November 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1796-1: moderate: Recommended update for xscreensaver
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for xscreensaver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1796-1 Rating: moderate References: #1101393 #1165170 #890595 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for xscreensaver fixes the following issues: - update to 5.44 (ECO-2755): * New hacks, gibson, etruscanvenus and scooter * BSOD supports Tivo and Nintendo * New color options in romanboy, projectiveplane, hypertorus and klein * Performance tweaks for eruption, fireworkx, halftone, halo, moire2, rd-bomb * X11: Always use $HOME/.xscreensaver, not getpwuid's directory * New hacks GravityWell, DeepStars, handsy. * GLPlanet now supports the Mercator projection. * Bouncing Cow has mathematically ideal cows. * Foggy toasters. * Unknown Pleasures can now use an image file as a clip mask. * Updated webcollage for recent changes. * Added some sample unlock dialog color schemes to the .ad file. * On systemd systems, closing your laptop lid actually lock your screen now. (bsc#1101393) * Lock after completing fade (bsc#1101393). * sonar can ping without being setuid by using setcap. * The new font-loading fallback heuristics work again. * Fixed `noof' from displaying minimalistically. * Rewrote `unknownpleasures' to be faster, and a true waterfall graph. * If the xscreensaver daemon is setuid, the screen wont be unlocked. * Fix a BadWindow error. (bsc#1165170) * Suspend/Resumes don't show the desktop content before loading the lock screen. (bsc#1101393) * No longer require Xxf86misc extension, which is no longer supported and it has been removed from Xserver years ago. * New hacks filmleader vfeedback glitchpeg, razzledazzle, peepers, crumbler, maze3d and esper. * webcollagenow works with ImageMagick. * Improvements of GLPlanet, DymaxionMap, Tessellimage, XAnalogTV. * More heuristics for using RSS feeds as image sources. * Built-in image assets are now PNG instead of XPM or XBM. * Better font-loading fallback. * In case of too old versions, the message will advise to open a bugreport. (bsc#890595). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1796=1 Package List: - openSUSE Leap 15.2 (x86_64): xscreensaver-5.44-lp152.6.3.1 xscreensaver-data-5.44-lp152.6.3.1 xscreensaver-data-debuginfo-5.44-lp152.6.3.1 xscreensaver-data-extra-5.44-lp152.6.3.1 xscreensaver-data-extra-debuginfo-5.44-lp152.6.3.1 xscreensaver-debuginfo-5.44-lp152.6.3.1 xscreensaver-debugsource-5.44-lp152.6.3.1 - openSUSE Leap 15.2 (noarch): xscreensaver-lang-5.44-lp152.6.3.1 References: https://bugzilla.suse.com/1101393 https://bugzilla.suse.com/1165170 https://bugzilla.suse.com/890595

1 0

openSUSE-RU-2020:1800-1: moderate: Recommended update for rubygem-railties-5_1
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for rubygem-railties-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1800-1 Rating: moderate References: #1174315 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rubygem-railties-5_1 fixes the following issue: - Fix rubygems dependencies for puma update and respect older version. (bnc#1174315) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1800=1 Package List: - openSUSE Leap 15.2 (x86_64): ruby2.5-rubygem-railties-5_1-5.1.4-lp152.4.3.1 ruby2.5-rubygem-railties-doc-5_1-5.1.4-lp152.4.3.1 References: https://bugzilla.suse.com/1174315

1 0

openSUSE-RU-2020:1797-1: moderate: Recommended update for sysconfig
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for sysconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1797-1 Rating: moderate References: #1173391 #1176285 #1176325 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sysconfig fixes the following issues: - Fix for 'netconfig' to run with a new library including fallback to the previous location. (bsc#1176285) - Fix for changing content of such files like '/etc/resolv.conf' to avoid linked applications re-read them and unnecessarily re-initializes themselves accordingly. (bsc#1176325) - Fix for 'chrony helper' calling in background. (bsc#1173391) - Fix for configuration file by creating a symlink for it to prevent false ownership on the file. (bsc#1159566) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1797=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): sysconfig-0.85.6-lp152.2.3.1 sysconfig-debuginfo-0.85.6-lp152.2.3.1 sysconfig-debugsource-0.85.6-lp152.2.3.1 sysconfig-netconfig-0.85.6-lp152.2.3.1 References: https://bugzilla.suse.com/1173391 https://bugzilla.suse.com/1176285 https://bugzilla.suse.com/1176325

