October 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1685-1: moderate: Recommended update for ndctl
by maintenance＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Recommended Update: Recommended update for ndctl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1685-1 Rating: moderate References: #1175851 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ndctl fixes the following issues: - Suppress 'ENXIO' when processing all namespaces. (jsc#SLE-13321, bsc#1175851) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1685=1 Package List: - openSUSE Leap 15.1 (x86_64): libndctl-devel-64.1-lp151.2.22.1 libndctl6-64.1-lp151.2.22.1 libndctl6-debuginfo-64.1-lp151.2.22.1 ndctl-64.1-lp151.2.22.1 ndctl-debuginfo-64.1-lp151.2.22.1 ndctl-debugsource-64.1-lp151.2.22.1 References: https://bugzilla.suse.com/1175851

1 0

openSUSE-RU-2020:1684-1: moderate: Recommended update for sushi
by maintenance＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Recommended Update: Recommended update for sushi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1684-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for sushi fixes the following issues: sushi was updated to version 3.34.0: + Add support for moving Nautilus selection with arrow keys. + Add support for parenting the window on Wayland. + Use builder-dark style for text/source viewer. + Add localization for appdata file. Update to version 3.33.90: + Add a command line launcher. + Fix viewer mimetype matching. + Load viewers from home directory. + Updated translations. Update to version 3.33.4: + Add a native LibreofficeKit renderer. + Fix translation infrastructure regression. + Fix loading album cover art from Amazon. + Fix several glitches on HiDpi and fractional scaling displays. + Respect placement of close button preference. + Fix audio metadata tags retrieval. + Only load a single GstTagList copy. + Fix displaying audio tag content with markup characters. + Add an appdata file. + Properly letterbox album cover art. + Add a way to report loading errors in the main view. + Scale window size with display resolution. Update to version 3.33.3: + Rewrite to use GTK directly, drop Clutter dependency. + Use GtkSourceView 4. Update to version 3.32.1: + Specify GtkSourceView 3.0 import version. Update to version 3.32.0: + Update DOAP file for GitLab move. + Explicitly hide minimize and maximize. Update to version 3.31.2: + Port to meson build system. + Replace some deprecated API. Update to version 3.30.0: + Fix miscellaneous warnings. + Rename service file to match owned bus name. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1684=1 Package List: - openSUSE Leap 15.2 (noarch): sushi-lang-3.34.0-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): sushi-3.34.0-lp152.4.3.1 sushi-debuginfo-3.34.0-lp152.4.3.1 sushi-debugsource-3.34.0-lp152.4.3.1 References:

