January 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0102-1: important: Security update for libssh
by opensuse-security＠opensuse.org 25 Jan '20

25 Jan '20

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0102-1 Rating: important References: #1158095 Cross-References: CVE-2019-14889 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2019-14889: Fixed an unwanted command execution in scp caused by unsanitized location (bsc#1158095). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-102=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libssh-debugsource-0.8.7-lp151.2.9.1 libssh-devel-0.8.7-lp151.2.9.1 libssh4-0.8.7-lp151.2.9.1 libssh4-debuginfo-0.8.7-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): libssh4-32bit-0.8.7-lp151.2.9.1 libssh4-32bit-debuginfo-0.8.7-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-14889.html https://bugzilla.suse.com/1158095

1 0

openSUSE-RU-2020:0100-1: moderate: Recommended update for dnf-plugins-core
by maintenance＠opensuse.org 25 Jan '20

25 Jan '20

openSUSE Recommended Update: Recommended update for dnf-plugins-core ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0100-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for dnf-plugins-core fixes the following issues: - Deconflict with zypper-needs-restarting on SLE to unblock PackageHub updates Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-100=1 Package List: - openSUSE Leap 15.1 (noarch): dnf-plugins-core-4.0.7-lp151.3.6.1 dnf-plugins-core-lang-4.0.7-lp151.3.6.1 dnf-utils-4.0.7-lp151.3.6.1 python3-dnf-plugin-leaves-4.0.7-lp151.3.6.1 python3-dnf-plugin-local-4.0.7-lp151.3.6.1 python3-dnf-plugin-show-leaves-4.0.7-lp151.3.6.1 python3-dnf-plugin-versionlock-4.0.7-lp151.3.6.1 python3-dnf-plugins-core-4.0.7-lp151.3.6.1 References:

1 0

openSUSE-RU-2020:0099-1: moderate: Recommended update for kaccounts-providers
by maintenance＠opensuse.org 25 Jan '20

25 Jan '20

openSUSE Recommended Update: Recommended update for kaccounts-providers ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0099-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kaccounts-providers fixes the following issues: - Fixed Google account usage. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-99=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kaccounts-providers-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): kaccounts-providers-lang-18.12.3-bp151.3.3.1 References:

1 0

openSUSE-RU-2020:0098-1: moderate: Recommended update for ucode-intel
by maintenance＠opensuse.org 24 Jan '20

24 Jan '20

openSUSE Recommended Update: Recommended update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0098-1 Rating: moderate References: #1160478 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ucode-intel fixes the following issues: Reverted the Skylake Server Intel Microcode below to 0x02000064 due to occasional faults during warm-boot (bsc#1160478) - SKX-SP H0/M0/U0 6-55-4/b7 02000064->02000065 Xeon Scalable This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-98=1 Package List: - openSUSE Leap 15.1 (x86_64): ucode-intel-20191115-lp151.2.18.1 References: https://bugzilla.suse.com/1160478

1 0

openSUSE-RU-2020:0097-1: moderate: Recommended update for python-acme, python-certbot, python-certbot-apache, python-certbot-dns-cloudflare, python-certbot-dns-cloudxns, python-certbot-dns-digitalocean, python-certbot-dns-dnsimple, python-certbot-dns-dnsmadeeasy, python-certbot-dns-google, python-certbot-dns-luadns, python-certbot-dns-nsone, python-certbot-dns-rfc2136, python-certbot-dns-route53, python-certbot-nginx
by maintenance＠opensuse.org 24 Jan '20

