October 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1675-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1675-1 Rating: important References: #1177561 #1177562 Cross-References: CVE-2020-26934 CVE-2020-26935 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: - phpMyAdmin was updated to 4.9.6 * CVE-2020-26934: Fixed an XSS relating to the transformation feature (boo#1177561). * CVE-2020-26935: Fixed an SQL injection in SearchController (boo#1177562). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1675=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1675=1 Package List: - openSUSE Leap 15.2 (noarch): phpMyAdmin-4.9.6-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.6-lp151.2.18.1 - openSUSE Backports SLE-15-SP2 (noarch): phpMyAdmin-4.9.6-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.6-bp151.3.18.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.6-46.1 References: https://www.suse.com/security/cve/CVE-2020-26934.html https://www.suse.com/security/cve/CVE-2020-26935.html https://bugzilla.suse.com/1177561 https://bugzilla.suse.com/1177562

1 0

openSUSE-SU-2020:1674-1: important: Security update for icingaweb2
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1674-1 Rating: important References: #1175530 Cross-References: CVE-2020-24368 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icingaweb2 fixes the following issues: - icingaweb2 was updated to 2.7.4 * CVE-2020-24368: Fixed a path Traversal which could have allowed an attacker to access arbitrary files which are readable by the process running (boo#1175530). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1674=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1674=1 Package List: - openSUSE Leap 15.2 (noarch): icingacli-2.7.4-lp152.2.3.1 icingaweb2-2.7.4-lp152.2.3.1 icingaweb2-common-2.7.4-lp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp152.2.3.1 icingaweb2-vendor-JShrink-2.7.4-lp152.2.3.1 icingaweb2-vendor-Parsedown-2.7.4-lp152.2.3.1 icingaweb2-vendor-dompdf-2.7.4-lp152.2.3.1 icingaweb2-vendor-lessphp-2.7.4-lp152.2.3.1 icingaweb2-vendor-zf1-2.7.4-lp152.2.3.1 php-Icinga-2.7.4-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): icingacli-2.7.4-lp151.6.8.1 icingaweb2-2.7.4-lp151.6.8.1 icingaweb2-common-2.7.4-lp151.6.8.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp151.6.8.1 icingaweb2-vendor-JShrink-2.7.4-lp151.6.8.1 icingaweb2-vendor-Parsedown-2.7.4-lp151.6.8.1 icingaweb2-vendor-dompdf-2.7.4-lp151.6.8.1 icingaweb2-vendor-lessphp-2.7.4-lp151.6.8.1 icingaweb2-vendor-zf1-2.7.4-lp151.6.8.1 php-Icinga-2.7.4-lp151.6.8.1 - openSUSE Backports SLE-15-SP2 (noarch): icingacli-2.7.4-bp152.2.3.1 icingaweb2-2.7.4-bp152.2.3.1 icingaweb2-common-2.7.4-bp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp152.2.3.1 icingaweb2-vendor-JShrink-2.7.4-bp152.2.3.1 icingaweb2-vendor-Parsedown-2.7.4-bp152.2.3.1 icingaweb2-vendor-dompdf-2.7.4-bp152.2.3.1 icingaweb2-vendor-lessphp-2.7.4-bp152.2.3.1 icingaweb2-vendor-zf1-2.7.4-bp152.2.3.1 php-Icinga-2.7.4-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): icingacli-2.7.4-bp151.5.6.1 icingaweb2-2.7.4-bp151.5.6.1 icingaweb2-common-2.7.4-bp151.5.6.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp151.5.6.1 icingaweb2-vendor-JShrink-2.7.4-bp151.5.6.1 icingaweb2-vendor-Parsedown-2.7.4-bp151.5.6.1 icingaweb2-vendor-dompdf-2.7.4-bp151.5.6.1 icingaweb2-vendor-lessphp-2.7.4-bp151.5.6.1 icingaweb2-vendor-zf1-2.7.4-bp151.5.6.1 php-Icinga-2.7.4-bp151.5.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.7.4-12.1 icingaweb2-2.7.4-12.1 icingaweb2-common-2.7.4-12.1 icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 icingaweb2-vendor-JShrink-2.7.4-12.1 icingaweb2-vendor-Parsedown-2.7.4-12.1 icingaweb2-vendor-dompdf-2.7.4-12.1 icingaweb2-vendor-lessphp-2.7.4-12.1 icingaweb2-vendor-zf1-2.7.4-12.1 php-Icinga-2.7.4-12.1 References: https://www.suse.com/security/cve/CVE-2020-24368.html https://bugzilla.suse.com/1175530