1 0

openSUSE-SU-2020:1682-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1682-1 Rating: important References: #1065729 #1140683 #1172538 #1174748 #1175520 #1176381 #1176400 #1176946 #1177340 #1177511 #1177685 #1177724 #1177725 Cross-References: CVE-2020-12351 CVE-2020-12352 CVE-2020-25212 CVE-2020-25645 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 9 fixes is now available. Description: The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-12351: A type confusion while processing AMP packets could be used by physical close attackers to crash the kernel or potentially execute code was fixed (bsc#1177724). - CVE-2020-12352: A stack information leak when handling certain AMP packets could be used by physical close attackers to leak information from the kernel was fixed (bsc#1177725). - CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381). - CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511). The following non-security bugs were fixed: - 59c7c3caaaf8 ("nvme: fix possible hang when ns scanning fails during error recovery") - NFS: On fatal writeback errors, we need to call nfs_inode_remove_request() (bsc#1177340). - NFS: Revalidate the file mapping on all fatal writeback errors (bsc#1177340). - drm/sun4i: mixer: Extend regmap max_register (git-fixes). - ea43d9709f72 ("nvme: fix identify error status silent ignore") - i2c: meson: fix clock setting overwrite (git-fixes). - iommu/vt-d: Correctly calculate agaw in domain_init() (bsc#1176400). - mac80211: do not allow bigger VHT MPDUs than the hardware supports (git-fixes). - macsec: avoid use-after-free in macsec_handle_frame() (git-fixes). - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() (bsc#1177685). - mmc: core: do not set limits.discard_granularity as 0 (git-fixes). - nvme-multipath: do not reset on unknown status (bsc#1174748). - nvme-rdma: Avoid double freeing of async event data (bsc#1174748). - nvme: Fix ctrl use-after-free during sysfs deletion (bsc#1174748). - nvme: Namepace identification descriptor list is optional (bsc#1174748). - nvme: add a Identify Namespace Identification Descriptor list quirk (bsc#1174748). - nvme: fix deadlock caused by ANA update wrong locking (bsc#1174748). - nvme: fix possible io failures when removing multipathed ns (bsc#1174748). - nvme: make nvme_identify_ns propagate errors back (bsc#1174748). - nvme: make nvme_report_ns_ids propagate error back (bsc#1174748). - nvme: pass status to nvme_error_status (bsc#1174748). - nvme: return error from nvme_alloc_ns() (bsc#1174748). - powerpc/dma: Fix dma_map_ops::get_required_mask (bsc#1065729). - scsi: hisi_sas: Add debugfs ITCT file and add file operations (bsc#1140683). - scsi: hisi_sas: Add manual trigger for debugfs dump (bsc#1140683). - scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32() (bsc#1140683). - scsi: hisi_sas: Change return variable type in phy_up_v3_hw() (bsc#1140683). - scsi: hisi_sas: Correct memory allocation size for DQ debugfs (bsc#1140683). - scsi: hisi_sas: Do some more tidy-up (bsc#1140683). - scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO (bsc#1140683). - scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs code (bsc#1140683). Refresh: - scsi: hisi_sas: No need to check return value of debugfs_create functions (bsc#1140683). Update: - scsi: hisi_sas: Some misc tidy-up (bsc#1140683). - scsi: qla2xxx: Add IOCB resource tracking (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Add SLER and PI control support (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Add rport fields in debugfs (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Correct the check for sscanf() return value (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix I/O errors during LIP reset tests (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix I/O failures during remote port toggle testing (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix MPI reset needed message (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix buffer-buffer credit extraction error (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix crash on session cleanup with unload (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix inconsistent format argument type in qla_dbg.c (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix inconsistent format argument type in tcm_qla2xxx.c (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix memory size truncation (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix point-to-point (N2N) device discovery issue (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Fix reset of MPI firmware (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Honor status qualifier in FCP_RSP per spec (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Make tgt_port_database available in initiator mode (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Performance tweak (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Reduce duplicate code in reporting speed (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Remove unneeded variable 'rval' (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Setup debugfs entries for remote ports (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Update version to 10.02.00.102-k (bsc#1176946 bsc#1175520 bsc#1172538). - scsi: qla2xxx: Update version to 10.02.00.103-k (bsc#1176946 bsc#1175520 bsc#1172538). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1682=1 Package List: - openSUSE Leap 15.1 (x86_64): kernel-debug-4.12.14-lp151.28.75.1 kernel-debug-base-4.12.14-lp151.28.75.1 kernel-debug-base-debuginfo-4.12.14-lp151.28.75.1 kernel-debug-debuginfo-4.12.14-lp151.28.75.1 kernel-debug-debugsource-4.12.14-lp151.28.75.1 kernel-debug-devel-4.12.14-lp151.28.75.1 kernel-debug-devel-debuginfo-4.12.14-lp151.28.75.1 kernel-default-4.12.14-lp151.28.75.1 kernel-default-base-4.12.14-lp151.28.75.1 kernel-default-base-debuginfo-4.12.14-lp151.28.75.1 kernel-default-debuginfo-4.12.14-lp151.28.75.1 kernel-default-debugsource-4.12.14-lp151.28.75.1 kernel-default-devel-4.12.14-lp151.28.75.1 kernel-default-devel-debuginfo-4.12.14-lp151.28.75.1 kernel-kvmsmall-4.12.14-lp151.28.75.1 kernel-kvmsmall-base-4.12.14-lp151.28.75.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp151.28.75.1 kernel-kvmsmall-debuginfo-4.12.14-lp151.28.75.1 kernel-kvmsmall-debugsource-4.12.14-lp151.28.75.1 kernel-kvmsmall-devel-4.12.14-lp151.28.75.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp151.28.75.1 kernel-obs-build-4.12.14-lp151.28.75.1 kernel-obs-build-debugsource-4.12.14-lp151.28.75.1 kernel-obs-qa-4.12.14-lp151.28.75.1 kernel-syms-4.12.14-lp151.28.75.1 kernel-vanilla-4.12.14-lp151.28.75.1 kernel-vanilla-base-4.12.14-lp151.28.75.1 kernel-vanilla-base-debuginfo-4.12.14-lp151.28.75.1 kernel-vanilla-debuginfo-4.12.14-lp151.28.75.1 kernel-vanilla-debugsource-4.12.14-lp151.28.75.1 kernel-vanilla-devel-4.12.14-lp151.28.75.1 kernel-vanilla-devel-debuginfo-4.12.14-lp151.28.75.1 - openSUSE Leap 15.1 (noarch): kernel-devel-4.12.14-lp151.28.75.1 kernel-docs-4.12.14-lp151.28.75.1 kernel-docs-html-4.12.14-lp151.28.75.1 kernel-macros-4.12.14-lp151.28.75.1 kernel-source-4.12.14-lp151.28.75.1 kernel-source-vanilla-4.12.14-lp151.28.75.1 References: https://www.suse.com/security/cve/CVE-2020-12351.html https://www.suse.com/security/cve/CVE-2020-12352.html https://www.suse.com/security/cve/CVE-2020-25212.html https://www.suse.com/security/cve/CVE-2020-25645.html https://bugzilla.suse.com/1065729 https://bugzilla.suse.com/1140683 https://bugzilla.suse.com/1172538 https://bugzilla.suse.com/1174748 https://bugzilla.suse.com/1175520 https://bugzilla.suse.com/1176381 https://bugzilla.suse.com/1176400 https://bugzilla.suse.com/1176946 https://bugzilla.suse.com/1177340 https://bugzilla.suse.com/1177511 https://bugzilla.suse.com/1177685 https://bugzilla.suse.com/1177724 https://bugzilla.suse.com/1177725

