October 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1734-1: important: Security update for freetype2
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1734-1 Rating: important References: #1177914 Cross-References: CVE-2020-15999 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freetype2 fixes the following issues: - CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1734=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetype2-debugsource-2.10.1-lp151.4.6.1 freetype2-devel-2.10.1-lp151.4.6.1 libfreetype6-2.10.1-lp151.4.6.1 libfreetype6-debuginfo-2.10.1-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): freetype2-devel-32bit-2.10.1-lp151.4.6.1 ft2demos-2.10.1-lp151.4.6.1 ftbench-2.10.1-lp151.4.6.1 ftdiff-2.10.1-lp151.4.6.1 ftdump-2.10.1-lp151.4.6.1 ftgamma-2.10.1-lp151.4.6.1 ftgrid-2.10.1-lp151.4.6.1 ftinspect-2.10.1-lp151.4.6.1 ftlint-2.10.1-lp151.4.6.1 ftmulti-2.10.1-lp151.4.6.1 ftstring-2.10.1-lp151.4.6.1 ftvalid-2.10.1-lp151.4.6.1 ftview-2.10.1-lp151.4.6.1 libfreetype6-32bit-2.10.1-lp151.4.6.1 libfreetype6-32bit-debuginfo-2.10.1-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): freetype2-profile-tti35-2.10.1-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://bugzilla.suse.com/1177914

1 0

openSUSE-SU-2020:1731-1: important: Security update for chromium
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1731-1 Rating: important References: #1177936 Cross-References: CVE-2020-15999 CVE-2020-16000 CVE-2020-16001 CVE-2020-16002 CVE-2020-16003 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1731=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-86.0.4240.111-bp151.3.116.1 chromium-86.0.4240.111-bp151.3.116.1 References: https://www.suse.com/security/cve/CVE-2020-15999.html https://www.suse.com/security/cve/CVE-2020-16000.html https://www.suse.com/security/cve/CVE-2020-16001.html https://www.suse.com/security/cve/CVE-2020-16002.html https://www.suse.com/security/cve/CVE-2020-16003.html https://bugzilla.suse.com/1177936

1 0

openSUSE-RU-2020:1733-1: Recommended update for apache2
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1733-1 Rating: low References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for apache2 fixes the following issues: - Added -a argument to 'gensslcert' to allow to override the default SAN value This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1733=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-2.4.33-lp151.8.18.1 apache2-debuginfo-2.4.33-lp151.8.18.1 apache2-debugsource-2.4.33-lp151.8.18.1 apache2-devel-2.4.33-lp151.8.18.1 apache2-event-2.4.33-lp151.8.18.1 apache2-event-debuginfo-2.4.33-lp151.8.18.1 apache2-example-pages-2.4.33-lp151.8.18.1 apache2-prefork-2.4.33-lp151.8.18.1 apache2-prefork-debuginfo-2.4.33-lp151.8.18.1 apache2-utils-2.4.33-lp151.8.18.1 apache2-utils-debuginfo-2.4.33-lp151.8.18.1 apache2-worker-2.4.33-lp151.8.18.1 apache2-worker-debuginfo-2.4.33-lp151.8.18.1 - openSUSE Leap 15.1 (noarch): apache2-doc-2.4.33-lp151.8.18.1 References:

1 0

openSUSE-RU-2020:1730-1: moderate: Recommended update for vlc
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1730-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for vlc fixes the following issues: vlc was updated to 3.0.11.1: * Fixed HLS playlist update mechanism, unable to start in some cases. * Because of broken HLS servers, adaptive no longer considers Content-Type as authoritative. * Fixed handling of WEBM WebVTT subtitles * Workaround invalid ADTS in TS from Makito encoders * Fixed Opus when using avformat demuxer * Fixed inverted explicit start/end positioning * Fix listing of media on certain Panasonic recorders discovered via UPnP Update to version 3.0.11: + Access: rtp descriptor leak on error fix. + Demux: * Fixed regression with some encrypted HLS streams. * Live HLS delay until first update fix. * HLS rendition switch regression fix. * Fix imprecise m4a seek. + Decoder: Fixed missing captions with some capture cards. + Audio filters: soxr resampling fixes. + Audio Output: Fix sound not coming back after a pause with CoreAudio (macOS/iOS). + Misc: Update Youtube script. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1730=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libvlc5-3.0.11.1-bp152.2.6.1 libvlccore9-3.0.11.1-bp152.2.6.1 vlc-3.0.11.1-bp152.2.6.1 vlc-codec-gstreamer-3.0.11.1-bp152.2.6.1 vlc-devel-3.0.11.1-bp152.2.6.1 vlc-jack-3.0.11.1-bp152.2.6.1 vlc-noX-3.0.11.1-bp152.2.6.1 vlc-opencv-3.0.11.1-bp152.2.6.1 vlc-qt-3.0.11.1-bp152.2.6.1 vlc-vdpau-3.0.11.1-bp152.2.6.1 - openSUSE Backports SLE-15-SP2 (noarch): vlc-lang-3.0.11.1-bp152.2.6.1 References:

1 0

openSUSE-RU-2020:1728-1: moderate: Recommended update for file
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1728-1 Rating: moderate References: #1176123 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for file fixes the following issues: - Fixes an issue when file displays broken 'ELF' interpreter. (bsc#1176123) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1728=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): file-5.32-lp151.8.6.1 file-debuginfo-5.32-lp151.8.6.1 file-debugsource-5.32-lp151.8.6.1 file-devel-5.32-lp151.8.6.1 libmagic1-5.32-lp151.8.6.1 libmagic1-debuginfo-5.32-lp151.8.6.1 python2-magic-5.32-lp151.8.6.1 python3-magic-5.32-lp151.8.6.1 - openSUSE Leap 15.1 (noarch): file-magic-5.32-lp151.8.6.1 - openSUSE Leap 15.1 (x86_64): file-devel-32bit-5.32-lp151.8.6.1 libmagic1-32bit-5.32-lp151.8.6.1 libmagic1-32bit-debuginfo-5.32-lp151.8.6.1 References: https://bugzilla.suse.com/1176123