1 0

openSUSE-SU-2020:1675-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1675-1 Rating: important References: #1177561 #1177562 Cross-References: CVE-2020-26934 CVE-2020-26935 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin fixes the following issues: - phpMyAdmin was updated to 4.9.6 * CVE-2020-26934: Fixed an XSS relating to the transformation feature (boo#1177561). * CVE-2020-26935: Fixed an SQL injection in SearchController (boo#1177562). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1675=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1675=1 Package List: - openSUSE Leap 15.2 (noarch): phpMyAdmin-4.9.6-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.6-lp151.2.18.1 - openSUSE Backports SLE-15-SP2 (noarch): phpMyAdmin-4.9.6-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.6-bp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-26934.html https://www.suse.com/security/cve/CVE-2020-26935.html https://bugzilla.suse.com/1177561 https://bugzilla.suse.com/1177562

1 0

openSUSE-SU-2020:1674-1: important: Security update for icingaweb2
by opensuse-security＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1674-1 Rating: important References: #1175530 Cross-References: CVE-2020-24368 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icingaweb2 fixes the following issues: - icingaweb2 was updated to 2.7.4 * CVE-2020-24368: Fixed a path Traversal which could have allowed an attacker to access arbitrary files which are readable by the process running (boo#1175530). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1674=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.7.4-12.1 icingaweb2-2.7.4-12.1 icingaweb2-common-2.7.4-12.1 icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 icingaweb2-vendor-JShrink-2.7.4-12.1 icingaweb2-vendor-Parsedown-2.7.4-12.1 icingaweb2-vendor-dompdf-2.7.4-12.1 icingaweb2-vendor-lessphp-2.7.4-12.1 icingaweb2-vendor-zf1-2.7.4-12.1 php-Icinga-2.7.4-12.1 References: https://www.suse.com/security/cve/CVE-2020-24368.html https://bugzilla.suse.com/1175530

1 0

openSUSE-RU-2020:1673-1: important: Recommended update for multipath-tools
by maintenance＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Recommended Update: Recommended update for multipath-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1673-1 Rating: important References: #1125043 #1139837 #1161923 #1165786 #1172157 #1172429 #1173060 #1173064 #1176644 #1176670 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for multipath-tools fixes the following issues: - Fixed an issue where mapping two WWID's to the same multipath led to a data corruption (bsc#1172429) - Improved logging of some failure cases (bsc#1173060, bsc#1173064) - Limited the PRIN allocation length to 8192 bytes (bsc#1165786) - Added "-e" option to enable foreign libraries (bsc#1139837) - Fixed an issue when handling synthetic uevents (bsc#1161923) - Fix handling of hardware properties for maps without paths (bsc#1176644) - Fixed an issue where all paths were dropped from a storage array (bsc#1125043) - Fixed handling of incompletely initialized udev devices (bsc#1172157) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1673=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kpartx-0.8.2+140.5146cae-lp152.3.3.1 kpartx-debuginfo-0.8.2+140.5146cae-lp152.3.3.1 libdmmp-devel-0.8.2+140.5146cae-lp152.3.3.1 libdmmp0_2_0-0.8.2+140.5146cae-lp152.3.3.1 libdmmp0_2_0-debuginfo-0.8.2+140.5146cae-lp152.3.3.1 multipath-tools-0.8.2+140.5146cae-lp152.3.3.1 multipath-tools-debuginfo-0.8.2+140.5146cae-lp152.3.3.1 multipath-tools-debugsource-0.8.2+140.5146cae-lp152.3.3.1 multipath-tools-devel-0.8.2+140.5146cae-lp152.3.3.1 References: https://bugzilla.suse.com/1125043 https://bugzilla.suse.com/1139837 https://bugzilla.suse.com/1161923 https://bugzilla.suse.com/1165786 https://bugzilla.suse.com/1172157 https://bugzilla.suse.com/1172429 https://bugzilla.suse.com/1173060 https://bugzilla.suse.com/1173064 https://bugzilla.suse.com/1176644 https://bugzilla.suse.com/1176670

