September 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1494-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 21 Sep '20

21 Sep '20

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1494-1 Rating: moderate References: #1175109 Cross-References: CVE-2020-8231 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - An application that performs multiple requests with libcurl's multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl will pick and use the wrong connection and instead pick another one the application has created since then. [bsc#1175109, CVE-2020-8231] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1494=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): curl-7.66.0-lp152.3.9.1 curl-debuginfo-7.66.0-lp152.3.9.1 curl-debugsource-7.66.0-lp152.3.9.1 curl-mini-7.66.0-lp152.3.9.1 curl-mini-debuginfo-7.66.0-lp152.3.9.1 curl-mini-debugsource-7.66.0-lp152.3.9.1 libcurl-devel-7.66.0-lp152.3.9.1 libcurl-mini-devel-7.66.0-lp152.3.9.1 libcurl4-7.66.0-lp152.3.9.1 libcurl4-debuginfo-7.66.0-lp152.3.9.1 libcurl4-mini-7.66.0-lp152.3.9.1 libcurl4-mini-debuginfo-7.66.0-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libcurl-devel-32bit-7.66.0-lp152.3.9.1 libcurl4-32bit-7.66.0-lp152.3.9.1 libcurl4-32bit-debuginfo-7.66.0-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-8231.html https://bugzilla.suse.com/1175109 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1486-1: moderate: Security update for virtualbox
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1486-1 Rating: moderate References: #1114605 #1174075 #1174159 #1175201 Cross-References: CVE-2020-14628 CVE-2020-14629 CVE-2020-14646 CVE-2020-14647 CVE-2020-14648 CVE-2020-14649 CVE-2020-14650 CVE-2020-14673 CVE-2020-14674 CVE-2020-14675 CVE-2020-14676 CVE-2020-14677 CVE-2020-14694 CVE-2020-14695 CVE-2020-14698 CVE-2020-14699 CVE-2020-14700 CVE-2020-14703 CVE-2020-14704 CVE-2020-14707 CVE-2020-14711 CVE-2020-14712 CVE-2020-14713 CVE-2020-14714 CVE-2020-14715 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for virtualbox fixes the following issues: Update to Oracle version 6.1.14a. This minor update enables the building of libvirt again. Version update to 6.1.14 (released September 04 2020 by Oracle) File "fix_virtio_build.patch" is added to fix a build problem. This is a maintenance release. The following items were fixed and/or added: GUI: Fixes file name changes in the File location field when creating Virtual Hard Disk (bug #19286) VMM: Fixed running VMs which failed to start with VERR_NEM_MISSING_KERNEL_API_2 when Hyper-V is used (bug #19779 and #19804) Audio: fix regression in HDA emulation introduced in 6.1.0 Shared Clipboard: Fixed a potential crash when copying HTML data (6.1.2 regression; bug #19226) Linux host and guest: Linux kernel version 5.8 support EFI: Fixed reading ISO9660 filesystems on attached media (6.1.0 regression; bug #19682) EFI: Support booting from drives attached to the LsiLogic SCSI and SAS controller emulations Pseudo version bump to 6.1.13, which is NOT an Oracle release. Update VB sources to run under kernel 5.8.0+ with no modifications to the kernel. These sources are derived from r85883 of the Oracle svn repository. For operations with USB{2,3}, the extension pack for revision 140056 must be installed. Once Oracle releases 6.1.14, then the extension pack and VB itself will have the same revision number. File "fixes_for_5.8.patch" is removed as that part was fixed upstream. Fixes boo#1175201. Apply Oracle changes for kernel 5.8. Version bump to 6.1.12 (released July 14 2020 by Oracle) This is a maintenance release. The following items were fixed and/or added: File "turn_off_cloud_net.patch" added. Fixes for CVE-2020-14628, CVE-2020-14646, CVE-2020-14647, CVE-2020-14649 CVE-2020-14713, CVE-2020-14674, CVE-2020-14675, CVE-2020-14676 CVE-2020-14677, CVE-2020-14699, CVE-2020-14711, CVE-2020-14629 CVE-2020-14703, CVE-2020-14704, CVE-2020-14648, CVE-2020-14650 