October 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1743-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1743-1 Rating: moderate References: #1176086 #1176181 #1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gnutls fixes the following issues: - Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181) - FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086) - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086) - FIPS: Add TLS KDF selftest (bsc#1176671) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1743=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnutls-3.6.7-lp152.9.3.2 gnutls-debuginfo-3.6.7-lp152.9.3.2 gnutls-debugsource-3.6.7-lp152.9.3.2 gnutls-guile-3.6.7-lp152.9.3.2 gnutls-guile-debuginfo-3.6.7-lp152.9.3.2 libgnutls-dane-devel-3.6.7-lp152.9.3.2 libgnutls-dane0-3.6.7-lp152.9.3.2 libgnutls-dane0-debuginfo-3.6.7-lp152.9.3.2 libgnutls-devel-3.6.7-lp152.9.3.2 libgnutls30-3.6.7-lp152.9.3.2 libgnutls30-debuginfo-3.6.7-lp152.9.3.2 libgnutls30-hmac-3.6.7-lp152.9.3.2 libgnutlsxx-devel-3.6.7-lp152.9.3.2 libgnutlsxx28-3.6.7-lp152.9.3.2 libgnutlsxx28-debuginfo-3.6.7-lp152.9.3.2 - openSUSE Leap 15.2 (x86_64): libgnutls-devel-32bit-3.6.7-lp152.9.3.2 libgnutls30-32bit-3.6.7-lp152.9.3.2 libgnutls30-32bit-debuginfo-3.6.7-lp152.9.3.2 libgnutls30-hmac-32bit-3.6.7-lp152.9.3.2 References: https://www.suse.com/security/cve/CVE-2020-24659.html https://bugzilla.suse.com/1176086 https://bugzilla.suse.com/1176181 https://bugzilla.suse.com/1176671

1 0

openSUSE-RU-2020:1741-1: moderate: Recommended update for tboot
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for tboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1741-1 Rating: moderate References: #1176378 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tboot fixes the following issues: - Fix for 'tboot' issues on platform coming with preloaded 'SINIT' modules with padding. (bsc#1176378) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1741=1 Package List: - openSUSE Leap 15.2 (x86_64): tboot-20170711_1.9.8-lp152.5.3.1 tboot-debuginfo-20170711_1.9.8-lp152.5.3.1 tboot-debugsource-20170711_1.9.8-lp152.5.3.1 References: https://bugzilla.suse.com/1176378

1 0

openSUSE-RU-2020:1742-1: moderate: Recommended update for prometheus-hanadb_exporter
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for prometheus-hanadb_exporter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1742-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for prometheus-hanadb_exporter fixes the following issue: Release 0.7.2 - lookup for `/usr/etc` and the fallback `/etc` directory for config files. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1742=1 Package List: - openSUSE Leap 15.2 (noarch): prometheus-hanadb_exporter-0.7.2+git.1600770990.726a4fe-lp152.2.3.1 References:

1 0

openSUSE-RU-2020:1740-1: moderate: Recommended update for habootstrap-formula, saphanabootstrap-formula, sapnwbootstrap-formula
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for habootstrap-formula, saphanabootstrap-formula, sapnwbootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1740-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for habootstrap-formula, saphanabootstrap-formula, sapnwbootstrap-formula fixes the following issues: saphanabootstrap-formula: - Version 0.6.2: - Update the package version after SUMA form update and extraction logic update (jsc#SLE-4047) - Fix the hana media extraction and installation logics when using exe archives - Update the SUMA hana form metadata, to show hana form under SAP deployment group - Update SUMA form.yml file and prevalidation state with latest changes in formula - Change the default 'hana_extract_dir' hana media extraction location - Remove copy of config files for exporters since we use /usr/etc habootstrap-formula: - Version 0.3.11 - Update the prevalidation logic to check for valid sbd entries (jsc#SLE-4047) - Improve Formula with form description (jsc#SLE-4047) - Update the SUMA form.yml file and prevalidation state with latest changes in project sapnwbootstrap-formula: - Version 0.5.2 - Create SUMA form based on latest pillar and formula data (jsc#SLE-4047) - Implement the differences between ENSA1 and ENSA2 versions - Add the keepalive configuration changes This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1740=1 Package List: - openSUSE Leap 15.2 (noarch): habootstrap-formula-0.3.11+git.1602831614.0f63599-lp152.2.6.1 saphanabootstrap-formula-0.6.2+git.1602608396.b2b12f7-lp152.2.6.1 sapnwbootstrap-formula-0.5.2+git.1602610350.43801ea-lp152.2.6.1 References:

1 0

openSUSE-RU-2020:1739-1: important: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1739-1 Rating: important References: #1177842 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1739=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): phpMyAdmin-4.9.7-bp152.2.6.1 References: https://bugzilla.suse.com/1177842

1 0

openSUSE-RU-2020:1738-1: important: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1738-1 Rating: important References: #1177842 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1738=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.7-bp151.3.21.1 References: https://bugzilla.suse.com/1177842

1 0

openSUSE-SU-2020:1737-1: important: Security update for chromium
by opensuse-security＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1737-1 Rating: important References: #1177936 Cross-References: CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1737=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-86.0.4240.111-lp152.2.42.1 chromedriver-debuginfo-86.0.4240.111-lp152.2.42.1 chromium-86.0.4240.111-lp152.2.42.1 chromium-debuginfo-86.0.4240.111-lp152.2.42.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://bugzilla.suse.com/1177936

1 0

openSUSE-RU-2020:1735-1: moderate: Recommended update for gettext-runtime
by maintenance＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Recommended Update: Recommended update for gettext-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1735-1 Rating: moderate References: #1176142 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gettext-runtime fixes the following issues: - Fix for an issue when 'xgettext' crashes during creating a 'POT' file. (bsc#1176142) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1735=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gettext-runtime-0.19.8.1-lp151.5.7.1 gettext-runtime-debuginfo-0.19.8.1-lp151.5.7.1 gettext-runtime-debugsource-0.19.8.1-lp151.5.7.1 gettext-runtime-mini-0.19.8.1-lp151.5.7.1 gettext-runtime-mini-debuginfo-0.19.8.1-lp151.5.7.1 gettext-runtime-mini-debugsource-0.19.8.1-lp151.5.7.1 gettext-tools-0.19.8.1-lp151.5.7.1 gettext-tools-debuginfo-0.19.8.1-lp151.5.7.1 gettext-tools-mini-0.19.8.1-lp151.5.7.1 gettext-tools-mini-debuginfo-0.19.8.1-lp151.5.7.1 - openSUSE Leap 15.1 (noarch): gettext-runtime-mini-tools-doc-0.19.8.1-lp151.5.7.1 gettext-runtime-tools-doc-0.19.8.1-lp151.5.7.1 - openSUSE Leap 15.1 (x86_64): gettext-csharp-0.19.8.1-lp151.5.7.1 gettext-java-0.19.8.1-lp151.5.7.1 gettext-runtime-32bit-0.19.8.1-lp151.5.7.1 gettext-runtime-32bit-debuginfo-0.19.8.1-lp151.5.7.1 References: https://bugzilla.suse.com/1176142

1 0

openSUSE-SU-2020:1736-1: important: Security update for atftp
by opensuse-security＠opensuse.org 26 Oct '20

26 Oct '20

openSUSE Security Update: Security update for atftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1736-1 Rating: important References: #1176437 Cross-References: CVE-2020-6097 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for atftp fixes the following issues: - [boo#1176437, CVE-2020-6097] A specially crafted sequence of RRQ-Multicast requests can trigger an assert() call resulting denial-of-service. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1736=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): atftp-0.7.2-lp152.2.3.1 atftp-debuginfo-0.7.2-lp152.2.3.1 atftp-debugsource-0.7.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-6097.html https://bugzilla.suse.com/1176437

1 0

openSUSE-SU-2020:1732-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1732-1 Rating: important References: #1176756 #1177872 Cross-References: CVE-2020-15683 CVE-2020-15969 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.4.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-46 (bsc#1177872, bsc#1176756) * CVE-2020-15969 Use-after-free in usersctp * CVE-2020-15683 Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 * Fixed: Fixed legacy preferences not being properly applied when set via GPO This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1732=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.4.0-lp151.2.73.1 MozillaFirefox-branding-upstream-78.4.0-lp151.2.73.1 MozillaFirefox-buildsymbols-78.4.0-lp151.2.73.1 MozillaFirefox-debuginfo-78.4.0-lp151.2.73.1 MozillaFirefox-debugsource-78.4.0-lp151.2.73.1 MozillaFirefox-devel-78.4.0-lp151.2.73.1 MozillaFirefox-translations-common-78.4.0-lp151.2.73.1 MozillaFirefox-translations-other-78.4.0-lp151.2.73.1 References: https://www.suse.com/security/cve/CVE-2020-15683.html https://www.suse.com/security/cve/CVE-2020-15969.html https://bugzilla.suse.com/1176756 https://bugzilla.suse.com/1177872

1 0