1 0

openSUSE-RU-2020:1672-1: moderate: Recommended update for openssl-1_1
by maintenance＠opensuse.org 16 Oct '20

16 Oct '20

openSUSE Recommended Update: Recommended update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1672-1 Rating: moderate References: #1177479 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openssl-1_1 fixes the following issues: - Restore private key check in EC_KEY_check_key (bsc#1177479) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1672=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_1-devel-1.1.1d-lp152.7.6.1 libopenssl1_1-1.1.1d-lp152.7.6.1 libopenssl1_1-debuginfo-1.1.1d-lp152.7.6.1 libopenssl1_1-hmac-1.1.1d-lp152.7.6.1 openssl-1_1-1.1.1d-lp152.7.6.1 openssl-1_1-debuginfo-1.1.1d-lp152.7.6.1 openssl-1_1-debugsource-1.1.1d-lp152.7.6.1 - openSUSE Leap 15.2 (noarch): openssl-1_1-doc-1.1.1d-lp152.7.6.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-lp152.7.6.1 libopenssl1_1-32bit-1.1.1d-lp152.7.6.1 libopenssl1_1-32bit-debuginfo-1.1.1d-lp152.7.6.1 libopenssl1_1-hmac-32bit-1.1.1d-lp152.7.6.1 References: https://bugzilla.suse.com/1177479

1 0

openSUSE-RU-2020:1671-1: moderate: Recommended update for budgie-calendar-applet, budgie-haste-applet, budgie-screenshot-applet
by maintenance＠opensuse.org 15 Oct '20

15 Oct '20

openSUSE Recommended Update: Recommended update for budgie-calendar-applet, budgie-haste-applet, budgie-screenshot-applet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1671-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for budgie-calendar-applet, budgie-haste-applet, budgie-screenshot-applet fixes the following issues: - budgie-calendar-applet was shipped in version 5.1: - budgie-haste-applet was shipped in version git 20200228: - budgie-screenshot-applet was shipped in version git 20200503 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1671=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): budgie-calendar-applet-5.2-bp152.2.1 budgie-haste-applet-20200228-bp152.2.1 budgie-haste-applet-debuginfo-20200228-bp152.2.1 budgie-haste-applet-debugsource-20200228-bp152.2.1 budgie-screenshot-applet-20200503-bp152.2.1 budgie-screenshot-applet-debuginfo-20200503-bp152.2.1 budgie-screenshot-applet-debugsource-20200503-bp152.2.1 - openSUSE Backports SLE-15-SP2 (noarch): budgie-calendar-applet-lang-5.2-bp152.2.1 budgie-haste-applet-lang-20200228-bp152.2.1 budgie-screenshot-applet-lang-20200503-bp152.2.1 References:

1 0

openSUSE-RU-2020:1670-1: moderate: Recommended update for vlc
by maintenance＠opensuse.org 15 Oct '20