CVE-2020-14673, CVE-2020-14694, CVE-2020-14695, CVE-2020-14698 CVE-2020-14700, CVE-2020-14712, CVE-2020-14707, CVE-2020-14714 CVE-2020-14715 boo#1174159. UI: Fixes for Log-Viewer search-backward icon Devices: Fixes and improvements for the BusLogic SCSI controller emulation Serial Port: Regression fixes in FIFO data handling Oracle Cloud Infrastructure integration: Experimental new type of network attachment, allowing local VM to act as if it was run in cloud API: improved resource management in the guest control functionality VBoxManage: fixed command option parsing for the "snapshot edit" sub-command VBoxManage: Fix crash of 'VBoxManage internalcommands repairhd' when processing invalid input (bug #19579) Guest Additions, 3D: New experimental GLX graphics output Guest Additions, 3D: Fixed releasing texture objects, which could cause guest crashes Guest Additions: Fixed writes to a file on a shared folder not being reflected on the host when the file is mmap'ed and the used Linux kernel is between version 4.10.0 and 4.11.x Guest Additions: Fixed the shared folder driver on 32bit Windows 8 and newer returning an error when flushing writes to a file which is mapped into memory under rare circumstances Guest Additions: Improve resize coverage for VMSVGA graphics controller Guest Additions: Fix issues detecting guest additions ISO at runtime Guest Additions: Fixed German translation encoding for Windows GA installer Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1486=1 Package List: - openSUSE Leap 15.2 (noarch): virtualbox-guest-desktop-icons-6.1.14-lp152.2.5.1 virtualbox-guest-source-6.1.14-lp152.2.5.1 virtualbox-host-source-6.1.14-lp152.2.5.1 - openSUSE Leap 15.2 (x86_64): python3-virtualbox-6.1.14-lp152.2.5.1 python3-virtualbox-debuginfo-6.1.14-lp152.2.5.1 virtualbox-6.1.14-lp152.2.5.1 virtualbox-debuginfo-6.1.14-lp152.2.5.1 virtualbox-debugsource-6.1.14-lp152.2.5.1 virtualbox-devel-6.1.14-lp152.2.5.1 virtualbox-guest-tools-6.1.14-lp152.2.5.1 virtualbox-guest-tools-debuginfo-6.1.14-lp152.2.5.1 virtualbox-guest-x11-6.1.14-lp152.2.5.1 virtualbox-guest-x11-debuginfo-6.1.14-lp152.2.5.1 virtualbox-kmp-debugsource-6.1.14-lp152.2.5.1 virtualbox-kmp-default-6.1.14_k5.3.18_lp152.41-lp152.2.5.1 virtualbox-kmp-default-debuginfo-6.1.14_k5.3.18_lp152.41-lp152.2.5.1 virtualbox-kmp-preempt-6.1.14_k5.3.18_lp152.41-lp152.2.5.1 virtualbox-kmp-preempt-debuginfo-6.1.14_k5.3.18_lp152.41-lp152.2.5.1 virtualbox-qt-6.1.14-lp152.2.5.1 virtualbox-qt-debuginfo-6.1.14-lp152.2.5.1 virtualbox-vnc-6.1.14-lp152.2.5.1 virtualbox-websrv-6.1.14-lp152.2.5.1 virtualbox-websrv-debuginfo-6.1.14-lp152.2.5.1 References: https://www.suse.com/security/cve/CVE-2020-14628.html https://www.suse.com/security/cve/CVE-2020-14629.html https://www.suse.com/security/cve/CVE-2020-14646.html https://www.suse.com/security/cve/CVE-2020-14647.html https://www.suse.com/security/cve/CVE-2020-14648.html https://www.suse.com/security/cve/CVE-2020-14649.html https://www.suse.com/security/cve/CVE-2020-14650.html https://www.suse.com/security/cve/CVE-2020-14673.html https://www.suse.com/security/cve/CVE-2020-14674.html https://www.suse.com/security/cve/CVE-2020-14675.html https://www.suse.com/security/cve/CVE-2020-14676.html https://www.suse.com/security/cve/CVE-2020-14677.html https://www.suse.com/security/cve/CVE-2020-14694.html https://www.suse.com/security/cve/CVE-2020-14695.html https://www.suse.com/security/cve/CVE-2020-14698.html https://www.suse.com/security/cve/CVE-2020-14699.html https://www.suse.com/security/cve/CVE-2020-14700.html https://www.suse.com/security/cve/CVE-2020-14703.html https://www.suse.com/security/cve/CVE-2020-14704.html https://www.suse.com/security/cve/CVE-2020-14707.html https://www.suse.com/security/cve/CVE-2020-14711.html https://www.suse.com/security/cve/CVE-2020-14712.html https://www.suse.com/security/cve/CVE-2020-14713.html https://www.suse.com/security/cve/CVE-2020-14714.html https://www.suse.com/security/cve/CVE-2020-14715.html https://bugzilla.suse.com/1114605 https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1174159 https://bugzilla.suse.com/1175201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1483-1: important: Security update for perl-DBI
