December 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:2348-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2348-1 Rating: moderate References: #1180099 #1180112 Cross-References: CVE-2020-0487 CVE-2020-0499 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for flac fixes the following issues: - CVE-2020-0487: Fixed a memory leak (bsc#1180112). - CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2348=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): flac-1.3.2-lp151.4.3.1 flac-debuginfo-1.3.2-lp151.4.3.1 flac-debugsource-1.3.2-lp151.4.3.1 flac-devel-1.3.2-lp151.4.3.1 libFLAC++6-1.3.2-lp151.4.3.1 libFLAC++6-debuginfo-1.3.2-lp151.4.3.1 libFLAC8-1.3.2-lp151.4.3.1 libFLAC8-debuginfo-1.3.2-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): flac-devel-32bit-1.3.2-lp151.4.3.1 libFLAC++6-32bit-1.3.2-lp151.4.3.1 libFLAC++6-32bit-debuginfo-1.3.2-lp151.4.3.1 libFLAC8-32bit-1.3.2-lp151.4.3.1 libFLAC8-32bit-debuginfo-1.3.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): flac-doc-1.3.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-0487.html https://www.suse.com/security/cve/CVE-2020-0499.html https://bugzilla.suse.com/1180099 https://bugzilla.suse.com/1180112

1 0

openSUSE-RU-2020:2347-1: moderate: Recommended update for python3-ec2imgutils
by maintenance＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Recommended Update: Recommended update for python3-ec2imgutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2347-1 Rating: moderate References: #1179890 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-ec2imgutils contains the following fix: - Update to version 9.0.1 (bsc#1179890) + Support gp3 as option to create EBS root volume. This allows image creation with the new storage class and save 20% of cost. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2347=1 Package List: - openSUSE Leap 15.1 (noarch): python3-ec2imgutils-9.0.1-lp151.2.18.1 References: https://bugzilla.suse.com/1179890

1 0

openSUSE-RU-2020:2346-1: moderate: Recommended update for budgie-desktop
by maintenance＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Recommended Update: Recommended update for budgie-desktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2346-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for budgie-desktop fixes the following issues: - openSUSE Leap 15.3 fixes. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2346=1 Package List: - openSUSE Leap 15.2 (x86_64): budgie-desktop-10.5.1+1ed6276b-lp152.8.1 budgie-desktop-debuginfo-10.5.1+1ed6276b-lp152.8.1 budgie-desktop-debugsource-10.5.1+1ed6276b-lp152.8.1 budgie-desktop-devel-10.5.1+1ed6276b-lp152.8.1 budgie-desktop-doc-10.5.1+1ed6276b-lp152.8.1 libbudgie-plugin0-10.5.1+1ed6276b-lp152.8.1 libbudgie-plugin0-debuginfo-10.5.1+1ed6276b-lp152.8.1 libbudgie-private0-10.5.1+1ed6276b-lp152.8.1 libbudgie-private0-debuginfo-10.5.1+1ed6276b-lp152.8.1 libbudgietheme0-10.5.1+1ed6276b-lp152.8.1 libbudgietheme0-debuginfo-10.5.1+1ed6276b-lp152.8.1 libraven0-10.5.1+1ed6276b-lp152.8.1 libraven0-debuginfo-10.5.1+1ed6276b-lp152.8.1 typelib-1_0-Budgie-1_0-10.5.1+1ed6276b-lp152.8.1 - openSUSE Leap 15.2 (noarch): budgie-desktop-lang-10.5.1+1ed6276b-lp152.8.1 References:

1 0

openSUSE-RU-2020:2345-1: moderate: Recommended update for v4l2loopback
by maintenance＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Recommended Update: Recommended update for v4l2loopback ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2345-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for v4l2loopback fixes the following issues: - add -autoload subpackages that provides the configuration files to autoload the driver on startup - Fixup util dependencies: pull in required vl42-ctl for v4l2loopback-ctl, recommend gst-launch, supplement kernel module (v4l2loopback.ko). - Make util package noarch, its just a shell script. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2345=1 Package List: - openSUSE Leap 15.2 (x86_64): v4l2loopback-debugsource-0.12.5-lp152.2.5.1 v4l2loopback-kmp-default-debuginfo-0.12.5_k5.3.18_lp152.57-lp152.2.5.1 v4l2loopback-kmp-preempt-debuginfo-0.12.5_k5.3.18_lp152.57-lp152.2.5.1 - openSUSE Leap 15.2 (noarch): v4l2loopback-autoload-0.12.5-lp152.2.5.1 v4l2loopback-kmp-default-0.12.5_k5.3.18_lp152.57-lp152.2.5.1 v4l2loopback-kmp-preempt-0.12.5_k5.3.18_lp152.57-lp152.2.5.1 v4l2loopback-utils-0.12.5-lp152.2.5.1 References:

1 0

openSUSE-SU-2020:2344-1: Security update for PackageKit
by opensuse-security＠opensuse.org 27 Dec '20