1 0

openSUSE-RU-2020:1683-1: moderate: Recommended update for pipewire
by maintenance＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Recommended Update: Recommended update for pipewire ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1683-1 Rating: moderate References: #1176515 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pipewire fixes the following issues: - Fix a division by 0 error causing a crash. (bsc#1176515) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1683=1 Package List: - openSUSE Leap 15.2 (x86_64): gstreamer-plugin-pipewire-0.3.6-lp152.2.6.1 gstreamer-plugin-pipewire-debuginfo-0.3.6-lp152.2.6.1 libpipewire-0_3-0-0.3.6-lp152.2.6.1 libpipewire-0_3-0-debuginfo-0.3.6-lp152.2.6.1 pipewire-0.3.6-lp152.2.6.1 pipewire-debuginfo-0.3.6-lp152.2.6.1 pipewire-debugsource-0.3.6-lp152.2.6.1 pipewire-devel-0.3.6-lp152.2.6.1 pipewire-doc-0.3.6-lp152.2.6.1 pipewire-libjack-0_3-0.3.6-lp152.2.6.1 pipewire-libjack-0_3-debuginfo-0.3.6-lp152.2.6.1 pipewire-libpulse-0_3-0.3.6-lp152.2.6.1 pipewire-libpulse-0_3-debuginfo-0.3.6-lp152.2.6.1 pipewire-modules-0.3.6-lp152.2.6.1 pipewire-modules-debuginfo-0.3.6-lp152.2.6.1 pipewire-spa-plugins-0_2-0.3.6-lp152.2.6.1 pipewire-spa-plugins-0_2-debuginfo-0.3.6-lp152.2.6.1 pipewire-spa-tools-0.3.6-lp152.2.6.1 pipewire-spa-tools-debuginfo-0.3.6-lp152.2.6.1 pipewire-tools-0.3.6-lp152.2.6.1 pipewire-tools-debuginfo-0.3.6-lp152.2.6.1 References: https://bugzilla.suse.com/1176515