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Security update for perl-DBI ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1483-1 Rating: important References: #1176409 #1176412 Cross-References: CVE-2020-14392 CVE-2020-14393 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for perl-DBI fixes the following issues: Security issues fixed: - CVE-2020-14392: Memory corruption in XS functions when Perl stack is reallocated (bsc#1176412). - CVE-2020-14393: Fixed a buffer overflow on an overlong DBD class name (bsc#1176409). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1483=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): perl-DBI-1.642-lp152.2.3.1 perl-DBI-debuginfo-1.642-lp152.2.3.1 perl-DBI-debugsource-1.642-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14392.html https://www.suse.com/security/cve/CVE-2020-14393.html https://bugzilla.suse.com/1176409 https://bugzilla.suse.com/1176412 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1475-1: moderate: Recommended update for otrs
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Recommended update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1475-1 Rating: moderate References: #1122560 #1137614 #1137615 #1139406 #1141430 #1141431 #1141432 #1156431 #1157001 #1160663 #1168029 #1168030 #1168031 #1168032 Cross-References: CVE-2019-10067 CVE-2019-12248 CVE-2019-12497 CVE-2019-12746 CVE-2019-13457 CVE-2019-13458 CVE-2019-16375 CVE-2019-18179 CVE-2019-18180 CVE-2019-9752 CVE-2019-9892 CVE-2020-1765 CVE-2020-1766 CVE-2020-1769 CVE-2020-1770 CVE-2020-1771 CVE-2020-1772 CVE-2020-1773 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Otrs was updated to 5.0.42, fixing lots of bugs and security issues: https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo#1168029 OSA-2020-10: * Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. - CVE-2020-1772 boo#1168029 OSA-2020-09: * Information Disclosure It’s possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. - CVE-2020-1771 boo#1168030 OSA-2020-08: * Possible XSS in Customer user address book Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. - CVE-2020-1770 boo#1168031 OSA-2020-07: * Information disclosure in support bundle files Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. - CVE-2020-1769 boo#1168032 OSA-2020-06: * Autocomplete in the form login screens In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. Update to 5.0.41 https://community.otrs.com/otrs-community-edition-5s-patch-level-41/ * bug#14912 - Installer refers to non-existing documentation - added code to upgrade OTRS from 4 to 5 READ UPGRADING.SUSE * steps 1 to 4 are done by rpm pkg * steps 5 to *END* need to be done manually cause of DB backup Update to 5.0.40 https://community.otrs.com/otrs-community-edition-5s-patch-level-40/ - CVE-2020-1766 boo#1160663 OSA-2020-02: Improper handling of uploaded inline images Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. * CVE-2020-1765, OSA-2020-01: Spoofing of From field in several screens An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade - Update 5.0.39 https://community.otrs.com/otrs-community-edition-5s-patch-level-39/ * CVE-2019-18180 boo#1157001 OSA-2019-15: Denial of service OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). * CVE-2019-18179 OSA-2019-14: Information Disclosure An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. Update to 5.0.38 https://community.otrs.com/release-notes-otrs-5s-patch-level-38/ * CVE-2019-16375, boo#1156431 OSA-2019-13: Stored XXS An attacker who is logged into OTRS as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent compose an answer to the original article. Update to 5.0.37 https://community.otrs.com/release-notes-otrs-5s-patch-level-37/ * CVE-2019-13458, boo#1141432, OSA-2019-12: Information Disclosure An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS tags in templates in order to disclose hashed user passwords. * CVE-2019-13457, boo#1141431, OSA-2019-11: Information Disclosure A customer user can use the search results to disclose information from their “company” tickets (with the same CustomerID), even when CustomerDisableCompanyTicketAccess setting is turned on. * CVE-2019-12746, boo#1141430, OSA-2019-10: Session ID Disclosure A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then potentially abused in order to impersonate the agent user. Update to 5.0.36 https://community.otrs.com/release-notes-otrs-5s-patch-level-36/ * CVE-2019-12497, boo#1137614, OSA-2019-09: Information Disclosure In the customer or external frontend, personal information of agents can be disclosed like Name and mail address in external notes. * CVE-2019-12248, boo#1137615, OSA-2019-08: Loading External Image Resources An attacker could send a malicious email to an OTRS system. If a logged in agent user quotes it, the email could cause the browser to load external image resources. Update to 5.0.35 https://community.otrs.com/release-notes-otrs-5s-patch-level-35/ * CVE-2019-10067, boo#1139406, OSA-2019-05: Reflected and Stored XSS An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. * CVE-2019-9892, boo#1139406, OSA-2019-04: XXE Processing An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files of OTRS filesystem. - update missing CVE for OSA-2018-10, OSA-2019-01 Update to 5.0.34 * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/ * CVE-2019-9752, boo#1122560, OSA-2019-01: Stored XSS An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. Update to 5.0.33 * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/ Update to 5.0.26 * https://www.otrs.com/release-notes-otrs-5s-patch-level-26 * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/ - remove obsolete * otrs-scheduler.service * otrs-scheduler.init This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1475=1 Package List: - openSUSE Leap 15.2 (noarch): otrs-6.0.29-lp152.2.3.4 otrs-doc-6.0.29-lp152.2.3.4 otrs-itsm-6.0.29-lp152.2.3.4 - openSUSE Leap 15.1 (noarch): otrs-6.0.29-lp151.2.6.2 otrs-doc-6.0.29-lp151.2.6.2 otrs-itsm-6.0.29-lp151.2.6.2 - openSUSE Backports SLE-15-SP2 (noarch): otrs-6.0.29-bp152.2.5.4 otrs-doc-6.0.29-bp152.2.5.4 otrs-itsm-6.0.29-bp152.2.5.4 - openSUSE Backports SLE-15-SP1 (noarch): otrs-6.0.29-bp151.3.6.2 otrs-doc-6.0.29-bp151.3.6.2 otrs-itsm-6.0.29-bp151.3.6.2 References: https://www.suse.com/security/cve/CVE-2019-10067.html https://www.suse.com/security/cve/CVE-2019-12248.html https://www.suse.com/security/cve/CVE-2019-12497.html https://www.suse.com/security/cve/CVE-2019-12746.html https://www.suse.com/security/cve/CVE-2019-13457.html https://www.suse.com/security/cve/CVE-2019-13458.html https://www.suse.com/security/cve/CVE-2019-16375.html https://www.suse.com/security/cve/CVE-2019-18179.html https://www.suse.com/security/cve/CVE-2019-18180.html https://www.suse.com/security/cve/CVE-2019-9752.html https://www.suse.com/security/cve/CVE-2019-9892.html https://www.suse.com/security/cve/CVE-2020-1765.html https://www.suse.com/security/cve/CVE-2020-1766.html https://www.suse.com/security/cve/CVE-2020-1769.html https://www.suse.com/security/cve/CVE-2020-1770.html https://www.suse.com/security/cve/CVE-2020-1771.html https://www.suse.com/security/cve/CVE-2020-1772.html https://www.suse.com/security/cve/CVE-2020-1773.html https://bugzilla.suse.com/1122560 https://bugzilla.suse.com/1137614 https://bugzilla.suse.com/1137615 https://bugzilla.suse.com/1139406 https://bugzilla.suse.com/1141430 https://bugzilla.suse.com/1141431 https://bugzilla.suse.com/1141432 https://bugzilla.suse.com/1156431 https://bugzilla.suse.com/1157001 https://bugzilla.suse.com/1160663 https://bugzilla.suse.com/1168029 https://bugzilla.suse.com/1168030 https://bugzilla.suse.com/1168031 https://bugzilla.suse.com/1168032 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1478-1: important: Security update for fossil
