October 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1715-1: critical: Security update for chromium
by opensuse-security＠opensuse.org 23 Oct '20

23 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1715-1 Rating: critical References: #1177408 Cross-References: CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 CVE-2020-6557 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for chromium fixes the following issues: -chromium was updated to 86.0.4240.75 (boo#1177408): - CVE-2020-15967: Fixed Use after free in payments. - CVE-2020-15968: Fixed Use after free in Blink. - CVE-2020-15969: Fixed Use after free in WebRTC. - CVE-2020-15970: Fixed Use after free in NFC. - CVE-2020-15971: Fixed Use after free in printing. - CVE-2020-15972: Fixed Use after free in audio. - CVE-2020-15990: Fixed Use after free in autofill. - CVE-2020-15991: Fixed Use after free in password manager. - CVE-2020-15973: Fixed Insufficient policy enforcement in extensions. - CVE-2020-15974: Fixed Integer overflow in Blink. - CVE-2020-15975: Fixed Integer overflow in SwiftShader. - CVE-2020-15976: Fixed Use after free in WebXR. - CVE-2020-6557: Fixed Inappropriate implementation in networking. - CVE-2020-15977: Fixed Insufficient data validation in dialogs. - CVE-2020-15978: Fixed Insufficient data validation in navigation. - CVE-2020-15979: Fixed Inappropriate implementation in V8. - CVE-2020-15980: Fixed Insufficient policy enforcement in Intents. - CVE-2020-15981: Fixed Out of bounds read in audio. - CVE-2020-15982: Fixed Side-channel information leakage in cache. - CVE-2020-15983: Fixed Insufficient data validation in webUI. - CVE-2020-15984: Fixed Insufficient policy enforcement in Omnibox. - CVE-2020-15985: Fixed Inappropriate implementation in Blink. - CVE-2020-15986: Fixed Integer overflow in media. - CVE-2020-15987: Fixed Use after free in WebRTC. - CVE-2020-15992: Fixed Insufficient policy enforcement in networking. - CVE-2020-15988: Fixed Insufficient policy enforcement in downloads. - CVE-2020-15989: Fixed Uninitialized Use in PDFium. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1715=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): gn-0.1807-bp151.3.6.1 gn-debuginfo-0.1807-bp151.3.6.1 gn-debugsource-0.1807-bp151.3.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-86.0.4240.75-bp151.3.113.1 chromium-86.0.4240.75-bp151.3.113.1 References: https://www.suse.com/security/cve/CVE-2020-15967.html https://www.suse.com/security/cve/CVE-2020-15968.html https://www.suse.com/security/cve/CVE-2020-15969.html https://www.suse.com/security/cve/CVE-2020-15970.html https://www.suse.com/security/cve/CVE-2020-15971.html https://www.suse.com/security/cve/CVE-2020-15972.html https://www.suse.com/security/cve/CVE-2020-15973.html https://www.suse.com/security/cve/CVE-2020-15974.html https://www.suse.com/security/cve/CVE-2020-15975.html https://www.suse.com/security/cve/CVE-2020-15976.html https://www.suse.com/security/cve/CVE-2020-15977.html https://www.suse.com/security/cve/CVE-2020-15978.html https://www.suse.com/security/cve/CVE-2020-15979.html https://www.suse.com/security/cve/CVE-2020-15980.html https://www.suse.com/security/cve/CVE-2020-15981.html https://www.suse.com/security/cve/CVE-2020-15982.html https://www.suse.com/security/cve/CVE-2020-15983.html https://www.suse.com/security/cve/CVE-2020-15984.html https://www.suse.com/security/cve/CVE-2020-15985.html https://www.suse.com/security/cve/CVE-2020-15986.html https://www.suse.com/security/cve/CVE-2020-15987.html https://www.suse.com/security/cve/CVE-2020-15988.html https://www.suse.com/security/cve/CVE-2020-15989.html https://www.suse.com/security/cve/CVE-2020-15990.html https://www.suse.com/security/cve/CVE-2020-15991.html https://www.suse.com/security/cve/CVE-2020-15992.html https://www.suse.com/security/cve/CVE-2020-6557.html https://bugzilla.suse.com/1177408

1 0

openSUSE-RU-2020:1712-1: moderate: Recommended update for yast2-packager
by maintenance＠opensuse.org 23 Oct '20

23 Oct '20

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1712-1 Rating: moderate References: #1172477 #1175374 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-packager fixes the following issues: - Fixed name of the add-on repository to add the product name properly. (bsc#1175374, bsc#1172477) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1712=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-packager-4.2.65-lp152.2.6.1 References: https://bugzilla.suse.com/1172477 https://bugzilla.suse.com/1175374

