August 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1188-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 12 Aug '20

12 Aug '20

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1188-1 Rating: moderate References: #1169063 #1171899 #1173606 Cross-References: CVE-2020-11647 CVE-2020-13164 CVE-2020-15466 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Wireshark to 3.2.5: * CVE-2020-15466: GVCP dissector infinite loop (bsc#1173606) * CVE-2020-13164: NFS dissector crash (bsc#1171899) * CVE-2020-11647: The BACapp dissector could crash (bsc#1169063) - Further features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-3.2.5.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1188=1 Package List: - openSUSE Leap 15.1 (x86_64): libwireshark13-3.2.5-lp151.2.12.1 libwireshark13-debuginfo-3.2.5-lp151.2.12.1 libwiretap10-3.2.5-lp151.2.12.1 libwiretap10-debuginfo-3.2.5-lp151.2.12.1 libwsutil11-3.2.5-lp151.2.12.1 libwsutil11-debuginfo-3.2.5-lp151.2.12.1 wireshark-3.2.5-lp151.2.12.1 wireshark-debuginfo-3.2.5-lp151.2.12.1 wireshark-debugsource-3.2.5-lp151.2.12.1 wireshark-devel-3.2.5-lp151.2.12.1 wireshark-ui-qt-3.2.5-lp151.2.12.1 wireshark-ui-qt-debuginfo-3.2.5-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-11647.html https://www.suse.com/security/cve/CVE-2020-13164.html https://www.suse.com/security/cve/CVE-2020-15466.html https://bugzilla.suse.com/1169063 https://bugzilla.suse.com/1171899 https://bugzilla.suse.com/1173606 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1189-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Aug '20

12 Aug '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1189-1 Rating: important References: #1171433 #1174538 Cross-References: CVE-2020-15652 CVE-2020-15653 CVE-2020-15654 CVE-2020-15655 CVE-2020-15656 CVE-2020-15657 CVE-2020-15658 CVE-2020-15659 CVE-2020-6463 CVE-2020-6514 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: This update for MozillaFirefox and pipewire fixes the following issues: MozillaFirefox Extended Support Release 78.1.0 ESR * Fixed: Various stability, functionality, and security fixes (bsc#1174538) * CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker * CVE-2020-6514: WebRTC data channel leaks internal address to peer * CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy * CVE-2020-15653: Bypassing iframe sandbox when allowing popups * CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture * CVE-2020-15656: Type confusion for special arguments in IonMonkey * CVE-2020-15658: Overriding file type when saving to disk * CVE-2020-15657: DLL hijacking due to incorrect loading path * CVE-2020-15654: Custom cursor can overlay user interface * CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1 pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308): * Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed. * Compile fixes * Stability improvements in jack and pulseaudio layers. * Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions. * Improvements to the GStreamer source and sink shutdown. * Fix compatibility with v2 clients again when negotiating buffers. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1189=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.1.0-lp152.2.15.1 MozillaFirefox-branding-upstream-78.1.0-lp152.2.15.1 MozillaFirefox-buildsymbols-78.1.0-lp152.2.15.1 MozillaFirefox-debuginfo-78.1.0-lp152.2.15.1 MozillaFirefox-debugsource-78.1.0-lp152.2.15.1 MozillaFirefox-devel-78.1.0-lp152.2.15.1 MozillaFirefox-translations-common-78.1.0-lp152.2.15.1 MozillaFirefox-translations-other-78.1.0-lp152.2.15.1 gstreamer-plugin-pipewire-0.3.6-lp152.2.3.1 gstreamer-plugin-pipewire-debuginfo-0.3.6-lp152.2.3.1 libpipewire-0_3-0-0.3.6-lp152.2.3.1 libpipewire-0_3-0-debuginfo-0.3.6-lp152.2.3.1 pipewire-0.3.6-lp152.2.3.1 pipewire-debuginfo-0.3.6-lp152.2.3.1 pipewire-debugsource-0.3.6-lp152.2.3.1 pipewire-devel-0.3.6-lp152.2.3.1 pipewire-doc-0.3.6-lp152.2.3.1 pipewire-libjack-0_3-0.3.6-lp152.2.3.1 pipewire-libjack-0_3-debuginfo-0.3.6-lp152.2.3.1 pipewire-libpulse-0_3-0.3.6-lp152.2.3.1 pipewire-libpulse-0_3-debuginfo-0.3.6-lp152.2.3.1 pipewire-modules-0.3.6-lp152.2.3.1 pipewire-modules-debuginfo-0.3.6-lp152.2.3.1 pipewire-spa-plugins-0_2-0.3.6-lp152.2.3.1 pipewire-spa-plugins-0_2-debuginfo-0.3.6-lp152.2.3.1 pipewire-spa-tools-0.3.6-lp152.2.3.1 pipewire-spa-tools-debuginfo-0.3.6-lp152.2.3.1 pipewire-tools-0.3.6-lp152.2.3.1 pipewire-tools-debuginfo-0.3.6-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15652.html https://www.suse.com/security/cve/CVE-2020-15653.html https://www.suse.com/security/cve/CVE-2020-15654.html https://www.suse.com/security/cve/CVE-2020-15655.html https://www.suse.com/security/cve/CVE-2020-15656.html https://www.suse.com/security/cve/CVE-2020-15657.html https://www.suse.com/security/cve/CVE-2020-15658.html https://www.suse.com/security/cve/CVE-2020-15659.html https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6514.html https://bugzilla.suse.com/1171433 https://bugzilla.suse.com/1174538 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1182-1: important: Security update for libX11
by opensuse-security＠opensuse.org 12 Aug '20