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: #1047218 #1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for fossil fixes the following issues: - fossil 2.12.1: * CVE-2020-24614: Remote authenticated users with check-in or administrative privileges could have executed arbitrary code [boo#1175760] * Security fix in the "fossil git export" command. New "safety-net" features were added to prevent similar problems in the future. * Enhancements to the graph display for cases when there are many cherry-pick merges into a single check-in. Example * Enhance the fossil open command with the new --workdir option and the ability to accept a URL as the repository name, causing the remote repository to be cloned automatically. Do not allow "fossil open" to open in a non-empty working directory unless the --keep option or the new --force option is used. * Enhance the markdown formatter to more closely follow the CommonMark specification with regard to text highlighting. Underscores in the middle of identifiers (ex: fossil_printf()) no longer need to be escaped. * The markdown-to-html translator can prevent unsafe HTML (for example: <script>) on user-contributed pages like forum and tickets and wiki. The admin can adjust this behavior using the safe-html setting on the Admin/Wiki page. The default is to disallow unsafe HTML everywhere. * Added the "collapse" and "expand" capability for long forum posts. * The "fossil remote" command now has options for specifying multiple persistent remotes with symbolic names. Currently only one remote can be used at a time, but that might change in the future. * Add the "Remember me?" checkbox on the login page. Use a session cookie for the login if it is not checked. * Added the experimental "fossil hook" command for managing "hook scripts" that run before checkin or after a push. * Enhance the fossil revert command so that it is able to revert all files beneath a directory. * Add the fossil bisect skip command. * Add the fossil backup command. * Enhance fossil bisect ui so that it shows all unchecked check-ins in between the innermost "good" and "bad" check-ins. * Added the --reset flag to the "fossil add", "fossil rm", and "fossil addremove" commands. * Added the "--min N" and "--logfile FILENAME" flags to the backoffice command, as well as other enhancements to make the backoffice command a viable replacement for automatic backoffice. Other incremental backoffice improvements. * Added the /fileedit page, which allows editing of text files online. Requires explicit activation by a setup user. * Translate built-in help text into HTML for display on web pages. * On the /timeline webpage, the combination of query parameters "p=CHECKIN" and "bt=ANCESTOR" draws all ancestors of CHECKIN going back to ANCESTOR. * Update the built-in SQLite so that the "fossil sql" command supports new output modes ".mode box" and ".mode json". * Add the "obscure()" SQL function to the "fossil sql" command. * Added virtual tables "helptext" and "builtin" to the "fossil sql" command, providing access to the dispatch table including all help text, and the builtin data files, respectively. * Delta compression is now applied to forum edits. * The wiki editor has been modernized and is now Ajax-based. - Package the fossil.1 manual page. - fossil 2.11.1: * Make the "fossil git export" command more restrictive about characters that it allows in the tag names - Add fossil-2.11-reproducible.patch to override build date (boo#1047218) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1478=1 Package List: - openSUSE Leap 15.2 (x86_64): fossil-2.12.1-lp152.2.3.1 fossil-debuginfo-2.12.1-lp152.2.3.1 fossil-debugsource-2.12.1-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): fossil-2.12.1-lp151.3.6.1 fossil-debuginfo-2.12.1-lp151.3.6.1 fossil-debugsource-2.12.1-lp151.3.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.12.1-bp152.2.3.1 fossil-debuginfo-2.12.1-bp152.2.3.1 fossil-debugsource-2.12.1-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): fossil-2.12.1-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-24614.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1175760 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1453-1: moderate: Security update for lilypond