1 0

openSUSE-RU-2020:1711-1: moderate: Recommended update for hylafax+
by maintenance＠opensuse.org 23 Oct '20

23 Oct '20

openSUSE Recommended Update: Recommended update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1711-1 Rating: moderate References: #1172731 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hylafax+ fixes the following issues: Changes in hylafax+: - CVE-2020-8024: Fixed problematic permissions that allowed escalation from uucp to other users (boo#1172731) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1711=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): hylafax+-7.0.3-bp151.6.8.1 hylafax+-client-7.0.3-bp151.6.8.1 libfaxutil7_0_3-7.0.3-bp151.6.8.1 References: https://www.suse.com/security/cve/CVE-2020-8024.html https://bugzilla.suse.com/1172731

1 0

openSUSE-RU-2020:1710-1: moderate: Recommended update for gettext-runtime
by maintenance＠opensuse.org 23 Oct '20

23 Oct '20

openSUSE Recommended Update: Recommended update for gettext-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1710-1 Rating: moderate References: #1176142 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gettext-runtime fixes the following issues: - Fix for an issue when 'xgettext' crashes during creating a 'POT' file. (bsc#1176142) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1710=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gettext-runtime-0.19.8.1-lp152.6.6.1 gettext-runtime-debuginfo-0.19.8.1-lp152.6.6.1 gettext-runtime-debugsource-0.19.8.1-lp152.6.6.1 gettext-runtime-mini-0.19.8.1-lp152.6.6.1 gettext-runtime-mini-debuginfo-0.19.8.1-lp152.6.6.1 gettext-runtime-mini-debugsource-0.19.8.1-lp152.6.6.1 gettext-tools-0.19.8.1-lp152.6.6.1 gettext-tools-debuginfo-0.19.8.1-lp152.6.6.1 gettext-tools-mini-0.19.8.1-lp152.6.6.1 gettext-tools-mini-debuginfo-0.19.8.1-lp152.6.6.1 - openSUSE Leap 15.2 (x86_64): gettext-csharp-0.19.8.1-lp152.6.6.1 gettext-java-0.19.8.1-lp152.6.6.1 gettext-runtime-32bit-0.19.8.1-lp152.6.6.1 gettext-runtime-32bit-debuginfo-0.19.8.1-lp152.6.6.1 - openSUSE Leap 15.2 (noarch): gettext-runtime-mini-tools-doc-0.19.8.1-lp152.6.6.1 gettext-runtime-tools-doc-0.19.8.1-lp152.6.6.1 References: https://bugzilla.suse.com/1176142

1 0

openSUSE-RU-2020:1709-1: important: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1709-1 Rating: important References: #1177842 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1709=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1709=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1709=1 Package List: - openSUSE Leap 15.2 (noarch): phpMyAdmin-4.9.7-lp152.2.6.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.7-lp151.2.21.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.7-49.1 References: https://bugzilla.suse.com/1177842

1 0

openSUSE-RU-2020:1709-1: important: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1709-1 Rating: important References: #1177842 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1709=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1709=1 Package List: - openSUSE Leap 15.2 (noarch): phpMyAdmin-4.9.7-lp152.2.6.1 - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.7-lp151.2.21.1 References: https://bugzilla.suse.com/1177842

