September 2020 - openSUSE Security Announce

[security-announce] openSUSE-SU-2020:1459-1: moderate: Security update for openldap2
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1459-1 Rating: moderate References: #1174154 Cross-References: CVE-2020-15719 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openldap2 fixes the following issues: - bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509 SAN's falling back to CN validation in violation of rfc6125. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1459=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libldap-2_4-2-2.4.46-lp152.14.6.1 libldap-2_4-2-debuginfo-2.4.46-lp152.14.6.1 openldap2-2.4.46-lp152.14.6.1 openldap2-back-meta-2.4.46-lp152.14.6.1 openldap2-back-meta-debuginfo-2.4.46-lp152.14.6.1 openldap2-back-perl-2.4.46-lp152.14.6.1 openldap2-back-perl-debuginfo-2.4.46-lp152.14.6.1 openldap2-back-sock-2.4.46-lp152.14.6.1 openldap2-back-sock-debuginfo-2.4.46-lp152.14.6.1 openldap2-back-sql-2.4.46-lp152.14.6.1 openldap2-back-sql-debuginfo-2.4.46-lp152.14.6.1 openldap2-client-2.4.46-lp152.14.6.1 openldap2-client-debuginfo-2.4.46-lp152.14.6.1 openldap2-contrib-2.4.46-lp152.14.6.1 openldap2-contrib-debuginfo-2.4.46-lp152.14.6.1 openldap2-debuginfo-2.4.46-lp152.14.6.1 openldap2-debugsource-2.4.46-lp152.14.6.1 openldap2-devel-2.4.46-lp152.14.6.1 openldap2-devel-static-2.4.46-lp152.14.6.1 openldap2-ppolicy-check-password-1.2-lp152.14.6.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp152.14.6.1 - openSUSE Leap 15.2 (x86_64): libldap-2_4-2-32bit-2.4.46-lp152.14.6.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp152.14.6.1 openldap2-devel-32bit-2.4.46-lp152.14.6.1 - openSUSE Leap 15.2 (noarch): libldap-data-2.4.46-lp152.14.6.1 openldap2-doc-2.4.46-lp152.14.6.1 References: https://www.suse.com/security/cve/CVE-2020-15719.html https://bugzilla.suse.com/1174154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1455-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 19 Sep '20

19 Sep '20

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1455-1 Rating: important References: #1161883 #1174458 Cross-References: CVE-2020-14339 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. bsc#1161883, bsc#1174458 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1455=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libvirt-6.0.0-lp152.9.3.1 libvirt-admin-6.0.0-lp152.9.3.1 libvirt-admin-debuginfo-6.0.0-lp152.9.3.1 libvirt-client-6.0.0-lp152.9.3.1 libvirt-client-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-6.0.0-lp152.9.3.1 libvirt-daemon-config-network-6.0.0-lp152.9.3.1 libvirt-daemon-config-nwfilter-6.0.0-lp152.9.3.1 libvirt-daemon-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-interface-6.0.0-lp152.9.3.1 libvirt-daemon-driver-interface-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-lxc-6.0.0-lp152.9.3.1 libvirt-daemon-driver-lxc-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-network-6.0.0-lp152.9.3.1 libvirt-daemon-driver-network-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nodedev-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nodedev-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nwfilter-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nwfilter-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-qemu-6.0.0-lp152.9.3.1 libvirt-daemon-driver-qemu-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-secret-6.0.0-lp152.9.3.1 libvirt-daemon-driver-secret-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-core-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-core-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-disk-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-disk-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-gluster-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-gluster-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-iscsi-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-iscsi-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-logical-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-logical-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-mpath-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-mpath-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-scsi-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-scsi-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-hooks-6.0.0-lp152.9.3.1 