15 Oct '20

openSUSE Recommended Update: Recommended update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1670-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: * Fixed HLS playlist update mechanism, unable to start in some cases. * Because of broken HLS servers, adaptive no longer considers Content-Type as authoritative. * Fixed handling of WEBM WebVTT subtitles * Workaround invalid ADTS in TS from Makito encoders * Fixed Opus when using avformat demuxer * Fixed inverted explicit start/end positioning * Fix listing of media on certain Panasonic recorders discovered via UPnP * Updated gnutls to 3.6.14 * Updated libebml to 1.4.0 * Updated libmatroska to 1.6.0 * Updated mpg123 to 1.26.2 Update to version 3.0.11: + Access: rtp descriptor leak on error fix. + Demux: * Fixed regression with some encrypted HLS streams. * Live HLS delay until first update fix. * HLS rendition switch regression fix. * Fix imprecise m4a seek. + Decoder: Fixed missing captions with some capture cards. + Audio filters: soxr resampling fixes. + Contribs: * Updated libfaad to 2.9.2 (Parametric Stereo regression). * Updated libarchive to 3.4.2. + Audio Output: Fix sound not coming back after a pause with CoreAudio (macOS/iOS). + Misc: Update Youtube script. - Package arm neon plugins - Update to version 3.0.10: + Misc: Update Twitch & VLSub scripts. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1670=1 Package List: - openSUSE Leap 15.1 (noarch): vlc-lang-3.0.11.1-lp151.6.9.1 - openSUSE Leap 15.1 (x86_64): libvlc5-3.0.11.1-lp151.6.9.1 libvlc5-debuginfo-3.0.11.1-lp151.6.9.1 libvlccore9-3.0.11.1-lp151.6.9.1 libvlccore9-debuginfo-3.0.11.1-lp151.6.9.1 vlc-3.0.11.1-lp151.6.9.1 vlc-codec-gstreamer-3.0.11.1-lp151.6.9.1 vlc-codec-gstreamer-debuginfo-3.0.11.1-lp151.6.9.1 vlc-debuginfo-3.0.11.1-lp151.6.9.1 vlc-debugsource-3.0.11.1-lp151.6.9.1 vlc-devel-3.0.11.1-lp151.6.9.1 vlc-jack-3.0.11.1-lp151.6.9.1 vlc-jack-debuginfo-3.0.11.1-lp151.6.9.1 vlc-noX-3.0.11.1-lp151.6.9.1 vlc-noX-debuginfo-3.0.11.1-lp151.6.9.1 vlc-opencv-3.0.11.1-lp151.6.9.1 vlc-opencv-debuginfo-3.0.11.1-lp151.6.9.1 vlc-qt-3.0.11.1-lp151.6.9.1 vlc-qt-debuginfo-3.0.11.1-lp151.6.9.1 vlc-vdpau-3.0.11.1-lp151.6.9.1 vlc-vdpau-debuginfo-3.0.11.1-lp151.6.9.1 References:

1 0

openSUSE-RU-2020:1669-1: moderate: Recommended update for krename
by maintenance＠opensuse.org 15 Oct '20

15 Oct '20

openSUSE Recommended Update: Recommended update for krename ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1669-1 Rating: moderate References: #1177221 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for krename fixes the following issues: Changes in krename: - fixed krename not terminating after renaming (boo#1177221, kde#395084) - Add support for exiv2-0.27: This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1669=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): krename-5.0.0-bp152.4.3.1 References: https://bugzilla.suse.com/1177221

1 0

openSUSE-RU-2020:1668-1: moderate: Recommended update for krename
by maintenance＠opensuse.org 15 Oct '20

15 Oct '20

openSUSE Recommended Update: Recommended update for krename ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1668-1 Rating: moderate References: #1177221 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for krename fixes the following issues: Changes in krename: - fixed krename not terminating after renaming (boo#1177221, kde#395084) - Add support for exiv2-0.27: This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1668=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): krename-5.0.0-bp151.4.3.1 References: https://bugzilla.suse.com/1177221

1 0