24 Jan '20

openSUSE Recommended Update: Recommended update for python-acme, python-certbot, python-certbot-apache, python-certbot-dns-cloudflare, python-certbot-dns-cloudxns, python-certbot-dns-digitalocean, python-certbot-dns-dnsimple, python-certbot-dns-dnsmadeeasy, python-certbot-dns-google, python-certbot-dns-luadns, python-certbot-dns-nsone, python-certbot-dns-rfc2136, python-certbot-dns-route53, python-certbot-nginx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0097-1 Rating: moderate References: #1160066 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-acme, python-certbot, python-certbot-apache, python-certbot-dns-cloudflare, python-certbot-dns-cloudxns, python-certbot-dns-digitalocean, python-certbot-dns-dnsimple, python-certbot-dns-dnsmadeeasy, python-certbot-dns-google, python-certbot-dns-luadns, python-certbot-dns-nsone, python-certbot-dns-rfc2136, python-certbot-dns-route53, python-certbot-nginx fixes the following issues: Changes in python-acme: update to version 1.0.0 (boo#1160066) * Deprecated attributes related to the TLS-SNI-01 challenge in acme.challenges and acme.standalone have been removed. update to version 0.40.1 * acme.standalone.BaseRequestHandlerWithLogging and acme.standalone.simple_tls_sni_01_server have been deprecated and will be removed in a future release of the library. update to version 0.37.2 * acme: Authz deactivation added to acme module. Changes in python-certbot: update to version 1.0.0 (boo#1160066) * certbot-auto has deprecated support for systems using OpenSSL 1.0.1 that are not running on x86-64. * Certbot's config_changes subcommand has been removed * certbot.plugins.common.TLSSNI01 has been removed. * The functions certbot.client.view_config_changes, certbot.main.config_changes, certbot.plugins.common.Installer.view_config_changes, certbot.reverter.Reverter.view_config_changes, and certbot.util.get_systemd_os_info have been removed * Certbot's register --update-registration subcommand has been removed * When possible, default to automatically configuring the webserver so all requests redirect to secure HTTPS access. This is mostly relevant when running Certbot in non-interactive mode. Previously, the default was to not redirect all requests. update to version 0.40.1 * --server may now be combined with --dry-run. * --dry-run now requests fresh authorizations every time, fixing the issue where it was prone to falsely reporting success. * The OS detection logic again uses distro library for Linux OSes * certbot.plugins.common.TLSSNI01 has been deprecated and will be removed in a future release. * CLI flags --tls-sni-01-port and --tls-sni-01-address have been removed. * The values tls-sni and tls-sni-01 for the --preferred-challenges flag are no longer accepted. * Removed the flags: --agree-dev-preview, --dialog, and --apache-init-script update to version 0.39.0 * Support for Python 3.8 was added to Certbot and all of its components. * Don't send OCSP requests for expired certificates update to version 0.38.0 * If Certbot fails to rollback your server configuration, the error message links to the Let's Encrypt forum. * Replace platform.linux_distribution with distro.linux_distribution as a step towards Python 3.8 support in Certbot. update to version 0.37.2 * nginx and apache fixes Changes in python-certbot-apache: update to version 1.0.0 (boo#1160066) * The docs extras for the certbot-apache and certbot-nginx packages have been removed. update to version 0.40.1 * Sync with main certbot package. update to version 0.39.0 * Support for Python 3.8 was added to Certbot and all of its components. update to version 0.38.0 * Fixed OS detection in the Apache plugin on Scientific Linux. update to version 0.37.2 * Turn off session tickets for apache plugin by default * Stop disabling TLS session tickets in Apache as it caused TLS failures on some systems. Changes in python-certbot-dns-cloudflare: update to version 0.39.0 * Support for Python 3.8 was added to Certbot and all of its components. Changes in python-certbot-dns-rfc2136: update to version 1.0.0 * certbot-dns-rfc2136 now uses TCP to query SOA records. Changes in python-certbot-nginx: update to version 1.0.0 (boo#1160066) * Disable session tickets for Nginx users when appropriate. update to version 0.37.2 * Follow updated Mozilla recommendations for Nginx ssl_protocols, ssl_ciphers, and ssl_prefer_server_ciphers * Stop disabling TLS session tickets in Nginx as it caused TLS failures on some systems. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-97=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-acme-1.0.0-bp151.3.6.3 python2-certbot-1.0.0-bp151.3.6.3 python2-certbot-apache-1.0.0-bp151.3.6.3 python2-certbot-dns-cloudflare-1.0.0-bp151.3.6.3 python2-certbot-dns-cloudxns-1.0.0-bp151.2.6.4 python2-certbot-dns-digitalocean-1.0.0-bp151.2.6.3 python2-certbot-dns-dnsimple-1.0.0-bp151.2.6.4 python2-certbot-dns-dnsmadeeasy-1.0.0-bp151.2.6.4 python2-certbot-dns-google-1.0.0-bp151.2.6.2 python2-certbot-dns-luadns-1.0.0-bp151.2.6.4 python2-certbot-dns-nsone-1.0.0-bp151.2.6.4 python2-certbot-dns-rfc2136-1.0.0-bp151.2.6.3 python2-certbot-dns-route53-1.0.0-bp151.2.6.3 python2-certbot-nginx-1.0.0-bp151.2.6.3 python3-acme-1.0.0-bp151.3.6.3 python3-certbot-1.0.0-bp151.3.6.3 python3-certbot-apache-1.0.0-bp151.3.6.3 python3-certbot-dns-cloudflare-1.0.0-bp151.3.6.3 python3-certbot-dns-cloudxns-1.0.0-bp151.2.6.4 python3-certbot-dns-digitalocean-1.0.0-bp151.2.6.3 python3-certbot-dns-dnsimple-1.0.0-bp151.2.6.4 python3-certbot-dns-dnsmadeeasy-1.0.0-bp151.2.6.4 python3-certbot-dns-google-1.0.0-bp151.2.6.2 python3-certbot-dns-luadns-1.0.0-bp151.2.6.4 python3-certbot-dns-nsone-1.0.0-bp151.2.6.4 python3-certbot-dns-rfc2136-1.0.0-bp151.2.6.3 python3-certbot-dns-route53-1.0.0-bp151.2.6.3 python3-certbot-nginx-1.0.0-bp151.2.6.3 References: https://bugzilla.suse.com/1160066