libvirt-daemon-lxc-6.0.0-lp152.9.3.1 libvirt-daemon-qemu-6.0.0-lp152.9.3.1 libvirt-debugsource-6.0.0-lp152.9.3.1 libvirt-devel-6.0.0-lp152.9.3.1 libvirt-libs-6.0.0-lp152.9.3.1 libvirt-libs-debuginfo-6.0.0-lp152.9.3.1 libvirt-lock-sanlock-6.0.0-lp152.9.3.1 libvirt-lock-sanlock-debuginfo-6.0.0-lp152.9.3.1 libvirt-nss-6.0.0-lp152.9.3.1 libvirt-nss-debuginfo-6.0.0-lp152.9.3.1 wireshark-plugin-libvirt-6.0.0-lp152.9.3.1 wireshark-plugin-libvirt-debuginfo-6.0.0-lp152.9.3.1 - openSUSE Leap 15.2 (x86_64): libvirt-client-32bit-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-libxl-6.0.0-lp152.9.3.1 libvirt-daemon-driver-libxl-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-rbd-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-rbd-debuginfo-6.0.0-lp152.9.3.1 libvirt-daemon-xen-6.0.0-lp152.9.3.1 libvirt-devel-32bit-6.0.0-lp152.9.3.1 - openSUSE Leap 15.2 (noarch): libvirt-bash-completion-6.0.0-lp152.9.3.1 libvirt-doc-6.0.0-lp152.9.3.1 References: https://www.suse.com/security/cve/CVE-2020-14339.html https://bugzilla.suse.com/1161883 https://bugzilla.suse.com/1174458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1452-1: moderate: Security update for libqt4
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1452-1 Rating: moderate References: #1118595 #1118596 #1118599 #1121214 #1176315 Cross-References: CVE-2018-15518 CVE-2018-19869 CVE-2018-19873 CVE-2020-17507 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for libqt4 fixes the following issues: * Fix buffer over-read in read_xbm_body (boo#1176315, CVE-2020-17507) * Fix "double free or corruption" in QXmlStreamReader (boo#1118595, CVE-2018-15518) * Fix QBmpHandler segfault on malformed BMP file boo#1118596, CVE-2018-19873) * Fix crash when parsing malformed url reference (boo#1118599, CVE-2018-19869) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1452=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libqt4-4.8.7-lp151.9.3.1 libqt4-debuginfo-4.8.7-lp151.9.3.1 libqt4-debugsource-4.8.7-lp151.9.3.1 libqt4-devel-4.8.7-lp151.9.3.1 libqt4-devel-debuginfo-4.8.7-lp151.9.3.1 libqt4-linguist-4.8.7-lp151.9.3.1 libqt4-linguist-debuginfo-4.8.7-lp151.9.3.1 libqt4-private-headers-devel-4.8.7-lp151.9.3.1 libqt4-qt3support-4.8.7-lp151.9.3.1 libqt4-qt3support-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-4.8.7-lp151.9.3.1 libqt4-sql-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-sqlite-4.8.7-lp151.9.3.1 libqt4-sql-sqlite-debuginfo-4.8.7-lp151.9.3.1 libqt4-x11-4.8.7-lp151.9.3.1 libqt4-x11-debuginfo-4.8.7-lp151.9.3.1 - openSUSE Leap 15.1 (x86_64): libqt4-32bit-4.8.7-lp151.9.3.1 libqt4-32bit-debuginfo-4.8.7-lp151.9.3.1 libqt4-devel-32bit-4.8.7-lp151.9.3.1 libqt4-devel-32bit-debuginfo-4.8.7-lp151.9.3.1 libqt4-devel-doc-4.8.7-lp151.9.3.1 libqt4-devel-doc-debuginfo-4.8.7-lp151.9.3.1 libqt4-devel-doc-debugsource-4.8.7-lp151.9.3.1 libqt4-qt3support-32bit-4.8.7-lp151.9.3.1 libqt4-qt3support-32bit-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-32bit-4.8.7-lp151.9.3.1 libqt4-sql-32bit-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-plugins-debugsource-4.8.7-lp151.9.3.1 libqt4-sql-postgresql-4.8.7-lp151.9.3.1 libqt4-sql-postgresql-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-sqlite-32bit-4.8.7-lp151.9.3.1 libqt4-sql-sqlite-32bit-debuginfo-4.8.7-lp151.9.3.1 libqt4-sql-unixODBC-4.8.7-lp151.9.3.1 libqt4-sql-unixODBC-debuginfo-4.8.7-lp151.9.3.1 libqt4-x11-32bit-4.8.7-lp151.9.3.1 libqt4-x11-32bit-debuginfo-4.8.7-lp151.9.3.1 qt4-x11-tools-4.8.7-lp151.9.3.1 qt4-x11-tools-debuginfo-4.8.7-lp151.9.3.1 - openSUSE Leap 15.1 (noarch): libqt4-devel-doc-data-4.8.7-lp151.9.3.1 References: https://www.suse.com/security/cve/CVE-2018-15518.html https://www.suse.com/security/cve/CVE-2018-19869.html https://www.suse.com/security/cve/CVE-2018-19873.html https://www.suse.com/security/cve/CVE-2020-17507.html https://bugzilla.suse.com/1118595 https://bugzilla.suse.com/1118596 https://bugzilla.suse.com/1118599 https://bugzilla.suse.com/1121214 https://bugzilla.suse.com/1176315 