12 Aug '20

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1182-1 Rating: important References: #1174628 Cross-References: CVE-2020-14344 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - Fixed XIM client heap overflows (CVE-2020-14344, bsc#1174628). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1182=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libX11-6-1.6.5-lp152.5.6.1 libX11-6-debuginfo-1.6.5-lp152.5.6.1 libX11-debugsource-1.6.5-lp152.5.6.1 libX11-devel-1.6.5-lp152.5.6.1 libX11-xcb1-1.6.5-lp152.5.6.1 libX11-xcb1-debuginfo-1.6.5-lp152.5.6.1 - openSUSE Leap 15.2 (x86_64): libX11-6-32bit-1.6.5-lp152.5.6.1 libX11-6-32bit-debuginfo-1.6.5-lp152.5.6.1 libX11-devel-32bit-1.6.5-lp152.5.6.1 libX11-xcb1-32bit-1.6.5-lp152.5.6.1 libX11-xcb1-32bit-debuginfo-1.6.5-lp152.5.6.1 - openSUSE Leap 15.2 (noarch): libX11-data-1.6.5-lp152.5.6.1 References: https://www.suse.com/security/cve/CVE-2020-14344.html https://bugzilla.suse.com/1174628 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1183-1: moderate: Security update for ark
by opensuse-security＠opensuse.org 12 Aug '20

12 Aug '20

openSUSE Security Update: Security update for ark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1183-1 Rating: moderate References: #1174773 Cross-References: CVE-2020-16116 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ark fixes the following issues: - Fixed a directory traversal bug (boo#1174773, CVE-2020-16116). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1183=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1183=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1183=1 Package List: - openSUSE Leap 15.2 (x86_64): ark-20.04.2-lp152.2.3.1 ark-debuginfo-20.04.2-lp152.2.3.1 ark-debugsource-20.04.2-lp152.2.3.1 libkerfuffle20-20.04.2-lp152.2.3.1 libkerfuffle20-debuginfo-20.04.2-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): ark-lang-20.04.2-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): ark-lang-18.12.3-lp151.2.4.1 - openSUSE Leap 15.1 (x86_64): ark-18.12.3-lp151.2.4.1 ark-debuginfo-18.12.3-lp151.2.4.1 ark-debugsource-18.12.3-lp151.2.4.1 libkerfuffle18-18.12.3-lp151.2.4.1 libkerfuffle18-debuginfo-18.12.3-lp151.2.4.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ark-18.12.3-bp151.3.3.1 libkerfuffle18-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): ark-lang-18.12.3-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-16116.html https://bugzilla.suse.com/1174773 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1179-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 11 Aug '20