1 0

openSUSE-SU-2020:1707-1: moderate: Recommended update for mailman
by opensuse-security＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Security Update: Recommended update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1707-1 Rating: moderate References: #1171363 #1173369 Cross-References: CVE-2020-12108 CVE-2020-12137 CVE-2020-15011 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mailman to version 2.1.34 fixes the following issues: - The fix for lp#1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSE_SECOND_PENDING to unsubscription as well. (lp#1878458) - DMARC mitigation no longer misses if the domain name returned by DNS contains upper case. (lp#1881035) - A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to prevent mailbombing of a member of a list with private rosters by repeated subscribe attempts. (lp#1883017) - Very long filenames for scrubbed attachments are now truncated. (lp#1884456) - A content injection vulnerability via the private login page has been fixed. CVE-2020-15011 (lp#1877379, bsc#1173369) - A content injection vulnerability via the options login page has been discovered and reported by Vishal Singh. CVE-2020-12108 (lp#1873722, bsc#1171363) - Bounce recognition for a non-compliant Yahoo format is added. - Archiving workaround for non-ascii in string.lowercase in some Python packages is added. - Thanks to Jim Popovitch, there is now a dmarc_moderation_addresses list setting that can be used to apply dmarc_moderation_action to mail From: addresses listed or matching listed regexps. This can be used to modify mail to addresses that don't accept external mail From: themselves. - There is a new MAX_LISTNAME_LENGTH setting. The fix for lp#1780874 obtains a list of the names of all the all the lists in the installation in order to determine the maximum length of a legitimate list name. It does this on every web access and on sites with a very large number of lists, this can have performance implications. See the description in Defaults.py for more information. - Thanks to Ralf Jung there is now the ability to add text based captchas (aka textchas) to the listinfo subscribe form. See the documentation for the new CAPTCHA setting in Defaults.py for how to enable this. Also note that if you have custom listinfo.html templates, you will have to add a <mm-captcha-ui> tag to those templates to make this work. This feature can be used in combination with or instead of the Google reCAPTCHA feature added in 2.1.26. - Thanks to Ralf Hildebrandt the web admin Membership Management section now has a feature to sync the list's membership with a list of email addresses as with the bin/sync_members command. - There is a new drop_cc list attribute set from DEFAULT_DROP_CC. This controls the dropping of addresses from the Cc: header in delivered messages by the duplicate avoidance process. (lp#1845751) - There is a new REFUSE_SECOND_PENDING mm_cfg.py setting that will cause a second request to subscribe to a list when there is already a pending confirmation for that user. This can be set to Yes to prevent mailbombing of a third party by repeatedly posting the subscribe form. (lp#1859104) - Fixed the confirm CGI to catch a rare TypeError on simultaneous confirmations of the same token. (lp#1785854) - Scrubbed application/octet-stream MIME parts will now be given a .bin extension instead of .obj. CVE-2020-12137 (lp#1886117) - Added bounce recognition for a non-compliant opensmtpd DSN with Action: error. (lp#1805137) - Corrected and augmented some security log messages. (lp#1810098) - Implemented use of QRUNNER_SLEEP_TIME for bin/qrunner --runner=All. (lp#1818205) - Leading/trailing spaces in provided email addresses for login to private archives and the user options page are now ignored. (lp#1818872) - Fixed the spelling of the --no-restart option for mailmanctl. - Fixed an issue where certain combinations of charset and invalid characters in a list's description could produce a List-ID header without angle brackets. (lp#1831321) - With the Postfix MTA and virtual domains, mappings for the site list -bounces and -request addresses in each virtual domain are now added to data/virtual-mailman (-owner was done in 2.1.24). (lp#1831777) - The paths.py module now extends sys.path with the result of site.getsitepackages() if available. (lp#1838866) - A bug causing a UnicodeDecodeError in preparing to send the confirmation request message to a new subscriber has been fixed. (lp#1851442) - The SimpleMatch heuristic bounce recognizer has been improved to not return most invalid email addresses. (lp#1859011) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1707=1 Package List: - openSUSE Leap 15.2 (x86_64): mailman-2.1.34-lp152.7.3.1 mailman-debuginfo-2.1.34-lp152.7.3.1 mailman-debugsource-2.1.34-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://www.suse.com/security/cve/CVE-2020-12137.html https://www.suse.com/security/cve/CVE-2020-15011.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/1173369

1 0

openSUSE-RU-2020:1708-1: moderate: Recommended update for gettext-runtime
by maintenance＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Recommended Update: Recommended update for gettext-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1708-1 Rating: moderate References: #1176142 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gettext-runtime fixes the following issues: - Fix for an issue when 'xgettext' crashes during creating a 'POT' file. (bsc#1176142) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1708=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gettext-runtime-0.19.8.1-lp151.5.5.1 gettext-runtime-debuginfo-0.19.8.1-lp151.5.5.1 gettext-runtime-debugsource-0.19.8.1-lp151.5.5.1 gettext-runtime-mini-0.19.8.1-lp151.5.5.1 gettext-runtime-mini-debuginfo-0.19.8.1-lp151.5.5.1 gettext-runtime-mini-debugsource-0.19.8.1-lp151.5.5.1 gettext-tools-0.19.8.1-lp151.5.5.1 gettext-tools-debuginfo-0.19.8.1-lp151.5.5.1 gettext-tools-mini-0.19.8.1-lp151.5.5.1 gettext-tools-mini-debuginfo-0.19.8.1-lp151.5.5.1 - openSUSE Leap 15.1 (noarch): gettext-runtime-mini-tools-doc-0.19.8.1-lp151.5.5.1 gettext-runtime-tools-doc-0.19.8.1-lp151.5.5.1 - openSUSE Leap 15.1 (x86_64): gettext-csharp-0.19.8.1-lp151.5.5.1 gettext-java-0.19.8.1-lp151.5.5.1 gettext-runtime-32bit-0.19.8.1-lp151.5.5.1 gettext-runtime-32bit-debuginfo-0.19.8.1-lp151.5.5.1 References: https://bugzilla.suse.com/1176142