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for lilypond ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1453-1 Rating: moderate References: #1174949 Cross-References: CVE-2020-17353 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lilypond fixes the following issues: - CVE-2020-17353: When -dsafe is used, LilyPond lacks restrictions on embedded-ps and embedded-svg (boo#1174949). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1453=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1453=1 Package List: - openSUSE Leap 15.2 (noarch): lilypond-doc-2.20.0-lp152.2.5.10 lilypond-doc-cs-2.20.0-lp152.2.5.10 lilypond-doc-de-2.20.0-lp152.2.5.10 lilypond-doc-es-2.20.0-lp152.2.5.10 lilypond-doc-fr-2.20.0-lp152.2.5.10 lilypond-doc-hu-2.20.0-lp152.2.5.10 lilypond-doc-it-2.20.0-lp152.2.5.10 lilypond-doc-ja-2.20.0-lp152.2.5.10 lilypond-doc-nl-2.20.0-lp152.2.5.10 lilypond-doc-zh-2.20.0-lp152.2.5.10 lilypond-emmentaler-fonts-2.20.0-lp152.2.5.10 lilypond-fonts-common-2.20.0-lp152.2.5.10 lilypond-texgy-fonts-2.20.0-lp152.2.5.10 - openSUSE Leap 15.2 (x86_64): lilypond-2.20.0-lp152.2.5.10 lilypond-debuginfo-2.20.0-lp152.2.5.10 lilypond-debugsource-2.20.0-lp152.2.5.10 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): lilypond-2.20.0-bp152.2.5.6 lilypond-debuginfo-2.20.0-bp152.2.5.6 lilypond-debugsource-2.20.0-bp152.2.5.6 - openSUSE Backports SLE-15-SP2 (noarch): lilypond-emmentaler-fonts-2.20.0-bp152.2.5.6 lilypond-fonts-common-2.20.0-bp152.2.5.6 lilypond-texgy-fonts-2.20.0-bp152.2.5.6 References: https://www.suse.com/security/cve/CVE-2020-17353.html https://bugzilla.suse.com/1174949 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1468-1: moderate: Security update for slurm_18_08
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for slurm_18_08 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1468-1 Rating: moderate References: #1172004 Cross-References: CVE-2020-12693 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm_18_08 fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user to launch a process as an arbitrary user. (CVE-2020-12693, bsc#1172004). Add: Fix-Authentication-Bypass-when-Message-Aggregation-is-enabled-CVE-2020-1269 3.patch - Remove unneeded build dependency to postgresql-devel. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1468=1 Package List: - openSUSE Leap 15.2 (x86_64): libpmi0-18.08.9-lp152.2.1 libpmi0-debuginfo-18.08.9-lp152.2.1 libslurm33-18.08.9-lp152.2.1 libslurm33-debuginfo-18.08.9-lp152.2.1 perl-slurm-18.08.9-lp152.2.1 perl-slurm-debuginfo-18.08.9-lp152.2.1 slurm-18.08.9-lp152.2.1 slurm-auth-none-18.08.9-lp152.2.1 slurm-auth-none-debuginfo-18.08.9-lp152.2.1 slurm-config-18.08.9-lp152.2.1 slurm-config-man-18.08.9-lp152.2.1 slurm-cray-18.08.9-lp152.2.1 slurm-cray-debuginfo-18.08.9-lp152.2.1 slurm-debuginfo-18.08.9-lp152.2.1 slurm-debugsource-18.08.9-lp152.2.1 slurm-devel-18.08.9-lp152.2.1 slurm-doc-18.08.9-lp152.2.1 slurm-hdf5-18.08.9-lp152.2.1 slurm-hdf5-debuginfo-18.08.9-lp152.2.1 slurm-lua-18.08.9-lp152.2.1 slurm-lua-debuginfo-18.08.9-lp152.2.1 slurm-munge-18.08.9-lp152.2.1 slurm-munge-debuginfo-18.08.9-lp152.2.1 slurm-node-18.08.9-lp152.2.1 slurm-node-debuginfo-18.08.9-lp152.2.1 slurm-openlava-18.08.9-lp152.2.1 slurm-pam_slurm-18.08.9-lp152.2.1 slurm-pam_slurm-debuginfo-18.08.9-lp152.2.1 slurm-plugins-18.08.9-lp152.2.1 slurm-plugins-debuginfo-18.08.9-lp152.2.1 slurm-seff-18.08.9-lp152.2.1 slurm-sjstat-18.08.9-lp152.2.1 slurm-slurmdbd-18.08.9-lp152.2.1 slurm-slurmdbd-debuginfo-18.08.9-lp152.2.1 slurm-sql-18.08.9-lp152.2.1 slurm-sql-debuginfo-18.08.9-lp152.2.1 