1 0

openSUSE-SU-2020:0096-1: moderate: Security update for libredwg
by opensuse-security＠opensuse.org 23 Jan '20

23 Jan '20

openSUSE Security Update: Security update for libredwg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0096-1 Rating: moderate References: #1160520 #1160522 #1160523 #1160524 #1160525 #1160526 #1160527 Cross-References: CVE-2020-6609 CVE-2020-6610 CVE-2020-6611 CVE-2020-6612 CVE-2020-6613 CVE-2020-6614 CVE-2020-6615 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libredwg fixes the following issues: libredwg was updated to release 0.10: API breaking changes: * Added a new int *isnewp argument to all dynapi utf8text getters, if the returned string is freshly malloced or not. * removed the UNKNOWN supertype, there are only UNKNOWN_OBJ and UNKNOWN_ENT left, with common_entity_data. * renamed BLOCK_HEADER.preview_data to preview, preview_data_size to preview_size. * renamed SHAPE.shape_no to style_id. * renamed CLASS.wasazombie to is_zombie. Bugfixes: * Harmonized INDXFB with INDXF, removed extra src/in_dxfb.c. * Fixed encoding of added r2000 AUXHEADER address. * Fixed EED encoding from dwgrewrite. * Add several checks against [CVE-2020-6609, boo#1160520], [CVE-2020-6610, boo#1160522], [CVE-2020-6611, boo#1160523], [CVE-2020-6612, boo#1160524], [CVE-2020-6613, boo#1160525], [CVE-2020-6614, boo#1160526], [CVE-2020-6615, boo#1160527] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-96=1 Package List: - openSUSE Leap 15.1 (x86_64): libredwg-debuginfo-0.10-lp151.2.6.1 libredwg-debugsource-0.10-lp151.2.6.1 libredwg-devel-0.10-lp151.2.6.1 libredwg-tools-0.10-lp151.2.6.1 libredwg-tools-debuginfo-0.10-lp151.2.6.1 libredwg0-0.10-lp151.2.6.1 libredwg0-debuginfo-0.10-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-6609.html https://www.suse.com/security/cve/CVE-2020-6610.html https://www.suse.com/security/cve/CVE-2020-6611.html https://www.suse.com/security/cve/CVE-2020-6612.html https://www.suse.com/security/cve/CVE-2020-6613.html https://www.suse.com/security/cve/CVE-2020-6614.html https://www.suse.com/security/cve/CVE-2020-6615.html https://bugzilla.suse.com/1160520 https://bugzilla.suse.com/1160522 https://bugzilla.suse.com/1160523 https://bugzilla.suse.com/1160524 https://bugzilla.suse.com/1160525 https://bugzilla.suse.com/1160526 https://bugzilla.suse.com/1160527