27 Dec '20

openSUSE Security Update: Security update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2344-1 Rating: low References: #1104313 #1176930 Cross-References: CVE-2020-16121 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for PackageKit fixes the following issue: - CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930). - Update summary and description of gstreamer-plugin and gtk3-module. (bsc#1104313) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2344=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): PackageKit-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-1.1.13-lp152.3.15.1 PackageKit-backend-dnf-debuginfo-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-1.1.13-lp152.3.15.1 PackageKit-backend-zypp-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debuginfo-1.1.13-lp152.3.15.1 PackageKit-debugsource-1.1.13-lp152.3.15.1 PackageKit-devel-1.1.13-lp152.3.15.1 PackageKit-devel-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-1.1.13-lp152.3.15.1 PackageKit-gstreamer-plugin-debuginfo-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-1.1.13-lp152.3.15.1 PackageKit-gtk3-module-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-1.1.13-lp152.3.15.1 typelib-1_0-PackageKitGlib-1_0-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (x86_64): libpackagekit-glib2-18-32bit-1.1.13-lp152.3.15.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.13-lp152.3.15.1 libpackagekit-glib2-devel-32bit-1.1.13-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): PackageKit-branding-upstream-1.1.13-lp152.3.15.1 PackageKit-lang-1.1.13-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-16121.html https://bugzilla.suse.com/1104313 https://bugzilla.suse.com/1176930

1 0

openSUSE-SU-2020:2336-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2336-1 Rating: moderate References: #1177789 Cross-References: CVE-2019-14584 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: - CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2336=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp151.11.12.1 ovmf-tools-2017+git1510945757.b2662641d5-lp151.11.12.1 - openSUSE Leap 15.1 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp151.11.12.1 - openSUSE Leap 15.1 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp151.11.12.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp151.11.12.1 References: https://www.suse.com/security/cve/CVE-2019-14584.html https://bugzilla.suse.com/1177789

1 0

openSUSE-RU-2020:2342-1: moderate: Recommended update for mutt
by maintenance＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Recommended Update: Recommended update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2342-1 Rating: moderate References: #1179461 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mutt fixes the following issues: - Add a further correction in for external bodies as well. (bsc#1179461) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2342=1 Package List: - openSUSE Leap 15.2 (noarch): mutt-doc-1.10.1-lp152.3.12.1 mutt-lang-1.10.1-lp152.3.12.1 - openSUSE Leap 15.2 (x86_64): mutt-1.10.1-lp152.3.12.1 mutt-debuginfo-1.10.1-lp152.3.12.1 mutt-debugsource-1.10.1-lp152.3.12.1 References: https://bugzilla.suse.com/1179461

1 0

openSUSE-RU-2020:2340-1: moderate: Recommended update for mutt
by maintenance＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Recommended Update: Recommended update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2340-1 Rating: moderate References: #1179461 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mutt fixes the following issues: - Add a further correction in for external bodies as well. (bsc#1179461) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2340=1 Package List: - openSUSE Leap 15.1 (x86_64): mutt-1.10.1-lp151.2.12.1 mutt-debuginfo-1.10.1-lp151.2.12.1 mutt-debugsource-1.10.1-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): mutt-doc-1.10.1-lp151.2.12.1 mutt-lang-1.10.1-lp151.2.12.1 References: https://bugzilla.suse.com/1179461