1 0

openSUSE-RU-2020:1729-1: moderate: Recommended update for file
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1729-1 Rating: moderate References: #1176123 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for file fixes the following issues: - Fixes an issue when file displays broken 'ELF' interpreter. (bsc#1176123) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1729=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): file-5.32-lp152.10.3.1 file-debuginfo-5.32-lp152.10.3.1 file-debugsource-5.32-lp152.10.3.1 file-devel-5.32-lp152.10.3.1 libmagic1-5.32-lp152.10.3.1 libmagic1-debuginfo-5.32-lp152.10.3.1 python2-magic-5.32-lp152.10.3.1 python3-magic-5.32-lp152.10.3.1 - openSUSE Leap 15.2 (x86_64): file-devel-32bit-5.32-lp152.10.3.1 libmagic1-32bit-5.32-lp152.10.3.1 libmagic1-32bit-debuginfo-5.32-lp152.10.3.1 - openSUSE Leap 15.2 (noarch): file-magic-5.32-lp152.10.3.1 References: https://bugzilla.suse.com/1176123

1 0

openSUSE-RU-2020:1727-1: moderate: Recommended update for procps
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for procps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1727-1 Rating: moderate References: #1158830 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for procps fixes the following issues: - Fixes an issue when command 'ps -C' does not allow anymore an argument longer than 15 characters. (bsc#1158830) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1727=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libprocps7-3.3.15-lp151.6.9.1 libprocps7-debuginfo-3.3.15-lp151.6.9.1 procps-3.3.15-lp151.6.9.1 procps-debuginfo-3.3.15-lp151.6.9.1 procps-debugsource-3.3.15-lp151.6.9.1 procps-devel-3.3.15-lp151.6.9.1 References: https://bugzilla.suse.com/1158830

1 0

openSUSE-RU-2020:1725-1: moderate: Recommended update for prometheus-ha_cluster_exporter
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for prometheus-ha_cluster_exporter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1725-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for prometheus-ha_cluster_exporter fixes the following issues: - Implement SBD watchdog and msgwait timeout metrics. - Handle correctly corosync membership parsing with qdevice enabled. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1725=1 Package List: - openSUSE Leap 15.2 (x86_64): prometheus-ha_cluster_exporter-1.2.0+git.1599131770.8912739-lp152.2.6.1 References:

1 0

openSUSE-RU-2020:1726-1: moderate: Recommended update for ndctl
by maintenance＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Recommended Update: Recommended update for ndctl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1726-1 Rating: moderate References: #1174969 #1175052 #1175851 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for ndctl fixes the following issues: - Suppress 'ENXIO' when processing all namespaces. (jsc#SLE-13321, bsc#1175851, ltc#187867) - Update to v69. (jsc#SLE-13824, jsc#SLE-12770, jsc#SLE-15065, jsc#SLE-15484, jsc#SLE-15485, bsc#1175052, ltc#186863, bsc#1174969, ltc#185845): - Set the default alignment to the platform alignment. - Add support for reporting 'life_used_percentage' metric. - Skip region filtering if numa_node attribute is not present. - Implement support for 'PAPR_PDSM_HEALTH'. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1726=1 Package List: - openSUSE Leap 15.2 (x86_64): libndctl-devel-69-lp152.7.9.1 libndctl6-69-lp152.7.9.1 libndctl6-debuginfo-69-lp152.7.9.1 ndctl-69-lp152.7.9.1 ndctl-debuginfo-69-lp152.7.9.1 ndctl-debugsource-69-lp152.7.9.1 References: https://bugzilla.suse.com/1174969 https://bugzilla.suse.com/1175052 https://bugzilla.suse.com/1175851

1 0

openSUSE-SU-2020:1724-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 25 Oct '20

25 Oct '20

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1724-1 Rating: moderate References: #1176086 #1176181 #1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gnutls fixes the following issues: - Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181) - FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086) - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086) - FIPS: Add TLS KDF selftest (bsc#1176671) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1724=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gnutls-3.6.7-lp151.2.21.1 gnutls-debuginfo-3.6.7-lp151.2.21.1 gnutls-debugsource-3.6.7-lp151.2.21.1 gnutls-guile-3.6.7-lp151.2.21.1 gnutls-guile-debuginfo-3.6.7-lp151.2.21.1 libgnutls-dane-devel-3.6.7-lp151.2.21.1 libgnutls-dane0-3.6.7-lp151.2.21.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.21.1 libgnutls-devel-3.6.7-lp151.2.21.1 libgnutls30-3.6.7-lp151.2.21.1 libgnutls30-debuginfo-3.6.7-lp151.2.21.1 libgnutls30-hmac-3.6.7-lp151.2.21.1 libgnutlsxx-devel-3.6.7-lp151.2.21.1 libgnutlsxx28-3.6.7-lp151.2.21.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.21.1 - openSUSE Leap 15.1 (x86_64): libgnutls-devel-32bit-3.6.7-lp151.2.21.1 libgnutls30-32bit-3.6.7-lp151.2.21.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.21.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-24659.html https://bugzilla.suse.com/1176086 https://bugzilla.suse.com/1176181 https://bugzilla.suse.com/1176671

1 0