August 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1146-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 04 Aug '20

04 Aug '20

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1146-1 Rating: important References: #1174415 Cross-References: CVE-2020-15900 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issues: - fixed CVE-2020-15900 Memory Corruption (SAFER Sandbox Breakout) cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582 (bsc#1174415) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1146=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ghostscript-9.52-lp152.2.4.1 ghostscript-debuginfo-9.52-lp152.2.4.1 ghostscript-debugsource-9.52-lp152.2.4.1 ghostscript-devel-9.52-lp152.2.4.1 ghostscript-mini-9.52-lp152.2.4.1 ghostscript-mini-debuginfo-9.52-lp152.2.4.1 ghostscript-mini-debugsource-9.52-lp152.2.4.1 ghostscript-mini-devel-9.52-lp152.2.4.1 ghostscript-x11-9.52-lp152.2.4.1 ghostscript-x11-debuginfo-9.52-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-15900.html https://bugzilla.suse.com/1174415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1144-1: moderate: Security update for targetcli-fb
by opensuse-security＠opensuse.org 04 Aug '20

04 Aug '20

openSUSE Security Update: Security update for targetcli-fb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1144-1 Rating: moderate References: #1172743 Cross-References: CVE-2020-13867 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for targetcli-fb fixes the following issues: - CVE-2020-13867: Fixed the permissions in /etc/target (bsc#1172743) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1144=1 Package List: - openSUSE Leap 15.2 (noarch): python2-targetcli-fb-2.1.52-lp152.2.3.1 python3-targetcli-fb-2.1.52-lp152.2.3.1 targetcli-fb-common-2.1.52-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13867.html https://bugzilla.suse.com/1172743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1142-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 04 Aug '20

04 Aug '20

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1142-1 Rating: important References: #1174415 Cross-References: CVE-2020-15900 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issues: - fixed CVE-2020-15900 Memory Corruption (SAFER Sandbox Breakout) cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582 (bsc#1174415) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1142=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.52-lp151.3.15.1 ghostscript-debuginfo-9.52-lp151.3.15.1 ghostscript-debugsource-9.52-lp151.3.15.1 ghostscript-devel-9.52-lp151.3.15.1 ghostscript-mini-9.52-lp151.3.15.1 ghostscript-mini-debuginfo-9.52-lp151.3.15.1 ghostscript-mini-debugsource-9.52-lp151.3.15.1 ghostscript-mini-devel-9.52-lp151.3.15.1 ghostscript-x11-9.52-lp151.3.15.1 ghostscript-x11-debuginfo-9.52-lp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-15900.html https://bugzilla.suse.com/1174415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1141-1: moderate: Security update for targetcli-fb
by opensuse-security＠opensuse.org 03 Aug '20

03 Aug '20

openSUSE Security Update: Security update for targetcli-fb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1141-1 Rating: moderate References: #1172743 Cross-References: CVE-2020-13867 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for targetcli-fb fixes the following issues: - CVE-2020-13867: Fixed the permissions in /etc/target (bsc#1172743) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1141=1 Package List: - openSUSE Leap 15.1 (noarch): python2-targetcli-fb-2.1.49-lp151.2.10.1 python3-targetcli-fb-2.1.49-lp151.2.10.1 targetcli-fb-common-2.1.49-lp151.2.10.1 References: https://www.suse.com/security/cve/CVE-2020-13867.html https://bugzilla.suse.com/1172743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1139-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 03 Aug '20

03 Aug '20

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1139-1 Rating: moderate References: #1174457 Cross-References: CVE-2020-15917 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: - Update to 3.17.6: * It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues. * A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL). * The progress window when importing an mbox file is now more responsive. * A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled. * Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3. - CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1139=1 Package List: - openSUSE Leap 15.2 (x86_64): claws-mail-3.17.6-lp152.3.3.1 claws-mail-debuginfo-3.17.6-lp152.3.3.1 claws-mail-debugsource-3.17.6-lp152.3.3.1 claws-mail-devel-3.17.6-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): claws-mail-lang-3.17.6-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15917.html https://bugzilla.suse.com/1174457 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1128-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 02 Aug '20

02 Aug '20

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1128-1 Rating: moderate References: #1173674 Cross-References: CVE-2020-15503 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libraw fixes the following issues: - security update - added patches fix CVE-2020-15503 [bsc#1173674], lack of thumbnail size range check can lead to buffer overflow + libraw-CVE-2020-15503.patch This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1128=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libraw-debuginfo-0.18.9-lp152.5.3.1 libraw-debugsource-0.18.9-lp152.5.3.1 libraw-devel-0.18.9-lp152.5.3.1 libraw-devel-static-0.18.9-lp152.5.3.1 libraw-tools-0.18.9-lp152.5.3.1 libraw-tools-debuginfo-0.18.9-lp152.5.3.1 libraw16-0.18.9-lp152.5.3.1 libraw16-debuginfo-0.18.9-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-15503.html https://bugzilla.suse.com/1173674 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1121-1: moderate: Security update for ldb
by opensuse-security＠opensuse.org 01 Aug '20

01 Aug '20

openSUSE Security Update: Security update for ldb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1121-1 Rating: moderate References: #1173159 Cross-References: CVE-2020-10730 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ldb fixes the following issues: - CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1121=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ldb-debugsource-1.4.6-lp151.2.3.1 ldb-tools-1.4.6-lp151.2.3.1 ldb-tools-debuginfo-1.4.6-lp151.2.3.1 libldb-devel-1.4.6-lp151.2.3.1 libldb1-1.4.6-lp151.2.3.1 libldb1-debuginfo-1.4.6-lp151.2.3.1 python-ldb-1.4.6-lp151.2.3.1 python-ldb-debuginfo-1.4.6-lp151.2.3.1 python-ldb-devel-1.4.6-lp151.2.3.1 python3-ldb-1.4.6-lp151.2.3.1 python3-ldb-debuginfo-1.4.6-lp151.2.3.1 python3-ldb-devel-1.4.6-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libldb1-32bit-1.4.6-lp151.2.3.1 libldb1-32bit-debuginfo-1.4.6-lp151.2.3.1 python-ldb-32bit-1.4.6-lp151.2.3.1 python-ldb-32bit-debuginfo-1.4.6-lp151.2.3.1 python3-ldb-32bit-1.4.6-lp151.2.3.1 python3-ldb-32bit-debuginfo-1.4.6-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10730.html https://bugzilla.suse.com/1173159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0