1 0

openSUSE-SU-2020:2337-1: moderate: Security update for blosc
by opensuse-security＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Security Update: Security update for blosc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2337-1 Rating: moderate References: #1174075 #1179914 Cross-References: CVE-2020-29367 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for blosc fixes the following issues: Update to version 1.20.1 boo#1179914 CVE-2020-29367: * More saftey checks have been implemented so that potential flaws discovered by new fuzzers in OSS-Fuzzer are fixed now * BloscLZ updated to 2.3.0. Expect better compression ratios for faster codecs. For details, see our new blog post: https://blosc.org/posts/beast-release/ * Fixed the _xgetbv() collision. Thanks to Micha�� G��rny (@mgorny). Update to version 1.19.0: * The length of automatic blocksizes for fast codecs (lz4, blosclz) has been incremented quite a bit (up to 256 KB) for better compression ratios. * The performance in modern CPUs (with at least 256 KB in L2 cache) should be better too (for older CPUs the performance should stay roughly the same). * For small buffers that cannot be compressed (typically < 128 bytes), blosc_compress() returns now a 0 (cannot compress) instead of a negative number (internal error). See #294. * blosclz codec updated to 2.1.0. Expect better compression ratios and performance in a wider variety of scenarios. * blosc_decompress_unsafe(), blosc_decompress_ctx_unsafe() and blosc_getitem_unsafe() have been removed because they are dangerous and after latest improvements, they should not be used in production. Update to version 1.18.1: * Fixed the copy of the leftovers of a chunk when its size is not a multiple of the typesize. Update to version 1.17.1: * BloscLZ codec updated to 2.0.0. Update to version 1.16.3: * Fix for building for clang with -march=haswell. See PR #262. * Fix all the known warnings for GCC/Clang. Still some work to do for MSVC in this front. * Due to some problems with several CI systems, the check for library symbols are deactivated now by default. If you want to enforce this check, use: cmake .. -DDEACTIVATE_SYMBOLS_CHECK=ON to re-activate it. * Correct the check for the compressed size when the buffer is memcpyed. This was a regression introduced in 1.16.0. Fixes #261. * Fixed a regression in 1.16.0 that prevented to compress empty buffers (see #260). * Now the functions that execute Blosc decompressions are safe by default for untrusted/possibly corrupted inputs. * The previous functions (with less safety) checks are still available with a '_unsafe' suffix. The complete list is: * Also, a new API function named blosc_cbuffer_validate(), for validating Blosc compressed data, has been added. * For details, see PR #258. Thanks to Jeremy Maitin-Shepard. * Fixed a bug in blosc_compress() that could lead to thread deadlock under some situations. See #251. Thanks to @wenjuno for the report and the fix. * Fix data race in shuffle.c host_implementation initialization. Fixes #253. Thanks to Jeremy Maitin-Shepard. * Add workaround for Visual Studio 2008's lack of a stdint.h file to blosclz.c. * Replaced //-comments with /**/-comments and other improvements for compatibility with quite old gcc compilers. See PR #243. Thanks to Andreas Martin. * Empty buffers can be compressed again (this was unadvertedly prevented while fixing #234). See #247. Thanks to Valentin Haenel. Update to version 1.14.4: * Added a new DEACTIVATE_SSE2 option for cmake that is useful for disabling SSE2 when doing cross-compilation (see #236). * New check for detecting output buffers smaller than BLOSC_MAX_OVERHEAD. * The complib and version parameters for blosc_get_complib_info() can be safely set to NULL now. This allows to call this function even if the user is not interested in these parameters (so no need to reserve memory for them). * In some situations that a supposedly blosc chunk is passed to blosc_decompress(), one might end with an Arithmetic exception. This is probably due to the chunk not being an actual blosc chunk, and divisions by zero might occur. A protection has been added for this. Update to version 1.14.3: * Fixed a bug that caused C-Blosc to crash on platforms requiring strict alignment. * Fixed a piece of code that was not C89 compliant. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-2337=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-2337=1 Package List: - openSUSE Leap 15.2 (x86_64): blosc-debugsource-1.20.1-lp152.4.3.1 blosc-devel-1.20.1-lp152.4.3.1 libblosc1-1.20.1-lp152.4.3.1 libblosc1-debuginfo-1.20.1-lp152.4.3.1 - openSUSE Leap 15.1 (x86_64): blosc-debugsource-1.20.1-lp151.3.3.1 blosc-devel-1.20.1-lp151.3.3.1 libblosc1-1.20.1-lp151.3.3.1 libblosc1-debuginfo-1.20.1-lp151.3.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): blosc-debugsource-1.20.1-bp152.4.3.1 blosc-devel-1.20.1-bp152.4.3.1 libblosc1-1.20.1-bp152.4.3.1 libblosc1-debuginfo-1.20.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): blosc-devel-1.20.1-bp151.4.3.1 libblosc1-1.20.1-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-29367.html https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1179914

1 0

openSUSE-RU-2020:2338-1: Recommended update for libpwquality
by maintenance＠opensuse.org 26 Dec '20

26 Dec '20

openSUSE Recommended Update: Recommended update for libpwquality ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:2338-1 Rating: low References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for libpwquality fixes the following issues: - Implement alignment with 'pam_cracklib'. (jsc#SLE-16720) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-2338=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpwquality-debugsource-1.4.4-lp151.3.3.1 libpwquality-devel-1.4.4-lp151.3.3.1 libpwquality-tools-1.4.4-lp151.3.3.1 libpwquality-tools-debuginfo-1.4.4-lp151.3.3.1 libpwquality1-1.4.4-lp151.3.3.1 libpwquality1-debuginfo-1.4.4-lp151.3.3.1 pam_pwquality-1.4.4-lp151.3.3.1 pam_pwquality-debuginfo-1.4.4-lp151.3.3.1 python2-pwquality-1.4.4-lp151.3.3.1 python2-pwquality-debuginfo-1.4.4-lp151.3.3.1 python3-pwquality-1.4.4-lp151.3.3.1 python3-pwquality-debuginfo-1.4.4-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): libpwquality-lang-1.4.4-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libpwquality1-32bit-1.4.4-lp151.3.3.1 libpwquality1-32bit-debuginfo-1.4.4-lp151.3.3.1 pam_pwquality-32bit-1.4.4-lp151.3.3.1 pam_pwquality-32bit-debuginfo-1.4.4-lp151.3.3.1 References:

1 0