March 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0286-1: important: Security update for ppp
by opensuse-security＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Security Update: Security update for ppp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0286-1 Rating: important References: #1162610 Cross-References: CVE-2020-8597 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ppp fixes the following security issue: - CVE-2020-8597: Fixed a buffer overflow in the eap_request and eap_response functions (bsc#1162610). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-286=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ppp-2.4.7-lp151.5.3.1 ppp-debuginfo-2.4.7-lp151.5.3.1 ppp-debugsource-2.4.7-lp151.5.3.1 ppp-devel-2.4.7-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): ppp-modem-2.4.7-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-8597.html https://bugzilla.suse.com/1162610

1 0

openSUSE-RU-2020:0285-1: moderate: Recommended update for linuxrc
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for linuxrc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0285-1 Rating: moderate References: #1058039 #1163115 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for linuxrc fixes the following issues: - Move plymouthd start after screen size detection. (bsc#1163115) plymouthd is now started after the screen size detection for avoiding race conditions with linuxrc. This is because the screen size detection might potentially interfere with plymouthd as both linuxrc and plymouthd might try to read from the same serial line. - Iterate through the device list in sorted order. (bsc#1058039) When searching for the installation repository, linuxrc iterates through available local or network devices. As the devices were used in the order they appeared in sysfs, it was more or less random. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-285=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): linuxrc-6.0.12-lp151.2.3.1 linuxrc-debuginfo-6.0.12-lp151.2.3.1 linuxrc-debugsource-6.0.12-lp151.2.3.1 References: https://bugzilla.suse.com/1058039 https://bugzilla.suse.com/1163115

1 0

openSUSE-SU-2020:0284-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0284-1 Rating: important References: #1082318 #1101024 #1101139 #1122242 #1122243 #1122244 #1122245 #1122535 #1158990 #1158992 #1161297 #1163749 Cross-References: CVE-2009-4112 CVE-2018-20723 CVE-2018-20724 CVE-2018-20725 CVE-2018-20726 CVE-2019-16723 CVE-2019-17357 CVE-2019-17358 CVE-2020-7106 CVE-2020-7237 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine was updated to version 1.2.9. Security issues fixed: - CVE-2009-4112: Fixed a privilege escalation (bsc#1122535). - CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245). - CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244). - CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535). - CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242). - CVE-2019-16723: Fixed an authentication bypass vulnerability. - CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990). - CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992). - CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749). - CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297). Non-security issues fixed: - Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024). - Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-284=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.9-bp151.4.3.1 cacti-spine-debuginfo-1.2.9-bp151.4.3.1 cacti-spine-debugsource-1.2.9-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.9-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2009-4112.html https://www.suse.com/security/cve/CVE-2018-20723.html https://www.suse.com/security/cve/CVE-2018-20724.html https://www.suse.com/security/cve/CVE-2018-20725.html https://www.suse.com/security/cve/CVE-2018-20726.html https://www.suse.com/security/cve/CVE-2019-16723.html https://www.suse.com/security/cve/CVE-2019-17357.html https://www.suse.com/security/cve/CVE-2019-17358.html https://www.suse.com/security/cve/CVE-2020-7106.html https://www.suse.com/security/cve/CVE-2020-7237.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1101024 https://bugzilla.suse.com/1101139 https://bugzilla.suse.com/1122242 https://bugzilla.suse.com/1122243 https://bugzilla.suse.com/1122244 https://bugzilla.suse.com/1122245 https://bugzilla.suse.com/1122535 https://bugzilla.suse.com/1158990 https://bugzilla.suse.com/1158992 https://bugzilla.suse.com/1161297 https://bugzilla.suse.com/1163749

1 0

openSUSE-RU-2020:0283-1: moderate: Recommended update for python-ws4py
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for python-ws4py ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0283-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-ws4py fixes the following issues: - Fix license. Correct one is BSD-3-Clause. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-283=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python2-ws4py-0.4.2-bp151.4.3.1 python3-ws4py-0.4.2-bp151.4.3.1 References:

1 0

openSUSE-RU-2020:0282-1: moderate: Recommended update for policycoreutils
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for policycoreutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0282-1 Rating: moderate References: #1162674 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for policycoreutils fixes the following issues: - Prevent failures when loading seobject on systems without policies (bsc#1162674) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-282=1 Package List: - openSUSE Leap 15.1 (noarch): policycoreutils-lang-2.8-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): policycoreutils-2.8-lp151.4.6.1 policycoreutils-debuginfo-2.8-lp151.4.6.1 policycoreutils-debugsource-2.8-lp151.4.6.1 policycoreutils-devel-2.8-lp151.4.6.1 policycoreutils-newrole-2.8-lp151.4.6.1 policycoreutils-newrole-debuginfo-2.8-lp151.4.6.1 python3-policycoreutils-2.8-lp151.4.6.1 References: https://bugzilla.suse.com/1162674