11 Aug '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1179-1 Rating: important References: #1174538 Cross-References: CVE-2020-15652 CVE-2020-15659 CVE-2020-6463 CVE-2020-6514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Updated to Mozilla Thunderbird 68.11: * Fixed various security issues (MFSA-2020-35, bsc#1174538). * Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538). * Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538). * Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538). * Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538). * Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1179=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.11.0-lp151.2.47.1 MozillaThunderbird-debuginfo-68.11.0-lp151.2.47.1 MozillaThunderbird-debugsource-68.11.0-lp151.2.47.1 MozillaThunderbird-translations-common-68.11.0-lp151.2.47.1 MozillaThunderbird-translations-other-68.11.0-lp151.2.47.1 References: https://www.suse.com/security/cve/CVE-2020-15652.html https://www.suse.com/security/cve/CVE-2020-15659.html https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6514.html https://bugzilla.suse.com/1174538 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1178-1: moderate: Security update for go1.13
by opensuse-security＠opensuse.org 10 Aug '20

10 Aug '20

openSUSE Security Update: Security update for go1.13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1178-1 Rating: moderate References: #1149259 #1174977 Cross-References: CVE-2020-16845 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.13 fixes the following issues: - go1.13 was updated to version 1.13.5 - CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1178=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.13-1.13.15-lp151.8.1 go1.13-doc-1.13.15-lp151.8.1 go1.13-race-1.13.15-lp151.8.1 References: https://www.suse.com/security/cve/CVE-2020-16845.html https://bugzilla.suse.com/1149259 https://bugzilla.suse.com/1174977 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1177-1: moderate: Security update for perl-XML-Twig
by opensuse-security＠opensuse.org 10 Aug '20

10 Aug '20

openSUSE Security Update: Security update for perl-XML-Twig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1177-1 Rating: moderate References: #1008644 Cross-References: CVE-2016-9180 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-XML-Twig fixes the following issues: - Security fix [bsc#1008644, CVE-2016-9180] * Setting expand_external_ents to 0 or -1 currently doesn't work as expected; To completely turn off expanding external entities use no_xxe. * Update documentation for XML::Twig to mention problems with expand_external_ents and add information about new no_xxe argument This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1177=1 Package List: - openSUSE Leap 15.1 (noarch): perl-XML-Twig-3.52-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2016-9180.html https://bugzilla.suse.com/1008644 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1175-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 09 Aug '20