1 0

openSUSE-RU-2020:1706-1: critical: Recommended update for python-azure-agent
by maintenance＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Recommended Update: Recommended update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1706-1 Rating: critical References: #1176368 #1176369 #1177161 #1177257 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for python-azure-agent fixes the following issues: - Fixes an issue when the 'python-azure-agent' fails to initialize Azure instances. (bsc#1177161, bsc#1177257) Update to version 2.2.49.2 (bsc#1176368, bsc#1176369) + Do not use --unit with systemd-cgls (#1910) + Report processes that do not belong to the agent's cgroup (#1908) + Use controller mount point for extension cgroup path (#1899) + Improvements in setup of cgroups (#1896) + Remove ExtensionsMetricsData and per-process Memory data (#1884) + Fix return value of start_extension_command (#1927) + Remove import * (#1900) + Fix flaky ExtensionCleanupTest class (#1898) + Fix codecov badge (#1883) + Changed codecov to run on py3.8 (#1875) + Update documentation on /dev/random (#1909) + Mount options are in mount(8) (#1893) + Remove ssh host key thumbprint in report ready (#1913) + Emit AutoUpdate value at service start only (#1907) + Add logging for version mismatch (#1895) + Send telemetry event if libdir changes (#1897) + Add log collector utility (#1847) + Move AutoUpdate reporting to HeartBeat event (#1919) + Removing infinite download of extension manifest without a new GS (#1874) + Fix wrongful dir deletion (#1873) + Fix the cleanup-outdated-handlers to only delete handlers that are not present in the GS (#1889) + Expose periods of environment thread in waagent.conf (#1891) + Added user @kevinclark19a as Contributor. (#1906) - From 2.2.48.1 + Refactoring GoalState class out of Protocol, making Protocol thread-safe, removing stale dependencies of Protocol and removing the dependency on the file system to read the Protocol info + Fetch goal state when creating HostPluginProtocol (#1799) + Separate goal state from the protocol class (#1777) + Make protocol util a singleton per thread (#1743, #1756) + Fetch goal state before sending telemetry (#1751) + Remove file dependency (#1754) + Others (#1758, #1767, #1744, #1749, #1816, #1820) + New logs for goal state fetch (#1797) and refresh (#1794). + Thread name added to logs (#1778) + Populate telemetry events at creation time (#1791) + Periodic HeartBeat to be logged to the file (#1755) + Add unit test to verify call stacks on telemetry events (#1828) + Others (#1841, #1842, #1846) + Handling errors while reading extension status files (Limiting Size and Transient issues)(#1761) + Enable SWAP on Resource Disk as Application Certification Support suggested (#1762) + Update 'Provisioning' options in default configs ( #1853) + Drop Metadata Server Support (#1806, #1839, #1840 ) + Improve documentation of ResourceDisk.EnableSwapEncryption (#1782) + Removed is_snappy function (#1774) + Handle exceptions in monitor thread (#1770) + Fix timestamp for periodic operations in the monitor thread (#1879) + Fix permissions on the Ubuntu systemd service file (#1814) + Update hostname setting for SUSE distros (#1832) + Python 3.8 improvements + support for Ubuntu 20.04 (#1860, #1865, #1738) + Testing and dev-infra improvements [#1771, #1768, #1800, #1826, #1827, #1833] + Others (#1854, #1858) - From 2.2.46 + [#1741] Do not update goal state when refreshing the host plugin + [#1731] Fix upgrade sequence when update command fails + [#1725] Initialize CPU usage + [#1716, #1737] Added UTC logging and correcting the format + [#1651, #1729] Start sending PerformanceCounter metrics and additional memory information for Cgroups This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1706=1 Package List: - openSUSE Leap 15.1 (noarch): python-azure-agent-2.2.49.2-lp151.2.16.1 python-azure-agent-test-2.2.49.2-lp151.2.16.1 References: https://bugzilla.suse.com/1176368 https://bugzilla.suse.com/1176369 https://bugzilla.suse.com/1177161 https://bugzilla.suse.com/1177257

1 0

openSUSE-SU-2020:1705-1: critical: Security update for chromium
by opensuse-security＠opensuse.org 22 Oct '20