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1215-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1215-1 Rating: important References: #1174497 #1175044 #1175085 Cross-References: CVE-2020-6542 CVE-2020-6543 CVE-2020-6544 CVE-2020-6545 CVE-2020-6546 CVE-2020-6547 CVE-2020-6548 CVE-2020-6549 CVE-2020-6550 CVE-2020-6551 CVE-2020-6552 CVE-2020-6553 CVE-2020-6554 CVE-2020-6555 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 (boo#1175085) * CVE-2020-6542: Use after free in ANGLE * CVE-2020-6543: Use after free in task scheduling * CVE-2020-6544: Use after free in media * CVE-2020-6545: Use after free in audio * CVE-2020-6546: Inappropriate implementation in installer * CVE-2020-6547: Incorrect security UI in media * CVE-2020-6548: Heap buffer overflow in Skia * CVE-2020-6549: Use after free in media * CVE-2020-6550: Use after free in IndexedDB * CVE-2020-6551: Use after free in WebXR * CVE-2020-6552: Use after free in Blink * CVE-2020-6553: Use after free in offline mode * CVE-2020-6554: Use after free in extensions * CVE-2020-6555: Out of bounds read in WebGL * Various fixes from internal audits, fuzzing and other initiatives - Disable wayland everywhere as it breaks headless and middle mouse copy everywhere: boo#1174497 boo#1175044 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1215=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-84.0.4147.125-bp152.2.13.1 chromium-84.0.4147.125-bp152.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-6542.html https://www.suse.com/security/cve/CVE-2020-6543.html https://www.suse.com/security/cve/CVE-2020-6544.html https://www.suse.com/security/cve/CVE-2020-6545.html https://www.suse.com/security/cve/CVE-2020-6546.html https://www.suse.com/security/cve/CVE-2020-6547.html https://www.suse.com/security/cve/CVE-2020-6548.html https://www.suse.com/security/cve/CVE-2020-6549.html https://www.suse.com/security/cve/CVE-2020-6550.html https://www.suse.com/security/cve/CVE-2020-6551.html https://www.suse.com/security/cve/CVE-2020-6552.html https://www.suse.com/security/cve/CVE-2020-6553.html https://www.suse.com/security/cve/CVE-2020-6554.html https://www.suse.com/security/cve/CVE-2020-6555.html https://bugzilla.suse.com/1174497 https://bugzilla.suse.com/1175044 https://bugzilla.suse.com/1175085 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1428-1: important: Security update for librepo
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1428-1 Rating: important References: #1175475 Cross-References: CVE-2020-14352 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librepo fixes the following issues: - Fixed path validation to prevent directory traversal attacks (bsc#1175475, CVE-2020-14352) This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1428=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): librepo-devel-1.11.2-bp152.2.3.1 librepo0-1.11.2-bp152.2.3.1 python3-librepo-1.11.2-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14352.html https://bugzilla.suse.com/1175475 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1438-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1438-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1438=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): hylafax+-7.0.3-bp152.3.4.1 hylafax+-client-7.0.3-bp152.3.4.1 libfaxutil7_0_3-7.0.3-bp152.3.4.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1100-1: important: Security update for singularity
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1100-1 Rating: important References: #1174148 #1174150 #1174152 Cross-References: CVE-2020-13845 CVE-2020-13846 CVE-2020-13847 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for singularity fixes the following issues: - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems: - CVE-2020-13845, boo#1174150 In Singularity 3.x versions below 3.6.0, issues allow the ECL to be bypassed by a malicious user. - CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all / -a option to singularity verify returns success even when some objects in a SIF container are not signed, or cannot be verified. - CVE-2020-13847, boo#1174152 In Singularity 3.x versions below 3.6.0, Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file, allowing