1 0

openSUSE-RU-2020:0281-1: moderate: Recommended update for ndctl
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for ndctl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0281-1 Rating: moderate References: #1156308 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ndctl fixes the following issues: - Fix for init-labels mis-reporting success due to parsing issue of 'ndctl init-labels'. (bsc#1156308, ltc#181441) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-281=1 Package List: - openSUSE Leap 15.1 (x86_64): libndctl-devel-64.1-lp151.2.6.1 libndctl6-64.1-lp151.2.6.1 libndctl6-debuginfo-64.1-lp151.2.6.1 ndctl-64.1-lp151.2.6.1 ndctl-debuginfo-64.1-lp151.2.6.1 ndctl-debugsource-64.1-lp151.2.6.1 References: https://bugzilla.suse.com/1156308

1 0

openSUSE-RU-2020:0277-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0277-1 Rating: moderate References: #1160595 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for systemd fixes the following issues: - Remove TasksMax limit for both user and system slices (jsc#SLE-10123) - Backport IP filtering feature (jsc#SLE-7743 bsc#1160595) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-277=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libsystemd0-234-lp151.26.10.1 libsystemd0-debuginfo-234-lp151.26.10.1 libsystemd0-mini-234-lp151.26.10.1 libsystemd0-mini-debuginfo-234-lp151.26.10.1 libudev-devel-234-lp151.26.10.1 libudev-mini-devel-234-lp151.26.10.1 libudev-mini1-234-lp151.26.10.1 libudev-mini1-debuginfo-234-lp151.26.10.1 libudev1-234-lp151.26.10.1 libudev1-debuginfo-234-lp151.26.10.1 nss-myhostname-234-lp151.26.10.1 nss-myhostname-debuginfo-234-lp151.26.10.1 nss-mymachines-234-lp151.26.10.1 nss-mymachines-debuginfo-234-lp151.26.10.1 nss-systemd-234-lp151.26.10.1 nss-systemd-debuginfo-234-lp151.26.10.1 systemd-234-lp151.26.10.1 systemd-container-234-lp151.26.10.1 systemd-container-debuginfo-234-lp151.26.10.1 systemd-coredump-234-lp151.26.10.1 systemd-coredump-debuginfo-234-lp151.26.10.1 systemd-debuginfo-234-lp151.26.10.1 systemd-debugsource-234-lp151.26.10.1 systemd-devel-234-lp151.26.10.1 systemd-logger-234-lp151.26.10.1 systemd-mini-234-lp151.26.10.1 systemd-mini-container-mini-234-lp151.26.10.1 systemd-mini-container-mini-debuginfo-234-lp151.26.10.1 systemd-mini-coredump-mini-234-lp151.26.10.1 systemd-mini-coredump-mini-debuginfo-234-lp151.26.10.1 systemd-mini-debuginfo-234-lp151.26.10.1 systemd-mini-debugsource-234-lp151.26.10.1 systemd-mini-devel-234-lp151.26.10.1 systemd-mini-sysvinit-234-lp151.26.10.1 systemd-sysvinit-234-lp151.26.10.1 udev-234-lp151.26.10.1 udev-debuginfo-234-lp151.26.10.1 udev-mini-234-lp151.26.10.1 udev-mini-debuginfo-234-lp151.26.10.1 - openSUSE Leap 15.1 (noarch): systemd-bash-completion-234-lp151.26.10.1 systemd-mini-bash-completion-234-lp151.26.10.1 - openSUSE Leap 15.1 (x86_64): libsystemd0-32bit-234-lp151.26.10.1 libsystemd0-32bit-debuginfo-234-lp151.26.10.1 libudev-devel-32bit-234-lp151.26.10.1 libudev1-32bit-234-lp151.26.10.1 libudev1-32bit-debuginfo-234-lp151.26.10.1 nss-myhostname-32bit-234-lp151.26.10.1 nss-myhostname-32bit-debuginfo-234-lp151.26.10.1 nss-mymachines-32bit-234-lp151.26.10.1 nss-mymachines-32bit-debuginfo-234-lp151.26.10.1 systemd-32bit-234-lp151.26.10.1 systemd-32bit-debuginfo-234-lp151.26.10.1 References: https://bugzilla.suse.com/1160595

