.suse.com/1173359 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0976-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 17 Jul '20

17 Jul '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0976-1 Rating: important References: #1172698 #1172704 Cross-References: CVE-2020-8023 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openldap2 fixes the following issues: - CVE-2020-8023: Fixed a potential local privilege escalation from ldap to root when OPENLDAP_CONFIG_BACKEND="ldap" was used (bsc#1172698). - Changed DB_CONFIG to root:ldap permissions (bsc#1172704). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-976=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libldap-2_4-2-2.4.46-lp152.14.3.1 libldap-2_4-2-debuginfo-2.4.46-lp152.14.3.1 openldap2-2.4.46-lp152.14.3.1 openldap2-back-meta-2.4.46-lp152.14.3.1 openldap2-back-meta-debuginfo-2.4.46-lp152.14.3.1 openldap2-back-perl-2.4.46-lp152.14.3.1 openldap2-back-perl-debuginfo-2.4.46-lp152.14.3.1 openldap2-back-sock-2.4.46-lp152.14.3.1 openldap2-back-sock-debuginfo-2.4.46-lp152.14.3.1 openldap2-back-sql-2.4.46-lp152.14.3.1 openldap2-back-sql-debuginfo-2.4.46-lp152.14.3.1 openldap2-client-2.4.46-lp152.14.3.1 openldap2-client-debuginfo-2.4.46-lp152.14.3.1 openldap2-contrib-2.4.46-lp152.14.3.1 openldap2-contrib-debuginfo-2.4.46-lp152.14.3.1 openldap2-debuginfo-2.4.46-lp152.14.3.1 openldap2-debugsource-2.4.46-lp152.14.3.1 openldap2-devel-2.4.46-lp152.14.3.1 openldap2-devel-static-2.4.46-lp152.14.3.1 openldap2-ppolicy-check-password-1.2-lp152.14.3.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp152.14.3.1 - openSUSE Leap 15.2 (noarch): libldap-data-2.4.46-lp152.14.3.1 openldap2-doc-2.4.46-lp152.14.3.1 - openSUSE Leap 15.2 (x86_64): libldap-2_4-2-32bit-2.4.46-lp152.14.3.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp152.14.3.1 openldap2-devel-32bit-2.4.46-lp152.14.3.1 References: https://www.suse.com/security/cve/CVE-2020-8023.html https://bugzilla.suse.com/1172698 https://bugzilla.suse.com/1172704 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0978-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 17 Jul '20

17 Jul '20

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0978-1 Rating: important References: #1173477 Cross-References: CVE-2017-18922 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for LibVNCServer fixes the following issues: - CVE-2017-18922: Fixed an issue which could have allowed to an attacker to pre-auth overwrite a function pointer which subsequently used leading to potential remote code execution (bsc#1173477). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-978=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp152.9.4.1 LibVNCServer-devel-0.9.10-lp152.9.4.1 libvncclient0-0.9.10-lp152.9.4.1 libvncclient0-debuginfo-0.9.10-lp152.9.4.1 libvncserver0-0.9.10-lp152.9.4.1 libvncserver0-debuginfo-0.9.10-lp152.9.4.1 References: https://www.suse.com/security/cve/CVE-2017-18922.html https://bugzilla.suse.com/1173477 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0983-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 17 Jul '20