1 0

openSUSE-SU-2020:0095-1: moderate: Security update for libredwg
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for libredwg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0095-1 Rating: moderate References: #1129868 #1129869 #1129870 #1129873 #1129874 #1129875 #1129876 #1129878 #1129879 #1129881 #1154080 #1159824 #1159825 #1159826 #1159827 #1159828 #1159831 #1159832 Cross-References: CVE-2019-20009 CVE-2019-20010 CVE-2019-20011 CVE-2019-20012 CVE-2019-20013 CVE-2019-20014 CVE-2019-20015 CVE-2019-9770 CVE-2019-9771 CVE-2019-9772 CVE-2019-9773 CVE-2019-9774 CVE-2019-9775 CVE-2019-9776 CVE-2019-9777 CVE-2019-9778 CVE-2019-9779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has one errata is now available. Description: This update for libredwg fixes the following issues: libredwg was updated to release 0.9.3: * Added the -x,--extnames option to dwglayers for r13-r14 DWGs. * Fixed some leaks: SORTENTSTABLE, PROXY_ENTITY.ownerhandle for r13. * Add DICTIONARY.itemhandles[] for r13 and r14. * Fixed some dwglayers null pointer derefs, and flush its output for each layer. * Added several overflow checks from fuzzing [CVE-2019-20010, boo#1159825], [CVE-2019-20011, boo#1159826], [CVE-2019-20012, boo#1159827], [CVE-2019-20013, boo#1159828], [CVE-2019-20014, boo#1159831], [CVE-2019-20015, boo#1159832] * Disallow illegal SPLINE scenarios [CVE-2019-20009, boo#1159824] Update to release 0.9.1: * Fixed more null pointer dereferences, overflows, hangs and memory leaks for fuzzed (i.e. illegal) DWGs. Update to release 0.9 [boo#1154080]: * Added the DXF importer, using the new dynapi and the r2000 encoder. Only for r2000 DXFs. * Added utf8text conversion functions to the dynapi. * Added 3DSOLID encoder. * Added APIs to find handles for names, searching in tables and dicts. * API breaking changes - see NEWS file in package. * Fixed null pointer dereferences, and memory leaks (except DXF importer) [boo#1129868, CVE-2019-9779] [boo#1129869, CVE-2019-9778] [boo#1129870, CVE-2019-9777] [boo#1129873, CVE-2019-9776] [boo#1129874, CVE-2019-9773] [boo#1129875, CVE-2019-9772] [boo#1129876, CVE-2019-9771] [boo#1129878, CVE-2019-9775] [boo#1129879, CVE-2019-9774] [boo#1129881, CVE-2019-9770] Update to 0.8: * add a new dynamic API, read and write all header and object fields by name * API breaking changes * Fix many errors in DXF output * Fix JSON output * Many more bug fixes to handle specific object types This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-95=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libredwg-devel-0.9.3-bp151.2.3.1 libredwg-tools-0.9.3-bp151.2.3.1 libredwg0-0.9.3-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-20009.html https://www.suse.com/security/cve/CVE-2019-20010.html https://www.suse.com/security/cve/CVE-2019-20011.html https://www.suse.com/security/cve/CVE-2019-20012.html https://www.suse.com/security/cve/CVE-2019-20013.html https://www.suse.com/security/cve/CVE-2019-20014.html https://www.suse.com/security/cve/CVE-2019-20015.html https://www.suse.com/security/cve/CVE-2019-9770.html https://www.suse.com/security/cve/CVE-2019-9771.html https://www.suse.com/security/cve/CVE-2019-9772.html https://www.suse.com/security/cve/CVE-2019-9773.html https://www.suse.com/security/cve/CVE-2019-9774.html https://www.suse.com/security/cve/CVE-2019-9775.html https://www.suse.com/security/cve/CVE-2019-9776.html https://www.suse.com/security/cve/CVE-2019-9777.html https://www.suse.com/security/cve/CVE-2019-9778.html https://www.suse.com/security/cve/CVE-2019-9779.html https://bugzilla.suse.com/1129868 https://bugzilla.suse.com/1129869 https://bugzilla.suse.com/1129870 https://bugzilla.suse.com/1129873 https://bugzilla.suse.com/1129874 https://bugzilla.suse.com/1129875 https://bugzilla.suse.com/1129876 https://bugzilla.suse.com/1129878 https://bugzilla.suse.com/1129879 https://bugzilla.suse.com/1129881 https://bugzilla.suse.com/1154080 https://bugzilla.suse.com/1159824 https://bugzilla.suse.com/1159825 https://bugzilla.suse.com/1159826 https://bugzilla.suse.com/1159827 https://bugzilla.suse.com/1159828 https://bugzilla.suse.com/1159831 https://bugzilla.suse.com/1159832