1 0

openSUSE-RU-2020:0280-1: moderate: Recommended update for cpupower
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for cpupower ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0280-1 Rating: moderate References: #1117709 #1141729 #1152967 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for cpupower fixes the following issues: - Fix for aperf/mperf monitoring on latest AMD Rome CPUs and prevent showing wrong CPU information. (bsc#1152967) - Fix for showing proper frequency information for all available CPUs. (bsc#1141729) - Fix for listing available CPU governors incompletely. (bsc#1117709) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-280=1 Package List: - openSUSE Leap 15.1 (x86_64): cpupower-4.19-lp151.2.3.1 cpupower-bench-4.19-lp151.2.3.1 cpupower-bench-debuginfo-4.19-lp151.2.3.1 cpupower-debuginfo-4.19-lp151.2.3.1 cpupower-debugsource-4.19-lp151.2.3.1 cpupower-devel-4.19-lp151.2.3.1 libcpupower0-4.19-lp151.2.3.1 libcpupower0-debuginfo-4.19-lp151.2.3.1 References: https://bugzilla.suse.com/1117709 https://bugzilla.suse.com/1141729 https://bugzilla.suse.com/1152967

1 0

openSUSE-SU-2020:0278-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0278-1 Rating: important References: #1159329 #1161719 #1163809 Cross-References: CVE-2019-8835 CVE-2019-8844 CVE-2019-8846 CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.26.4 fixes the following issues: Security issues fixed: - CVE-2019-8835: Fixed multiple memory corruption issues (bsc#1161719). - CVE-2019-8844: Fixed multiple memory corruption issues (bsc#1161719). - CVE-2019-8846: Fixed a use-after-free issue (bsc#1161719). - CVE-2020-3862: Fixed a memory handling issue (bsc#1163809). - CVE-2020-3864: Fixed a logic issue in the DOM object context handling (bsc#1163809). - CVE-2020-3865: Fixed a logic issue in the DOM object context handling (bsc#1163809). - CVE-2020-3867: Fixed an XSS issue (bsc#1163809). - CVE-2020-3868: Fixed multiple memory corruption issues that could have lead to arbitrary code execution (bsc#1163809). Non-security issues fixed: - Fixed issues while trying to play a video on NextCloud. - Fixed vertical alignment of text containing arabic diacritics. - Fixed build with icu 65.1. - Fixed page loading errors with websites using HSTS. - Fixed web process crash when displaying a KaTeX formula. - Fixed several crashes and rendering issues. - Switched to a single web process for Evolution and geary (bsc#1159329 glgo#GNOME/evolution#587). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-278=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.26.4-lp151.2.12.1 libjavascriptcoregtk-4_0-18-debuginfo-2.26.4-lp151.2.12.1 libwebkit2gtk-4_0-37-2.26.4-lp151.2.12.1 libwebkit2gtk-4_0-37-debuginfo-2.26.4-lp151.2.12.1 typelib-1_0-JavaScriptCore-4_0-2.26.4-lp151.2.12.1 typelib-1_0-WebKit2-4_0-2.26.4-lp151.2.12.1 typelib-1_0-WebKit2WebExtension-4_0-2.26.4-lp151.2.12.1 webkit-jsc-4-2.26.4-lp151.2.12.1 webkit-jsc-4-debuginfo-2.26.4-lp151.2.12.1 webkit2gtk-4_0-injected-bundles-2.26.4-lp151.2.12.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.26.4-lp151.2.12.1 webkit2gtk3-debugsource-2.26.4-lp151.2.12.1 webkit2gtk3-devel-2.26.4-lp151.2.12.1 webkit2gtk3-minibrowser-2.26.4-lp151.2.12.1 webkit2gtk3-minibrowser-debuginfo-2.26.4-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.26.4-lp151.2.12.1 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.26.4-lp151.2.12.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.4-lp151.2.12.1 libwebkit2gtk-4_0-37-32bit-2.26.4-lp151.2.12.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.4-lp151.2.12.1 References: https://www.suse.com/security/cve/CVE-2019-8835.html https://www.suse.com/security/cve/CVE-2019-8844.html https://www.suse.com/security/cve/CVE-2019-8846.html https://www.suse.com/security/cve/CVE-2020-3862.html https://www.suse.com/security/cve/CVE-2020-3864.html https://www.suse.com/security/cve/CVE-2020-3865.html https://www.suse.com/security/cve/CVE-2020-3867.html https://www.suse.com/security/cve/CVE-2020-3868.html https://bugzilla.suse.com/1159329 https://bugzilla.suse.com/1161719 https://bugzilla.suse.com/1163809

1 0

openSUSE-RU-2020:0279-1: moderate: Recommended update for aaa_base
by maintenance＠opensuse.org 02 Mar '20

02 Mar '20

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0279-1 Rating: moderate References: #1160735 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for aaa_base fixes the following issues: - Change 'rp_filter' to increase the default priority to ethernet over the wifi. (bsc#1160735) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-279=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp151.5.21.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp151.5.21.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp151.5.21.1 aaa_base-extras-84.87+git20180409.04c9dae-lp151.5.21.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp151.5.21.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp151.5.21.1 References: https://bugzilla.suse.com/1160735

1 0