slurm-sview-18.08.9-lp152.2.1 slurm-sview-debuginfo-18.08.9-lp152.2.1 slurm-torque-18.08.9-lp152.2.1 slurm-torque-debuginfo-18.08.9-lp152.2.1 slurm-webdoc-18.08.9-lp152.2.1 References: https://www.suse.com/security/cve/CVE-2020-12693.html https://bugzilla.suse.com/1172004 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1458-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1458-1 Rating: moderate References: #1172491 Cross-References: CVE-2020-13790 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libjpeg-turbo fixes the following issues: - CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file (bsc#1172491). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1458=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjpeg-turbo-1.5.3-lp152.8.3.1 libjpeg-turbo-debuginfo-1.5.3-lp152.8.3.1 libjpeg-turbo-debugsource-1.5.3-lp152.8.3.1 libjpeg62-62.2.0-lp152.8.3.1 libjpeg62-debuginfo-62.2.0-lp152.8.3.1 libjpeg62-devel-62.2.0-lp152.8.3.1 libjpeg62-turbo-1.5.3-lp152.8.3.1 libjpeg62-turbo-debugsource-1.5.3-lp152.8.3.1 libjpeg8-8.1.2-lp152.8.3.1 libjpeg8-debuginfo-8.1.2-lp152.8.3.1 libjpeg8-devel-8.1.2-lp152.8.3.1 libturbojpeg0-8.1.2-lp152.8.3.1 libturbojpeg0-debuginfo-8.1.2-lp152.8.3.1 - openSUSE Leap 15.2 (x86_64): libjpeg62-32bit-62.2.0-lp152.8.3.1 libjpeg62-32bit-debuginfo-62.2.0-lp152.8.3.1 libjpeg62-devel-32bit-62.2.0-lp152.8.3.1 libjpeg8-32bit-8.1.2-lp152.8.3.1 libjpeg8-32bit-debuginfo-8.1.2-lp152.8.3.1 libjpeg8-devel-32bit-8.1.2-lp152.8.3.1 libturbojpeg0-32bit-8.1.2-lp152.8.3.1 libturbojpeg0-32bit-debuginfo-8.1.2-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2020-13790.html https://bugzilla.suse.com/1172491 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1465-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1465-1 Rating: moderate References: #1176179 Cross-References: CVE-2020-24977 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxml2 fixes the following issues: - CVE-2020-24977: Fixed a global-buffer-overflow in xmlEncodeEntitiesInternal (bsc#1176179). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1465=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libxml2-2-2.9.7-lp152.10.3.1 libxml2-2-debuginfo-2.9.7-lp152.10.3.1 libxml2-debugsource-2.9.7-lp152.10.3.1 libxml2-devel-2.9.7-lp152.10.3.1 libxml2-tools-2.9.7-lp152.10.3.1 libxml2-tools-debuginfo-2.9.7-lp152.10.3.1 python-libxml2-python-debugsource-2.9.7-lp152.10.3.1 python2-libxml2-python-2.9.7-lp152.10.3.1 python2-libxml2-python-debuginfo-2.9.7-lp152.10.3.1 python3-libxml2-python-2.9.7-lp152.10.3.1 python3-libxml2-python-debuginfo-2.9.7-lp152.10.3.1 - openSUSE Leap 15.2 (noarch): libxml2-doc-2.9.7-lp152.10.3.1 - openSUSE Leap 15.2 (x86_64): libxml2-2-32bit-2.9.7-lp152.10.3.1 libxml2-2-32bit-debuginfo-2.9.7-lp152.10.3.1 libxml2-devel-32bit-2.9.7-lp152.10.3.1 References: https://www.suse.com/security/cve/CVE-2020-24977.html https://bugzilla.suse.com/1176179 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1454-1: moderate: Security update for libetpan
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for libetpan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1454-1 Rating: moderate References: #1174579 Cross-References: CVE-2020-15953 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libetpan fixes the following issues: Update to 1.9.4 (boo#1174579, CVE-2020-15953): * Bugfixes on QUOTA * Varios warning fixes & build fixes Update to version 1.9.3 * Added IMAP CLIENTID / SMTP CLIENTID support * Use Cyrus SASL 2.1.27 Update to version 1.9.2 * Support of TLS SNI * LMDB for cache DB * Fixed build with recent versions of curl Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1454=1 Package List: - openSUSE Leap 15.2 (x86_64): libetpan-debugsource-1.9.4-lp152.3.3.1 libetpan-devel-1.9.4-lp152.3.3.1 libetpan20-1.9.4-lp152.3.3.1 libetpan20-debuginfo-1.9.4-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15953.html https://bugzilla.suse.com/1174579 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0