1 0

openSUSE-SU-2020:1679-1: critical: Security update for rubygem-activesupport-5_1
by opensuse-security＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Security Update: Security update for rubygem-activesupport-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1679-1 Rating: critical References: #1172186 Cross-References: CVE-2020-8165 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activesupport-5_1 fixes the following issues: - CVE-2020-8165: Fixed deserialization of untrusted data in MemCacheStore potentially resulting in remote code execution (bsc#1172186) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1679=1 Package List: - openSUSE Leap 15.2 (x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-lp152.4.3.1 ruby2.5-rubygem-activesupport-doc-5_1-5.1.4-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-8165.html https://bugzilla.suse.com/1172186

1 0

openSUSE-SU-2020:1680-1: important: Security update for libproxy
by opensuse-security＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Security Update: Security update for libproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1680-1 Rating: important References: #1176410 #1177143 Cross-References: CVE-2020-25219 CVE-2020-26154 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libproxy fixes the following issues: - CVE-2020-25219: Rewrote url::recvline to be nonrecursive (bsc#1176410). - CVE-2020-26154: Fixed a buffer overflow when PAC is enabled (bsc#1177143). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1680=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libproxy-debugsource-0.4.15-lp152.5.3.1 libproxy-devel-0.4.15-lp152.5.3.1 libproxy-tools-0.4.15-lp152.5.3.1 libproxy-tools-debuginfo-0.4.15-lp152.5.3.1 libproxy1-0.4.15-lp152.5.3.1 libproxy1-debuginfo-0.4.15-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): python-libproxy-0.4.15-lp152.5.3.1 python3-libproxy-0.4.15-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): libproxy-plugins-debugsource-0.4.15-lp152.5.3.1 libproxy-sharp-0.4.15-lp152.5.3.1 libproxy1-32bit-0.4.15-lp152.5.3.1 libproxy1-32bit-debuginfo-0.4.15-lp152.5.3.1 libproxy1-config-gnome3-0.4.15-lp152.5.3.1 libproxy1-config-gnome3-debuginfo-0.4.15-lp152.5.3.1 libproxy1-config-kde-0.4.15-lp152.5.3.1 libproxy1-config-kde-debuginfo-0.4.15-lp152.5.3.1 libproxy1-networkmanager-0.4.15-lp152.5.3.1 libproxy1-networkmanager-debuginfo-0.4.15-lp152.5.3.1 libproxy1-pacrunner-webkit-0.4.15-lp152.5.3.1 libproxy1-pacrunner-webkit-debuginfo-0.4.15-lp152.5.3.1 perl-Net-Libproxy-0.4.15-lp152.5.3.1 perl-Net-Libproxy-debuginfo-0.4.15-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-25219.html https://www.suse.com/security/cve/CVE-2020-26154.html https://bugzilla.suse.com/1176410 https://bugzilla.suse.com/1177143

1 0

openSUSE-RU-2020:1681-1: moderate: Recommended update for mksusecd
by maintenance＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Recommended Update: Recommended update for mksusecd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1681-1 Rating: moderate References: #1173263 #1176176 #1176379 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for mksusecd fixes the following issues: Update from version 1.72 to version 1.77 - fix add_on_products.xml handling (bsc#1176379) - Fixes an issue searching for products files only at top-level. (bsc#1176176) - Fix to ensure that modified files really end up on the media. (bsc#1176176) - adjust product handling if products are spread over several media - include complete product directories - fix product handling with new SLE full media layout - added "--sign-pass-file" - added option for recreating and signing the repo - remove "all done" message - additional passphrase options are not necessary at key creation - set additional options only when a existing sign key is specified - print message if --sign-pass-file and missing sign-key - removed sign_passwd_option on import - add --sign-key-id option to allow specifying a gpg signing key by id - do not include excluded products (bsc#1173263) - recreate products file, including its checksum update This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1681=1 Package List: - openSUSE Leap 15.2 (x86_64): mksusecd-1.77-lp152.2.3.1 mksusecd-debuginfo-1.77-lp152.2.3.1 mksusecd-debugsource-1.77-lp152.2.3.1 References: https://bugzilla.suse.com/1173263 https://bugzilla.suse.com/1176176 https://bugzilla.suse.com/1176379