1 0

openSUSE-SU-2020:1798-1: important: Security update for sane-backends
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for sane-backends ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1798-1 Rating: important References: #1172524 Cross-References: CVE-2020-12861 CVE-2020-12862 CVE-2020-12863 CVE-2020-12864 CVE-2020-12865 CVE-2020-12866 CVE-2020-12867 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for sane-backends fixes the following issues: sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues: - CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524) - CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524) - CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524) The upstream changelogs can be found here: - https://gitlab.com/sane-project/backends/-/releases/1.0.28 - https://gitlab.com/sane-project/backends/-/releases/1.0.29 - https://gitlab.com/sane-project/backends/-/releases/1.0.30 - https://gitlab.com/sane-project/backends/-/releases/1.0.31 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1798=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): sane-backends-1.0.31-lp152.7.3.1 sane-backends-autoconfig-1.0.31-lp152.7.3.1 sane-backends-debuginfo-1.0.31-lp152.7.3.1 sane-backends-debugsource-1.0.31-lp152.7.3.1 sane-backends-devel-1.0.31-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): sane-backends-32bit-1.0.31-lp152.7.3.1 sane-backends-32bit-debuginfo-1.0.31-lp152.7.3.1 sane-backends-devel-32bit-1.0.31-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-12861.html https://www.suse.com/security/cve/CVE-2020-12862.html https://www.suse.com/security/cve/CVE-2020-12863.html https://www.suse.com/security/cve/CVE-2020-12864.html https://www.suse.com/security/cve/CVE-2020-12865.html https://www.suse.com/security/cve/CVE-2020-12866.html https://www.suse.com/security/cve/CVE-2020-12867.html https://bugzilla.suse.com/1172524

1 0

openSUSE-SU-2020:1799-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1799-1 Rating: moderate References: #1177582 Cross-References: CVE-2020-13943 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1799=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.10.1 tomcat-admin-webapps-9.0.36-lp152.2.10.1 tomcat-docs-webapp-9.0.36-lp152.2.10.1 tomcat-el-3_0-api-9.0.36-lp152.2.10.1 tomcat-embed-9.0.36-lp152.2.10.1 tomcat-javadoc-9.0.36-lp152.2.10.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.10.1 tomcat-jsvc-9.0.36-lp152.2.10.1 tomcat-lib-9.0.36-lp152.2.10.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.10.1 tomcat-webapps-9.0.36-lp152.2.10.1 References: https://www.suse.com/security/cve/CVE-2020-13943.html https://bugzilla.suse.com/1177582