17 Jul '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0983-1 Rating: important References: #1166238 #1173576 #1173613 Cross-References: CVE-2020-12402 CVE-2020-12415 CVE-2020-12416 CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421 CVE-2020-12422 CVE-2020-12423 CVE-2020-12424 CVE-2020-12425 CVE-2020-12426 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues: Security issues fixed: - CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576). - CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576). - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576). - CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576). - CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576). - CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576). - CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576). - CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576). - CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576). - CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576). - CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576). - CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576). - CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576). - FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231). Non-security issues fixed: - Fixed interaction with freetype6 (bsc#1173613). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-983=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.0.1-lp152.2.5.1 MozillaFirefox-branding-upstream-78.0.1-lp152.2.5.1 MozillaFirefox-buildsymbols-78.0.1-lp152.2.5.1 MozillaFirefox-debuginfo-78.0.1-lp152.2.5.1 MozillaFirefox-debugsource-78.0.1-lp152.2.5.1 MozillaFirefox-devel-78.0.1-lp152.2.5.1 MozillaFirefox-translations-common-78.0.1-lp152.2.5.1 MozillaFirefox-translations-other-78.0.1-lp152.2.5.1 References: https://www.suse.com/security/cve/CVE-2020-12402.html https://www.suse.com/security/cve/CVE-2020-12415.html https://www.suse.com/security/cve/CVE-2020-12416.html https://www.suse.com/security/cve/CVE-2020-12417.html https://www.suse.com/security/cve/CVE-2020-12418.html https://www.suse.com/security/cve/CVE-2020-12419.html https://www.suse.com/security/cve/CVE-2020-12420.html https://www.suse.com/security/cve/CVE-2020-12421.html https://www.suse.com/security/cve/CVE-2020-12422.html https://www.suse.com/security/cve/CVE-2020-12423.html https://www.suse.com/security/cve/CVE-2020-12424.html https://www.suse.com/security/cve/CVE-2020-12425.html https://www.suse.com/security/cve/CVE-2020-12426.html https://bugzilla.suse.com/1166238 https://bugzilla.suse.com/1173576 https://bugzilla.suse.com/1173613 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0982-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 17 Jul '20

17 Jul '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0982-1 Rating: important References: #1173576 Cross-References: CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues: - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576). - CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576). - CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576). - CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576). - CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-982=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-68.10.0-lp152.2.4.1 MozillaThunderbird-debuginfo-68.10.0-lp152.2.4.1 MozillaThunderbird-debugsource-68.10.0-lp152.2.4.1 MozillaThunderbird-translations-common-68.10.0-lp152.2.4.1 MozillaThunderbird-translations-other-68.10.0-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-12417.html https://www.suse.com/security/cve/CVE-2020-12418.html https://www.suse.com/security/cve/CVE-2020-12419.html https://www.suse.com/security/cve/CVE-2020-12420.html https://www.suse.com/security/cve/CVE-2020-12421.html https://bugzilla.suse.com/1173576 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0970-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 16 Jul '20

16 Jul '20

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0970-1 Rating: moderate References: #1173466 #1173467 #1173469 Cross-References: CVE-2020-15304 CVE-2020-15305 CVE-2020-15306 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466). - CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467). - CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-970=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.12.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.12.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.12.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.12.1 openexr-2.2.1-lp151.4.12.1 openexr-debuginfo-2.2.1-lp151.4.12.1 openexr-debugsource-2.2.1-lp151.4.12.1 openexr-devel-2.2.1-lp151.4.12.1 openexr-doc-2.2.1-lp151.4.12.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.12.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.12.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.12.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.12.1 References: https://www.suse.com/security/cve/CVE-2020-15304.html https://www.suse.com/security/cve/CVE-2020-15305.html https://www.suse.com/security/cve/CVE-2020-15306.html https://bugzilla.suse.com/1173466 https://bugzilla.suse.com/1173467 https://bugzilla.suse.com/1173469 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0965-1: important: Security update for xen
by opensuse-security＠opensuse.org 15 Jul '20

15 Jul '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0965-1 Rating: important References: #1027519 #1172205 #1173376 #1173377 #1173378 #1173380 Cross-References: CVE-2020-0543 CVE-2020-15563 CVE-2020-15565 CVE-2020-15566 CVE-2020-15567 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377). - CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378). - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376). - CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380). - CVE-2020-0543: Special Register Buffer Data Sampling (SRBDS) aka "CrossTalk" (bsc#1172205). Additional upstream bug fixes (bsc#1027519) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-965=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.3_04-lp151.2.21.1 xen-devel-4.12.3_04-lp151.2.21.1 xen-libs-4.12.3_04-lp151.2.21.1 xen-libs-debuginfo-4.12.3_04-lp151.2.21.1 xen-tools-domU-4.12.3_04-lp151.2.21.1 xen-tools-domU-debuginfo-4.12.3_04-lp151.2.21.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.3_04-lp151.2.21.1 xen-doc-html-4.12.3_04-lp151.2.21.1 xen-libs-32bit-4.12.3_04-lp151.2.21.1 xen-libs-32bit-debuginfo-4.12.3_04-lp151.2.21.1 xen-tools-4.12.3_04-lp151.2.21.1 xen-tools-debuginfo-4.12.3_04-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-0543.html https://www.suse.com/security/cve/CVE-2020-15563.html https://www.suse.com/security/cve/CVE-2020-15565.html https://www.suse.com/security/cve/CVE-2020-15566.html https://www.suse.com/security/cve/CVE-2020-15567.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1172205 https://bugzilla.suse.com/1173376 https://bugzilla.suse.com/1173377 https://bugzilla.suse.com/1173378 https://bugzilla.suse.com/1173380 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0967-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 15 Jul '20