an attacker to cause unexpected behavior. A signed container may verify successfully, even when it has been modified in ways that could be exploited to cause malicious behavior. - New features / functionalities - A new '--legacy-insecure' flag to verify allows verification of SIF signatures in the old, insecure format. - A new '-l / --logs' flag for instance list that shows the paths to instance STDERR / STDOUT log files. - The --json output of instance list now include paths to STDERR / STDOUT log files. - Singularity now supports the execution of minimal Docker/OCI containers that do not contain /bin/sh, e.g. docker://hello-world. - A new cache structure is used that is concurrency safe on a filesystem that supports atomic rename. If you downgrade to Singularity 3.5 or older after using 3.6 you will need to run singularity cache clean. - A plugin system rework adds new hook points that will allow the development of plugins that modify behavior of the runtime. An image driver concept is introduced for plugins to support new ways of handling image and overlay mounts. Plugins built for <=3.5 are not compatible with 3.6. - The --bind flag can now bind directories from a SIF or ext3 image into a container. - The --fusemount feature to mount filesystems to a container via FUSE drivers is now a supported feature (previously an experimental hidden flag). - This permits users to mount e.g. sshfs and cvmfs filesystems to the container at runtime. - A new -c/--config flag allows an alternative singularity.conf to be specified by the root user, or all users in an unprivileged installation. - A new --env flag allows container environment variables to be set via the Singularity command line. - A new --env-file flag allows container environment variables to be set from a specified file. - A new --days flag for cache clean allows removal of items older than a specified number of days. Replaces the --name flag which is not generally useful as the cache entries are stored by hash, not a friendly name. - Changed defaults / behaviours - New signature format (see security fixes above). - Fixed spacing of singularity instance list to be dynamically changing based off of input lengths instead of fixed number of spaces to account for long instance names. - Environment variables prefixed with SINGULARITYENV_ always take precedence over variables without SINGULARITYENV_ prefix. - The %post build section inherits environment variables from the base image. - %files from ... will now follow symlinks for sources that are directly specified, or directly resolved from a glob pattern. It will not follow symlinks found through directory traversal. This mirrors Docker multi-stage COPY behaviour. - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated inside container and any symlinks in the CWD path are not resolved anymore to determine the destination path inside container. - The %test build section is executed the same manner as singularity test image. --fusemount with the container: default directive will foreground the FUSE process. Use container-daemon: for previous behavior. - Deprecate -a / --all option to sign/verify as new signature behavior makes this the default. - For more information about upstream changes, please check: https://github.com/hpcng/singularity/blob/master/CHANGELOG.md - Removed --name flag for cache clean; replaced with --days. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1100=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): singularity-3.6.0-bp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-13845.html https://www.suse.com/security/cve/CVE-2020-13846.html https://www.suse.com/security/cve/CVE-2020-13847.html https://bugzilla.suse.com/1174148 https://bugzilla.suse.com/1174150 https://bugzilla.suse.com/1174152 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1181-1: Security update of chromium