1 0

openSUSE-RU-2020:1795-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1795-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: strawberry was updated to version 0.8.2: * Bugfixes: + Fixed broken transition to next song for CUE files with certain audio formats (regression since version 0.6.13). + Fixed all collection divider keys showing on top with some language collate settings (regression in version 0.8.1). + Fixed SQL querying songs by song ID when song ID is a string. + Fixed saving album covers for LMS Subsonic servers. + Fixed reading song creation dates with LMS Subsonic servers. + Fixed saving initial settings. + Removed use of HTML in system tray icon tooltip for all desktop environments instead of just KDE and Cinnamon. Update to version 0.8.1: * Bugfixes: + Fixed engine selection in backend settings with Qt 6. + Fixed pixelated playlist source icon for currently playing song. + Fixed crash when deleting queued songs from playlist. + Fixed situations where songs could disappear or be shown multiple times with certain collection groupings. + Fixed initial sizes of playlist header columns. + Fixed Strawberry preventing logout. + Fixed incorrectly splitting of basename for moodbar and transcoding for filenames with several dots. + Fixed certain cases where "playing now" for scrobbler were sent twice. + Fixed album cover loaded twice for certain songs causing slugglish playing widget. + Fixed playing widget to draw text after album cover is fully shown. + Fixed crash when trying to copy a closed playlist to a device. + Fixed incorrect song source for CUE songs when added through the collection watcher. + Disable use of HTML in system tray tooltip on Cinnamon too. + Remove problematic '&' character from OSD messages. * Enhancements: + Improved playlist autoscrolling. + Only allow playlist right click tag editing for editable songs. + Read song creation time from subsonic API. + Remember manually set compilation status for albums when songs are rescanned. + Added icons for edit tag playlist right click menu actions. + Maximize dialogs if they are already open when clicked again in the menu. + Added support for compilation tag to edit tag dialog. + Show song info and album cover in OSD on stop and pause. + Reshow OSD on song restart. + Always save initial settings. + Removed use of deprecated gstreamer "low-percent" (Minimum buffer fill setting). + Added buffer low and high watermark settings to backend settings. + Make use of newer version of the desktop notifications service when available. * New features: + Added setting for enabling scrobbling based on song source. + Added optional delete from disk in collection and playlist. + Added Last.fm import data wizard. + Added smart and dynamic playlists. + Added song ratings. + Added Qobuz streaming support. + Added Subsonic server side scrobbling support. + Load thumbnails from iPods to show under device collection. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1795=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): strawberry-0.8.2-bp152.2.8.1 References:

1 0

openSUSE-SU-2020:1802-1: moderate: Security update for spice
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1802-1 Rating: moderate References: #1177158 Cross-References: CVE-2020-14355 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1802=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libspice-server-devel-0.14.2-lp152.2.3.1 libspice-server1-0.14.2-lp152.2.3.1 libspice-server1-debuginfo-0.14.2-lp152.2.3.1 spice-debugsource-0.14.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14355.html https://bugzilla.suse.com/1177158

1 0

openSUSE-RU-2020:1801-1: moderate: Recommended update for catatonit
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for catatonit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1801-1 Rating: moderate References: #1176155 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for catatonit fixes the following issues: - Fixes an issue when catatonit hangs when process dies in very specific way. (bsc#1176155) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1801=1 Package List: - openSUSE Leap 15.2 (x86_64): catatonit-0.1.5-lp152.4.3.1 catatonit-debuginfo-0.1.5-lp152.4.3.1 catatonit-debugsource-0.1.5-lp152.4.3.1 References: https://bugzilla.suse.com/1176155

1 0

openSUSE-SU-2020:1803-1: moderate: Security update for spice-gtk
by opensuse-security＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Security Update: Security update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1803-1 Rating: moderate References: #1177158 Cross-References: CVE-2020-14355 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice-gtk fixes the following issues: - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1803=1 Package List: - openSUSE Leap 15.2 (noarch): spice-gtk-lang-0.37-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libspice-client-glib-2_0-8-0.37-lp152.2.3.1 libspice-client-glib-2_0-8-debuginfo-0.37-lp152.2.3.1 libspice-client-glib-helper-0.37-lp152.2.3.1 libspice-client-glib-helper-debuginfo-0.37-lp152.2.3.1 libspice-client-gtk-3_0-5-0.37-lp152.2.3.1 libspice-client-gtk-3_0-5-debuginfo-0.37-lp152.2.3.1 spice-gtk-0.37-lp152.2.3.1 spice-gtk-debuginfo-0.37-lp152.2.3.1 spice-gtk-debugsource-0.37-lp152.2.3.1 spice-gtk-devel-0.37-lp152.2.3.1 typelib-1_0-SpiceClientGlib-2_0-0.37-lp152.2.3.1 typelib-1_0-SpiceClientGtk-3_0-0.37-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14355.html https://bugzilla.suse.com/1177158

1 0

openSUSE-RU-2020:1794-1: moderate: Recommended update for libsolv, libzypp, zypper
by maintenance＠opensuse.org 01 Nov '20