15 Jul '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0967-1 Rating: important References: #1173576 Cross-References: CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues: - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576). - CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576). - CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576). - CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576). - CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-967=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.10.0-lp151.2.44.2 MozillaThunderbird-debuginfo-68.10.0-lp151.2.44.2 MozillaThunderbird-debugsource-68.10.0-lp151.2.44.2 MozillaThunderbird-translations-common-68.10.0-lp151.2.44.2 MozillaThunderbird-translations-other-68.10.0-lp151.2.44.2 References: https://www.suse.com/security/cve/CVE-2020-12417.html https://www.suse.com/security/cve/CVE-2020-12418.html https://www.suse.com/security/cve/CVE-2020-12419.html https://www.suse.com/security/cve/CVE-2020-12420.html https://www.suse.com/security/cve/CVE-2020-12421.html https://bugzilla.suse.com/1173576 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0958-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 14 Jul '20

14 Jul '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0958-1 Rating: moderate References: #1172731 Cross-References: CVE-2020-8024 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hylafax+ fixes the following issues: Security issue fixed: - CVE-2020-8024 boo#1172731 hylafax+ was updated to version 7.0.2: * change FIXEDWIDTH default to better accommodate auto-rotation (13 Dec 2019) * prevent SSL_accept() from blocking (5 Dec 2019) * support libtiff v4.1 (5 Dec 2019) * fix ignoremodembusy feature broken by ModemGroup limits feature (16 Nov 2019) Version 7.0.1: * create a client timeout setting and change the default from 60 to 3600 seconds (26 Sep 2019) * extend timeout for receiving ECM frames (21 Aug 2019) * fix timeout in Class 1 frame reception (5 Aug 2019) * improve Class 1 protocol handling when MaxRecvPages exceeded (31 Jul 2019) * fix ModemGroup limit default (11 Jul 2019) * fix recovery for SSL Fax write failures (6 Jun 2019) Version 7.0.0: * add LDAP features for compatibility with ActiveDirectory (25 Mar-1 Apr 2019) * fix recovery after SSL Fax "accept failure" (18 Mar 2019) * add TextFormat overstrike option and disable by default (6 Feb 2019) * fix the page size of cover sheets returned via notify (8 Jan 2019) * fix or silence numerous compiler warnings (19, 22, 28 Dec 2018) * fix pagehandling updating after a proxy has been used (7-8 Dec 2018) * add faxmail stderr output of RFC2047 decoding results (5 Dec 2018) * fix faxmail handling of headers encoded with UTF-8 (4 Dec 2018) * fix faxmail handling of base64-encoded text parts (4 Dec 2018) * add SSL Fax support (9-26, 29 Nov; 11, 18, 25 Dec 2018; 2, 7, 23 Jan 2019) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-958=1 Package List: - openSUSE Leap 15.1 (x86_64): hylafax+-7.0.2-lp151.4.3.1 hylafax+-client-7.0.2-lp151.4.3.1 hylafax+-client-debuginfo-7.0.2-lp151.4.3.1 hylafax+-debuginfo-7.0.2-lp151.4.3.1 hylafax+-debugsource-7.0.2-lp151.4.3.1 libfaxutil7_0_2-7.0.2-lp151.4.3.1 libfaxutil7_0_2-debuginfo-7.0.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-8024.html https://bugzilla.suse.com/1172731 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:0957-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 14 Jul '20

14 Jul '20

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0957-1 Rating: moderate References: #1171883 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Removed conflicting entries which might expose pcp to security issues (bsc#1171883) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-957=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.24.1 permissions-debuginfo-20181116-lp151.4.24.1 permissions-debugsource-20181116-lp151.4.24.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.24.1 References: https://bugzilla.suse.com/1171883 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0