22 Oct '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1705-1 Rating: critical References: #1177408 Cross-References: CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 CVE-2020-6557 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for chromium fixes the following issues: -chromium was updated to 86.0.4240.75 (boo#1177408): - CVE-2020-15967: Fixed Use after free in payments. - CVE-2020-15968: Fixed Use after free in Blink. - CVE-2020-15969: Fixed Use after free in WebRTC. - CVE-2020-15970: Fixed Use after free in NFC. - CVE-2020-15971: Fixed Use after free in printing. - CVE-2020-15972: Fixed Use after free in audio. - CVE-2020-15990: Fixed Use after free in autofill. - CVE-2020-15991: Fixed Use after free in password manager. - CVE-2020-15973: Fixed Insufficient policy enforcement in extensions. - CVE-2020-15974: Fixed Integer overflow in Blink. - CVE-2020-15975: Fixed Integer overflow in SwiftShader. - CVE-2020-15976: Fixed Use after free in WebXR. - CVE-2020-6557: Fixed Inappropriate implementation in networking. - CVE-2020-15977: Fixed Insufficient data validation in dialogs. - CVE-2020-15978: Fixed Insufficient data validation in navigation. - CVE-2020-15979: Fixed Inappropriate implementation in V8. - CVE-2020-15980: Fixed Insufficient policy enforcement in Intents. - CVE-2020-15981: Fixed Out of bounds read in audio. - CVE-2020-15982: Fixed Side-channel information leakage in cache. - CVE-2020-15983: Fixed Insufficient data validation in webUI. - CVE-2020-15984: Fixed Insufficient policy enforcement in Omnibox. - CVE-2020-15985: Fixed Inappropriate implementation in Blink. - CVE-2020-15986: Fixed Integer overflow in media. - CVE-2020-15987: Fixed Use after free in WebRTC. - CVE-2020-15992: Fixed Insufficient policy enforcement in networking. - CVE-2020-15988: Fixed Insufficient policy enforcement in downloads. - CVE-2020-15989: Fixed Uninitialized Use in PDFium. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1705=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1705=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-86.0.4240.75-lp152.2.39.1 chromedriver-debuginfo-86.0.4240.75-lp152.2.39.1 chromium-86.0.4240.75-lp152.2.39.1 chromium-debuginfo-86.0.4240.75-lp152.2.39.1 gn-0.1807-lp152.2.3.1 gn-debuginfo-0.1807-lp152.2.3.1 gn-debugsource-0.1807-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): chromedriver-86.0.4240.75-lp151.2.144.1 chromedriver-debuginfo-86.0.4240.75-lp151.2.144.1 chromium-86.0.4240.75-lp151.2.144.1 chromium-debuginfo-86.0.4240.75-lp151.2.144.1 gn-0.1807-lp151.2.6.1 gn-debuginfo-0.1807-lp151.2.6.1 gn-debugsource-0.1807-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-15967.html https://www.suse.com/security/cve/CVE-2020-15968.html https://www.suse.com/security/cve/CVE-2020-15969.html https://www.suse.com/security/cve/CVE-2020-15970.html https://www.suse.com/security/cve/CVE-2020-15971.html https://www.suse.com/security/cve/CVE-2020-15972.html https://www.suse.com/security/cve/CVE-2020-15973.html https://www.suse.com/security/cve/CVE-2020-15974.html https://www.suse.com/security/cve/CVE-2020-15975.html https://www.suse.com/security/cve/CVE-2020-15976.html https://www.suse.com/security/cve/CVE-2020-15977.html https://www.suse.com/security/cve/CVE-2020-15978.html https://www.suse.com/security/cve/CVE-2020-15979.html https://www.suse.com/security/cve/CVE-2020-15980.html https://www.suse.com/security/cve/CVE-2020-15981.html https://www.suse.com/security/cve/CVE-2020-15982.html https://www.suse.com/security/cve/CVE-2020-15983.html https://www.suse.com/security/cve/CVE-2020-15984.html https://www.suse.com/security/cve/CVE-2020-15985.html https://www.suse.com/security/cve/CVE-2020-15986.html https://www.suse.com/security/cve/CVE-2020-15987.html https://www.suse.com/security/cve/CVE-2020-15988.html https://www.suse.com/security/cve/CVE-2020-15989.html https://www.suse.com/security/cve/CVE-2020-15990.html https://www.suse.com/security/cve/CVE-2020-15991.html https://www.suse.com/security/cve/CVE-2020-15992.html https://www.suse.com/security/cve/CVE-2020-6557.html https://bugzilla.suse.com/1177408

1 0