01 Nov '20

openSUSE Recommended Update: Recommended update for libsolv, libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1794-1 Rating: moderate References: #1174918 #1176192 #1176435 #1176712 #1176740 #1176902 #1177238 #935885 SLE-16271 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 8 recommended fixes and contains one feature can now be installed. Description: This update for libsolv, libzypp, zypper fixes the following issues: libzypp was updated to 17.25.1: - When kernel-rt has been installed, the purge-kernels service fails during boot. (bsc#1176902) - Use package name provides as group key in purge-kernel (bsc#1176740 bsc#1176192) kernel-default-base has new packaging, where the kernel uname -r does not reflect the full package version anymore. This patch adds additional logic to use the most generic/shortest edition each package provides with %{packagename}=<version> to group the kernel packages instead of the rpm versions. This also changes how the keep-spec for specific versions is applied, instead of matching the package versions, each of the package name provides will be matched. - RepoInfo: Return the type of the local metadata cache as fallback (bsc#1176435) - VendorAttr: Fix broken "suse,opensuse" equivalence handling. Enhance API and testcases. (bsc#1174918) - Update docs regarding 'opensuse' namepace matching. - Link against libzstd to close libsolvs open references (as we link statically) zypper was updated to 1.14.40: - info: Assume descriptions starting with '<p>' are richtext (bsc#935885) - help: prevent 'whatis' from writing to stderr (bsc#1176712) - wp: point out that command is aliased to a search command and searches case-insensitive (jsc#SLE-16271) libsolv was updated to 0.7.15 to fix: - make testcase_mangle_repo_names deal correctly with freed repos [bsc#1177238] - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1794=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsolv-debuginfo-0.7.15-lp152.2.10.1 libsolv-debugsource-0.7.15-lp152.2.10.1 libsolv-demo-0.7.15-lp152.2.10.1 libsolv-demo-debuginfo-0.7.15-lp152.2.10.1 libsolv-devel-0.7.15-lp152.2.10.1 libsolv-devel-debuginfo-0.7.15-lp152.2.10.1 libsolv-tools-0.7.15-lp152.2.10.1 libsolv-tools-debuginfo-0.7.15-lp152.2.10.1 libyaml-cpp0_6-0.6.1-lp152.5.2.1 libyaml-cpp0_6-debuginfo-0.6.1-lp152.5.2.1 libzypp-17.25.1-lp152.2.13.1 libzypp-debuginfo-17.25.1-lp152.2.13.1 libzypp-debugsource-17.25.1-lp152.2.13.1 libzypp-devel-17.25.1-lp152.2.13.1 libzypp-devel-doc-17.25.1-lp152.2.13.1 perl-solv-0.7.15-lp152.2.10.1 perl-solv-debuginfo-0.7.15-lp152.2.10.1 python-solv-0.7.15-lp152.2.10.1 python-solv-debuginfo-0.7.15-lp152.2.10.1 python3-solv-0.7.15-lp152.2.10.1 python3-solv-debuginfo-0.7.15-lp152.2.10.1 ruby-solv-0.7.15-lp152.2.10.1 ruby-solv-debuginfo-0.7.15-lp152.2.10.1 yaml-cpp-debugsource-0.6.1-lp152.5.2.1 yaml-cpp-devel-0.6.1-lp152.5.2.1 zypper-1.14.40-lp152.2.9.1 zypper-debuginfo-1.14.40-lp152.2.9.1 zypper-debugsource-1.14.40-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): zypper-aptitude-1.14.40-lp152.2.9.1 zypper-log-1.14.40-lp152.2.9.1 zypper-needs-restarting-1.14.40-lp152.2.9.1 References: https://bugzilla.suse.com/1174918 https://bugzilla.suse.com/1176192 https://bugzilla.suse.com/1176435 https://bugzilla.suse.com/1176712 https://bugzilla.suse.com/1176740 https://bugzilla.suse.com/1176902 https://bugzilla.suse.com/1177238 https://bugzilla.suse.com/935885

1 0