1 0

openSUSE-SU-2020:0093-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0093-1 Rating: important References: #1161252 Cross-References: CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 79.0.3945.130 (boo#1161252): - CVE-2020-6378, CVE-2020-6379: Fixed a use-after-free in speech recognizer - CVE-2020-6380: Fixed an extension message verification error - Various fixes from audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-93=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-93=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-93=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-79.0.3945.130-lp151.2.60.4 chromedriver-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-79.0.3945.130-lp151.2.60.4 chromium-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-debugsource-79.0.3945.130-lp151.2.60.4 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.130-bp151.3.56.3 chromedriver-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-79.0.3945.130-bp151.3.56.3 chromium-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-debugsource-79.0.3945.130-bp151.3.56.3 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): chromedriver-79.0.3945.130-28.1 chromium-79.0.3945.130-28.1 References: https://www.suse.com/security/cve/CVE-2020-6378.html https://www.suse.com/security/cve/CVE-2020-6379.html https://www.suse.com/security/cve/CVE-2020-6380.html https://bugzilla.suse.com/1161252

1 0

openSUSE-SU-2020:0094-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0094-1 Rating: important References: #1160305 #1160498 Cross-References: CVE-2019-17015 CVE-2019-17016 CVE-2019-17017 CVE-2019-17021 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.4.1 fixes the following issues: Security issues fixed: - CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement - CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017: Type Confusion in XPCVariant.cpp - CVE-2019-17022: CSS sanitization does not escape HTML tags - CVE-2019-17024: multiple Memory safety bugs fixed Non-security issues fixed: - Various improvements when setting up an account for a Microsoft Exchange server. For example better detection for Office 365 accounts. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-94=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.4.1-lp151.2.22.2 MozillaThunderbird-debuginfo-68.4.1-lp151.2.22.2 MozillaThunderbird-debugsource-68.4.1-lp151.2.22.2 MozillaThunderbird-translations-common-68.4.1-lp151.2.22.2 MozillaThunderbird-translations-other-68.4.1-lp151.2.22.2 References: https://www.suse.com/security/cve/CVE-2019-17015.html https://www.suse.com/security/cve/CVE-2019-17016.html https://www.suse.com/security/cve/CVE-2019-17017.html https://www.suse.com/security/cve/CVE-2019-17021.html https://www.suse.com/security/cve/CVE-2019-17022.html https://www.suse.com/security/cve/CVE-2019-17024.html https://www.suse.com/security/cve/CVE-2019-17026.html https://bugzilla.suse.com/1160305 https://bugzilla.suse.com/1160498

1 0

openSUSE-SU-2020:0093-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Jan '20

22 Jan '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0093-1 Rating: important References: #1161252 Cross-References: CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 79.0.3945.130 (boo#1161252): - CVE-2020-6378, CVE-2020-6379: Fixed a use-after-free in speech recognizer - CVE-2020-6380: Fixed an extension message verification error - Various fixes from audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-93=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-93=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-79.0.3945.130-lp151.2.60.4 chromedriver-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-79.0.3945.130-lp151.2.60.4 chromium-debuginfo-79.0.3945.130-lp151.2.60.4 chromium-debugsource-79.0.3945.130-lp151.2.60.4 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.130-bp151.3.56.3 chromedriver-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-79.0.3945.130-bp151.3.56.3 chromium-debuginfo-79.0.3945.130-bp151.3.56.3 chromium-debugsource-79.0.3945.130-bp151.3.56.3 References: https://www.suse.com/security/cve/CVE-2020-6378.html https://www.suse.com/security/cve/CVE-2020-6379.html https://www.suse.com/security/cve/CVE-2020-6380.html https://bugzilla.suse.com/1161252

1 0