1 0

openSUSE-SU-2020:1678-1: moderate: Security update for crmsh
by opensuse-security＠opensuse.org 17 Oct '20

17 Oct '20

openSUSE Security Update: Security update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1678-1 Rating: moderate References: #1163581 #1176569 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for crmsh fixes the following issues: - Fixed start_delay with start-delay(bsc#1176569) - fix on_fail should be on-fail(bsc#1176569) - config: Try to handle configparser.MissingSectionHeaderError while reading config file - ui_configure: Obscure sensitive data by default(bsc#1163581) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1678=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.2.0+git.1602225426.5f84efb5-lp152.4.27.1 crmsh-scripts-4.2.0+git.1602225426.5f84efb5-lp152.4.27.1 crmsh-test-4.2.0+git.1602225426.5f84efb5-lp152.4.27.1 References: https://bugzilla.suse.com/1163581 https://bugzilla.suse.com/1176569

1 0

openSUSE-SU-2020:1677-1: critical: Security update for rubygem-activesupport-5_1
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for rubygem-activesupport-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1677-1 Rating: critical References: #1172186 Cross-References: CVE-2020-8165 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activesupport-5_1 fixes the following issues: - CVE-2020-8165: Fixed deserialization of untrusted data in MemCacheStore potentially resulting in remote code execution (bsc#1172186) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1677=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-activesupport-5_1-5.1.4-lp151.3.3.1 ruby2.5-rubygem-activesupport-doc-5_1-5.1.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-8165.html https://bugzilla.suse.com/1172186

1 0

openSUSE-SU-2020:1676-1: important: Security update for libproxy
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for libproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1676-1 Rating: important References: #1176410 #1177143 Cross-References: CVE-2020-25219 CVE-2020-26154 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libproxy fixes the following issues: - CVE-2020-25219: Rewrote url::recvline to be nonrecursive (bsc#1176410). - CVE-2020-26154: Fixed a buffer overflow when PAC is enabled (bsc#1177143). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1676=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libproxy-debugsource-0.4.15-lp151.4.3.1 libproxy-devel-0.4.15-lp151.4.3.1 libproxy-tools-0.4.15-lp151.4.3.1 libproxy-tools-debuginfo-0.4.15-lp151.4.3.1 libproxy1-0.4.15-lp151.4.3.1 libproxy1-debuginfo-0.4.15-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libproxy-plugins-debugsource-0.4.15-lp151.4.3.1 libproxy-sharp-0.4.15-lp151.4.3.1 libproxy1-32bit-0.4.15-lp151.4.3.1 libproxy1-32bit-debuginfo-0.4.15-lp151.4.3.1 libproxy1-config-gnome3-0.4.15-lp151.4.3.1 libproxy1-config-gnome3-debuginfo-0.4.15-lp151.4.3.1 libproxy1-config-kde-0.4.15-lp151.4.3.1 libproxy1-config-kde-debuginfo-0.4.15-lp151.4.3.1 libproxy1-networkmanager-0.4.15-lp151.4.3.1 libproxy1-networkmanager-debuginfo-0.4.15-lp151.4.3.1 libproxy1-pacrunner-webkit-0.4.15-lp151.4.3.1 libproxy1-pacrunner-webkit-debuginfo-0.4.15-lp151.4.3.1 perl-Net-Libproxy-0.4.15-lp151.4.3.1 perl-Net-Libproxy-debuginfo-0.4.15-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): python-libproxy-0.4.15-lp151.4.3.1 python3-libproxy-0.4.15-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-25219.html https://www.suse.com/security/cve/CVE-2020-26154.html https://bugzilla.suse.com/1176410 https://bugzilla.suse.com/1177143

1 0