09 Aug '20

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1175-1 Rating: important References: #1174157 Cross-References: CVE-2020-14556 CVE-2020-14562 CVE-2020-14573 CVE-2020-14577 CVE-2020-14581 CVE-2020-14583 CVE-2020-14593 CVE-2020-14621 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for java-11-openjdk fixes the following issues: - Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157) * Security fixes: + JDK-8230613: Better ASCII conversions + JDK-8231800: Better listing of arrays + JDK-8232014: Expand DTD support + JDK-8233234: Better Zip Naming + JDK-8233239, CVE-2020-14562: Enhance TIFF support + JDK-8233255: Better Swing Buttons + JDK-8234032: Improve basic calendar services + JDK-8234042: Better factory production of certificates + JDK-8234418: Better parsing with CertificateFactory + JDK-8234836: Improve serialization handling + JDK-8236191: Enhance OID processing + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior + JDK-8237592, CVE-2020-14577: Enhance certificate verification + JDK-8238002, CVE-2020-14581: Better matrix operations + JDK-8238013: Enhance String writing + JDK-8238804: Enhance key handling process + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable + JDK-8238843: Enhanced font handing + JDK-8238920, CVE-2020-14583: Better Buffer support + JDK-8238925: Enhance WAV file playback + JDK-8240119, CVE-2020-14593: Less Affine Transformations + JDK-8240482: Improved WAV file playback + JDK-8241379: Update JCEKS support + JDK-8241522: Manifest improved jar headers redux + JDK-8242136, CVE-2020-14621: Better XML namespace handling * Other changes: + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException: Buffers have not been created + JDK-7124307: JSpinner and changing value by mouse + JDK-8022574: remove HaltNode code after uncommon trap calls + JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails + JDK-8040630: Popup menus and tooltips flicker with previous popup contents when first shown + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9) + JDK-8048215: [TESTBUG] java/lang/management/ManagementFactory/ThreadMXBeanProxy.java Expected non-null LockInfo + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails in nightly + JDK-8080353: JShell: Better error message on attempting to add default method + JDK-8139876: Exclude hanging nsk/stress/stack from execution with deoptimization enabled + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails with -XX:+DeoptimizeALot + JDK-8153430: jdk regression test MletParserLocaleTest, ParserInfiniteLoopTest reduce default timeout + JDK-8156207: Resource allocated BitMaps are often cleared unnecessarily + JDK-8159740: JShell: corralled declarations do not have correct source to wrapper mapping + JDK-8175984: ICC_Profile has un-needed, not-empty finalize method + JDK-8176359: Frame#setMaximizedbounds not working properly in multi screen environments + JDK-8183369: RFC unconformity of HttpURLConnection with proxy + JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT + JDK-8189861: Refactor CacheFind + JDK-8191169: java/net/Authenticator/B4769350.java failed intermittently + JDK-8191930: [Graal] emits unparseable XML into compile log + JDK-8193879: Java debugger hangs on method invocation + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on Windows + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails + JDK-8198000: java/awt/List/EmptyListEventTest/EmptyListEventTest.java debug assert on Windows + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/ /WrongParentAfterRemoveMenu.java debug assert on Windows + JDK-8198339: Test javax/swing/border/Test6981576.java is unstable + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows, after JDK-8198801 + JDK-8203264: JNI exception pending in PlainDatagramSocketImpl.c:740 + JDK-8203672: JNI exception pending in PlainSocketImpl.c + JDK-8203673: JNI exception pending in DualStackPlainDatagramSocketImpl.c:398 + JDK-8204834: Fix confusing "allocate" naming in OopStorage + JDK-8205399: Set node color on pinned HashMap.TreeNode deletion + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/ /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with handshake_failure + JDK-8206179: com/sun/management/OperatingSystemMXBean/ /GetCommittedVirtualMemorySize.java fails with Committed virtual memory size illegal value + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit() with RunThese30M + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize) doesn't work with 1GB LargePages This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1175=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.8.0-lp151.3.19.1 java-11-openjdk-accessibility-11.0.8.0-lp151.3.19.1 java-11-openjdk-accessibility-debuginfo-11.0.8.0-lp151.3.19.1 java-11-openjdk-debuginfo-11.0.8.0-lp151.3.19.1 java-11-openjdk-debugsource-11.0.8.0-lp151.3.19.1 java-11-openjdk-demo-11.0.8.0-lp151.3.19.1 java-11-openjdk-devel-11.0.8.0-lp151.3.19.1 java-11-openjdk-headless-11.0.8.0-lp151.3.19.1 java-11-openjdk-jmods-11.0.8.0-lp151.3.19.1 java-11-openjdk-src-11.0.8.0-lp151.3.19.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.8.0-lp151.3.19.1 References: https://www.suse.com/security/cve/CVE-2020-14556.html https://www.suse.com/security/cve/CVE-2020-14562.html https://www.suse.com/security/cve/CVE-2020-14573.html https://www.suse.com/security/cve/CVE-2020-14577.html https://www.suse.com/security/cve/CVE-2020-14581.html https://www.suse.com/security/cve/CVE-2020-14583.html https://www.suse.com/security/cve/CVE-2020-14593.html https://www.suse.com/security/cve/CVE-2020-14621.html https://bugzilla.suse.com/1174157 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1172-1: moderate: Security update for opera
by opensuse-security＠opensuse.org 09 Aug '20

