January 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0140-1: important: Security update for sarg
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for sarg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0140-1 Rating: important References: #1156643 Cross-References: CVE-2019-18932 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sarg fixes the following issues: - CVE-2019-18932: Fixed insecure usage of /tmp/sarg which potentially allowed privilege escalation or denial of service (boo#1156643). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-140=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sarg-2.3.10-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-18932.html https://bugzilla.suse.com/1156643

1 0

openSUSE-SU-2020:0139-1: moderate: Security update for rubygem-excon
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for rubygem-excon ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0139-1 Rating: moderate References: #1159342 Cross-References: CVE-2019-16779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-excon fixes the following issues: CVE-2019-16779 (boo#1159342): Fix a race condition around persistent connections, where a connection, which was interrupted, would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-139=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-excon-0.59.0-bp151.4.3.1 ruby2.5-rubygem-excon-doc-0.59.0-bp151.4.3.1 ruby2.5-rubygem-excon-testsuite-0.59.0-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16779.html https://bugzilla.suse.com/1159342

1 0

openSUSE-RU-2020:0144-1: moderate: Recommended update for zstd
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for zstd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0144-1 Rating: moderate References: #1161432 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zstd fixes the following issues: Update to version 1.4.4 (boo#1161432): * perf: Improved decompression speed, by > 10% * perf: Better compression speed when re-using a context * perf: Fix compression ratio when compressing large files with small dictionary * perf: zstd reference encoder can generate RLE blocks * perf: minor generic speed optimization * api: new ability to extract sequences from the parser for analysis * api: fixed decoding of magic-less frames * api: fixed ZSTD_initCStream_advanced() performance with fast modes * cli: Named pipes support * cli: short tar's extension support * cli: command --output-dir-flat=DIE , generates target files into requested directory * cli: commands --stream-size=# and --size-hint=# * cli: command --exclude-compressed * cli: faster -t test mode * cli: improved some error messages * cli: fix rare deadlock condition within dictionary builder * misc: Improved documentation : ZSTD_CLEVEL, DYNAMIC_BMI2, ZSTD_CDict, function deprecation, zstd format * misc: fixed educational decoder : accept larger literals section, and removed UNALIGNED() macro Update to version 1.4.3 * bug: Fix Dictionary Compression Ratio Regression (#1709) * bug: Fix Buffer Overflow in v0.3 Decompression (#1722) * build: Add support for IAR C/C++ Compiler for Arm (#1705) * misc: Add NULL pointer check in util.c (#1706) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-144=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libzstd-devel-1.4.4-bp151.4.6.1 libzstd-devel-static-1.4.4-bp151.4.6.1 libzstd1-1.4.4-bp151.4.6.1 zstd-1.4.4-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libzstd1-64bit-1.4.4-bp151.4.6.1 References: https://bugzilla.suse.com/1161432

1 0

openSUSE-RU-2020:0141-1: moderate: Recommended update for scap-workbench
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for scap-workbench ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0141-1 Rating: moderate References: #1084706 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for scap-workbench fixes the following issues: * security hardening for pk-exec usage (boo#1084706). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-141=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): scap-workbench-1.1.5-bp151.4.3.1 scap-workbench-doc-1.1.5-bp151.4.3.1 References: https://bugzilla.suse.com/1084706

1 0

openSUSE-RU-2020:0133-1: moderate: Recommended update for gitlint
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for gitlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0133-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gitlint fixes the following issues: Update to v0.11.0: * make it work with openSUSE This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-133=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-gitlint-0.11.0-bp151.4.3.1 python3-gitlint-0.11.0-bp151.4.3.1 References:

1 0

openSUSE-RU-2020:0128-1: moderate: Recommended update for DisplayCAL
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for DisplayCAL ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0128-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for DisplayCAL fixes the following issues: - Added dependency on python-xml. Without it, DisplayCAL won't start. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-128=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): DisplayCAL-3.5.3.0-bp151.4.3.1 References:

1 0

openSUSE-SU-2020:0142-1: moderate: Security update for shadowsocks-libev
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0142-1 Rating: moderate References: #1158251 #1158365 Cross-References: CVE-2019-5163 CVE-2019-5164 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for shadowsocks-libev fixes the following issues: - Update version to 3.3.3 * Refine the handling of suspicious connections. * Fix exploitable denial-of-service vulnerability exists in the UDPRelay functionality (boo#1158251, CVE-2019-5163) * Fix code execution vulnerability in the ss-manager binary (boo#1158365, CVE-2019-5164) * Refine the handling of fragment request. * Fix a high CPU bug introduced in 3.3.0. (#2449) * Enlarge the socket buffer size to 16KB. * Fix the empty list bug in ss-manager. * Fix the IPv6 address parser. * Fix a bug of port parser. * Fix a crash with MinGW. * Refine SIP003 plugin interface. * Remove connection timeout from all clients. * Fix the alignment bug again. * Fix a bug on 32-bit arch. * Add TCP fast open support to ss-tunnel by @PantherJohn. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-142=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libshadowsocks-libev2-3.3.3-bp151.5.3.1 shadowsocks-libev-3.3.3-bp151.5.3.1 shadowsocks-libev-devel-3.3.3-bp151.5.3.1 - openSUSE Backports SLE-15-SP1 (noarch): shadowsocks-libev-doc-3.3.3-bp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-5163.html https://www.suse.com/security/cve/CVE-2019-5164.html https://bugzilla.suse.com/1158251 https://bugzilla.suse.com/1158365

1 0

openSUSE-RU-2020:0135-1: moderate: Recommended update for kmozillahelper
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for kmozillahelper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0135-1 Rating: moderate References: #1037806 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmozillahelper fixes the following issues: - Update to 5.0.5: * Recognize if started from Thunderbird * Cache helper protocols (boo#1037806) * Use new style connect * Don't use deprecated KRun:runUrl without flags, use with flags * Improve HiDPI support - Add %license This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-135=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kmozillahelper-5.0.5-bp151.4.3.1 References: https://bugzilla.suse.com/1037806

1 0

openSUSE-SU-2020:0147-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0147-1 Rating: important References: #1160968 Cross-References: CVE-2020-2583 CVE-2020-2590 CVE-2020-2593 CVE-2020-2601 CVE-2020-2604 CVE-2020-2654 CVE-2020-2659 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968): - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2020-2590: Improve Kerberos interop capabilities - CVE-2020-2593: Normalize normalization for all - CVE-2020-2601: Better Ticket Granting Services - CVE-2020-2604: Better serial filter handling - CVE-2020-2659: Enhance datagram socket support - CVE-2020-2654: Improve Object Identifier Processing This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-147=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-accessibility-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-debugsource-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-demo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-devel-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-headless-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.242-lp151.2.9.1 java-1_8_0-openjdk-src-1.8.0.242-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.242-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-2583.html https://www.suse.com/security/cve/CVE-2020-2590.html https://www.suse.com/security/cve/CVE-2020-2593.html https://www.suse.com/security/cve/CVE-2020-2601.html https://www.suse.com/security/cve/CVE-2020-2604.html https://www.suse.com/security/cve/CVE-2020-2654.html https://www.suse.com/security/cve/CVE-2020-2659.html https://bugzilla.suse.com/1160968

1 0

openSUSE-RU-2020:0126-1: moderate: Recommended update for procps
by maintenance＠opensuse.org 29 Jan '20

29 Jan '20

openSUSE Recommended Update: Recommended update for procps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0126-1 Rating: moderate References: #1158830 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for procps fixes the following issues: - Fix for "ps -C" allowing to accept any arguments longer than 15 characters anymore. (bsc#1158830) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-126=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libprocps7-3.3.15-lp151.6.6.1 libprocps7-debuginfo-3.3.15-lp151.6.6.1 procps-3.3.15-lp151.6.6.1 procps-debuginfo-3.3.15-lp151.6.6.1 procps-debugsource-3.3.15-lp151.6.6.1 procps-devel-3.3.15-lp151.6.6.1 References: https://bugzilla.suse.com/1158830

1 0