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update of chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1181-1 Rating: low References: #1174582 Cross-References: CVE-2020-6532 CVE-2020-6537 CVE-2020-6538 CVE-2020-6539 CVE-2020-6540 CVE-2020-6541 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Chromium was updated to 84.0.4147.105 (boo#1174582): * CVE-2020-6537: Type Confusion in V8 * CVE-2020-6538: Inappropriate implementation in WebView * CVE-2020-6532: Use after free in SCTP * CVE-2020-6539: Use after free in CSS * CVE-2020-6540: Heap buffer overflow in Skia * CVE-2020-6541: Use after free in WebUSB This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1181=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-84.0.4147.105-bp152.2.10.1 chromium-84.0.4147.105-bp152.2.10.1 References: https://www.suse.com/security/cve/CVE-2020-6532.html https://www.suse.com/security/cve/CVE-2020-6537.html https://www.suse.com/security/cve/CVE-2020-6538.html https://www.suse.com/security/cve/CVE-2020-6539.html https://www.suse.com/security/cve/CVE-2020-6540.html https://www.suse.com/security/cve/CVE-2020-6541.html https://bugzilla.suse.com/1174582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1192-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1192-1 Rating: moderate References: #1174457 Cross-References: CVE-2020-15917 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: - Update to 3.17.6: * It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues. * A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL). * The progress window when importing an mbox file is now more responsive. * A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled. * Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3. - CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1192=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): claws-mail-3.17.6-bp152.3.3.1 claws-mail-devel-3.17.6-bp152.3.3.1 - openSUSE Backports SLE-15-SP2 (noarch): claws-mail-lang-3.17.6-bp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15917.html https://bugzilla.suse.com/1174457 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2020:1322-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Sep '20

18 Sep '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1322-1 Rating: important References: #1175757 Cross-References: CVE-2020-6558 CVE-2020-6559 CVE-2020-6560 CVE-2020-6561 CVE-2020-6562 CVE-2020-6563 CVE-2020-6564 CVE-2020-6565 CVE-2020-6566 CVE-2020-6567 CVE-2020-6568 CVE-2020-6569 CVE-2020-6570 CVE-2020-6571 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to version 85.0.4183.83 (boo#1175757) fixing: - CVE-2020-6558: Insufficient policy enforcement in iOS - CVE-2020-6559: Use after free in presentation API - CVE-2020-6560: Insufficient policy enforcement in autofill - CVE-2020-6561: Inappropriate implementation in Content Security Policy - CVE-2020-6562: Insufficient policy enforcement in Blink - CVE-2020-6563: Insufficient policy enforcement in intent handling. - CVE-2020-6564: Incorrect security UI in permissions - CVE-2020-6565: Incorrect security UI in Omnibox. - CVE-2020-6566: Insufficient policy enforcement in media. - CVE-2020-6567: Insufficient validation of untrusted input in command line handling. - CVE-2020-6568: Insufficient policy enforcement in intent handling. - CVE-2020-6569: Integer overflow in WebUSB. - CVE-2020-6570: Side-channel information leakage in WebRTC. - CVE-2020-6571: Incorrect security UI in Omnibox. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1322=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): chromedriver-85.0.4183.69-bp152.2.17.1 chromium-85.0.4183.69-bp152.2.17.1 References: https://www.suse.com/security/cve/CVE-2020-6558.html https://www.suse.com/security/cve/CVE-2020-6559.html https://www.suse.com/security/cve/CVE-2020-6560.html https://www.suse.com/security/cve/CVE-2020-6561.html https://www.suse.com/security/cve/CVE-2020-6562.html https://www.suse.com/security/cve/CVE-2020-6563.html https://www.suse.com/security/cve/CVE-2020-6564.html https://www.suse.com/security/cve/CVE-2020-6565.html https://www.suse.com/security/cve/CVE-2020-6566.html https://www.suse.com/security/cve/CVE-2020-6567.html https://www.suse.com/security/cve/CVE-2020-6568.html https://www.suse.com/security/cve/CVE-2020-6569.html https://www.suse.com/security/cve/CVE-2020-6570.html https://www.suse.com/security/cve/CVE-2020-6571.html https://bugzilla.suse.com/1175757 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0