09 Aug '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1172-1 Rating: moderate References: Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to version 70.0.3728.71 - DNA-86267 Make `Recently closed tabs` appearance consistent with `Search for open tabs`. - DNA-86988 Opera 70 translations - DNA-87530 Zen news leads not loading - DNA-87636 Fix displaying folder icon for closed windows in recently closed list - DNA-87682 Replace Extensions icon in toolbar with icon from sidebar - DNA-87756 Extend chrome.sessions.getRecentlyClosed with information about last active tab in window. - DNA-87778 Crash at opera::InstantSearchViewViews:: ~InstantSearchViewViews() - DNA-87815 Change affiliate links for AliExpress Search - Update to version 70.0.3728.59 - CHR-8010 Update chromium on desktop-stable-84-3728 to 84.0.4147.89 - DNA-87019 The video image does not respond to the pressing after closed the “Quit Opera?” dialog - DNA-87342 Fix right padding in settings > weather section - DNA-87427 Remove unneeded information from the requests’ diagnostics - DNA-87560 Crash at views::Widget::GetNativeView() - DNA-87561 Crash at CRYPTO_BUFFER_len - DNA-87599 Bypass VPN for default search engines doesn’t work - DNA-87611 Unittests fails on declarativeNetRequest and declarativeNetRequestFeedback permissions - DNA-87612 [Mac] Misaligned icon in address bar - DNA-87619 [Win/Lin] Misaligned icon in address bar - DNA-87716 [macOS/Windows] Crash when Search in tabs is open and Opera is minimised - DNA-87749 Crash at opera::InstantSearchSuggestionLineView:: SetIsHighlighted(bool) - The update to chromium 84.0.4147.89 fixes following issues: - CVE-2020-6510, CVE-2020-6511, CVE-2020-6512, CVE-2020-6513, CVE-2020-6514, CVE-2020-6515, CVE-2020-6516, CVE-2020-6517, CVE-2020-6518, CVE-2020-6519, CVE-2020-6520, CVE-2020-6521, CVE-2020-6522, CVE-2020-6523, CVE-2020-6524, CVE-2020-6525, CVE-2020-6526, CVE-2020-6527, CVE-2020-6528, CVE-2020-6529, CVE-2020-6530, CVE-2020-6531, CVE-2020-6533, CVE-2020-6534, CVE-2020-6535, CVE-2020-6536 - Complete Opera 70.0 changelog at: https://blogs.opera.com/desktop/changelog-for-70/ - Update to version 69.0.3686.77 - DNA-84207 New Yubikey enrollment is not working - DNA-87185 Lost translation - DNA-87382 Integrate scrolling to top of the feed with the existing scroll position restoration - DNA-87535 Sort out news on startpage state - DNA-87588 Merge “Prevent pointer from being sent in the clear over SCTP” to desktop-stable-83-3686 - Update to version 69.0.3686.57 - DNA-86682 Title case in Russian translation - DNA-86807 Title case in O69 BR Portuguese translation - DNA-87104 Right click context menu becomes scrollable sometimes - DNA-87376 Search in tabs opens significantly slower in O69 - DNA-87505 [Welcome Pages][Stats] Session stats for Welcome and Upgrade pages - DNA-87535 Sort out news on startpage state Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-1172=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-70.0.3728.71-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1169-1: important: Security update for grub2
by opensuse-security＠opensuse.org 08 Aug '20

08 Aug '20

openSUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1169-1 Rating: important References: #1168994 #1173812 #1174463 #1174570 Cross-References: CVE-2020-10713 CVE-2020-14308 CVE-2020-14309 CVE-2020-14310 CVE-2020-14311 CVE-2020-15706 CVE-2020-15707 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 (bsc#1168994) - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 (bsc#1173812) - Fix for CVE-2020-15706 (bsc#1174463) - Fix for CVE-2020-15707 (bsc#1174570) - Use overflow checking primitives where the arithmetic expression for buffer - Use grub_calloc for overflow check and return NULL when it would occur This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1169=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): grub2-2.04-lp152.7.3.4 grub2-branding-upstream-2.04-lp152.7.3.4 grub2-debuginfo-2.04-lp152.7.3.4 grub2-debugsource-2.04-lp152.7.3.4 - openSUSE Leap 15.2 (noarch): grub2-i386-efi-2.04-lp152.7.3.4 grub2-i386-efi-debug-2.04-lp152.7.3.4 grub2-i386-pc-2.04-lp152.7.3.4 grub2-i386-pc-debug-2.04-lp152.7.3.4 grub2-i386-xen-2.04-lp152.7.3.4 grub2-snapper-plugin-2.04-lp152.7.3.4 grub2-systemd-sleep-plugin-2.04-lp152.7.3.4 grub2-x86_64-efi-2.04-lp152.7.3.4 grub2-x86_64-efi-debug-2.04-lp152.7.3.4 grub2-x86_64-xen-2.04-lp152.7.3.4 References: https://www.suse.com/security/cve/CVE-2020-10713.html https://www.suse.com/security/cve/CVE-2020-14308.html https://www.suse.com/security/cve/CVE-2020-14309.html https://www.suse.com/security/cve/CVE-2020-14310.html https://www.suse.com/security/cve/CVE-2020-14311.html https://www.suse.com/security/cve/CVE-2020-15706.html https://www.suse.com/security/cve/CVE-2020-15707.html https://bugzilla.suse.com/1168994 https://bugzilla.suse.com/1173812 https://bugzilla.suse.com/1174463 https://bugzilla.suse.com/1174570 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0