March 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0379-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0379-1 Rating: moderate References: #1159003 #1166481 Cross-References: CVE-2019-18802 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 (bsc#1166481) - lib: Add nghttp2_check_authority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static and dynamic lib - build: Add new flag ENABLE_STATIC_CRT for Windows - build: cmake: Support building nghttpx with systemd - third-party: Update neverbleed to fix memory leak - nghttpx: Fix bug that mruby is incorrectly shared between backends - nghttpx: Reconnect h1 backend if it lost connection before sending headers - nghttpx: Returns 408 if backend timed out before sending headers - nghttpx: Fix request stal This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-379=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libnghttp2-14-1.40.0-lp151.3.6.1 libnghttp2-14-debuginfo-1.40.0-lp151.3.6.1 libnghttp2-devel-1.40.0-lp151.3.6.1 libnghttp2_asio-devel-1.40.0-lp151.3.6.1 libnghttp2_asio1-1.40.0-lp151.3.6.1 libnghttp2_asio1-debuginfo-1.40.0-lp151.3.6.1 nghttp2-1.40.0-lp151.3.6.1 nghttp2-debuginfo-1.40.0-lp151.3.6.1 nghttp2-debugsource-1.40.0-lp151.3.6.1 nghttp2-python-debugsource-1.40.0-lp151.3.6.1 python3-nghttp2-1.40.0-lp151.3.6.1 python3-nghttp2-debuginfo-1.40.0-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): libnghttp2-14-32bit-1.40.0-lp151.3.6.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp151.3.6.1 libnghttp2_asio1-32bit-1.40.0-lp151.3.6.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-18802.html https://bugzilla.suse.com/1159003 https://bugzilla.suse.com/1166481

1 0

openSUSE-RU-2020:0378-1: moderate: Recommended update for pari-elldata
by maintenance＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Recommended Update: Recommended update for pari-elldata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0378-1 Rating: moderate References: #1106378 #1165480 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for pari-elldata fixes the following issues: Update to release 20190912 * No changelog was provided - Strip /data/ subdirectory [boo#1106378,boo#1165480] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-378=1 Package List: - openSUSE Leap 15.1 (noarch): pari-elldata-20190912-lp151.3.3.1 References: https://bugzilla.suse.com/1106378 https://bugzilla.suse.com/1165480

1 0

openSUSE-SU-2020:0381-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0381-1 Rating: moderate References: #1163184 #1164505 #1165784 Cross-References: CVE-2020-10029 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2020-10029: Fixed a potential overflow in on-stack buffer during range reduction (bsc#1165784). - Fixed an issue where pthread were not always locked correctly (bsc#1164505). - Document mprotect and introduce section on memory protection (bsc#1163184). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-381=1 Package List: - openSUSE Leap 15.1 (i586 i686 x86_64): glibc-2.26-lp151.19.3.1 glibc-debuginfo-2.26-lp151.19.3.1 glibc-debugsource-2.26-lp151.19.3.1 glibc-devel-2.26-lp151.19.3.1 glibc-devel-debuginfo-2.26-lp151.19.3.1 glibc-devel-static-2.26-lp151.19.3.1 glibc-locale-2.26-lp151.19.3.1 glibc-locale-base-2.26-lp151.19.3.1 glibc-locale-base-debuginfo-2.26-lp151.19.3.1 glibc-profile-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (i586 x86_64): glibc-extra-2.26-lp151.19.3.1 glibc-extra-debuginfo-2.26-lp151.19.3.1 glibc-utils-2.26-lp151.19.3.1 glibc-utils-debuginfo-2.26-lp151.19.3.1 glibc-utils-src-debugsource-2.26-lp151.19.3.1 nscd-2.26-lp151.19.3.1 nscd-debuginfo-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (noarch): glibc-html-2.26-lp151.19.3.1 glibc-i18ndata-2.26-lp151.19.3.1 glibc-info-2.26-lp151.19.3.1 - openSUSE Leap 15.1 (x86_64): glibc-32bit-2.26-lp151.19.3.1 glibc-32bit-debuginfo-2.26-lp151.19.3.1 glibc-devel-32bit-2.26-lp151.19.3.1 glibc-devel-32bit-debuginfo-2.26-lp151.19.3.1 glibc-devel-static-32bit-2.26-lp151.19.3.1 glibc-locale-base-32bit-2.26-lp151.19.3.1 glibc-locale-base-32bit-debuginfo-2.26-lp151.19.3.1 glibc-profile-32bit-2.26-lp151.19.3.1 glibc-utils-32bit-2.26-lp151.19.3.1 glibc-utils-32bit-debuginfo-2.26-lp151.19.3.1 References: https://www.suse.com/security/cve/CVE-2020-10029.html https://bugzilla.suse.com/1163184 https://bugzilla.suse.com/1164505 https://bugzilla.suse.com/1165784

1 0

openSUSE-SU-2020:0382-1: moderate: Security update for mcpp
by opensuse-security＠opensuse.org 25 Mar '20

25 Mar '20

openSUSE Security Update: Security update for mcpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0382-1 Rating: moderate References: #1143032 Cross-References: CVE-2019-14274 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mcpp fixes the following issues: - CVE-2019-14274: Fixed a heap-based buffer overflow in the do_msg() (boo#1143032) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-382=1 Package List: - openSUSE Leap 15.1 (x86_64): libmcpp0-2.7.2-lp151.3.3.1 libmcpp0-debuginfo-2.7.2-lp151.3.3.1 mcpp-2.7.2-lp151.3.3.1 mcpp-debuginfo-2.7.2-lp151.3.3.1 mcpp-debugsource-2.7.2-lp151.3.3.1 mcpp-devel-2.7.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14274.html https://bugzilla.suse.com/1143032

1 0

openSUSE-RU-2020:0373-1: moderate: Recommended update for kaffeine
by maintenance＠opensuse.org 24 Mar '20

24 Mar '20

openSUSE Recommended Update: Recommended update for kaffeine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0373-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kaffeine fixes the following issues: Update to 2.0.18: * mediawidget: Override DVD keys instead of changing their settings (kde#394076) * mediawidget: warn user to use keys for DVD menu * mediawidget: remove a now unneeded check * mediawidget: fix video position movement with mouse wheel * mediawidget: fix the mouse wheel behavior at the streaming window * vlc: with vlc 2.x, use vlcMedia for libvlc_MediaMetaChanged event (kde#407153) * vlc: fix support for vlc 2.x (kde#407153) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-373=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): kaffeine-lang-2.0.18-bp151.3.3.2 - openSUSE Backports SLE-15-SP1 (x86_64): kaffeine-2.0.18-bp151.3.3.2 References:

1 0

openSUSE-RU-2020:0372-1: moderate: Recommended update for skelcd-control-openSUSE
by maintenance＠opensuse.org 24 Mar '20

24 Mar '20

openSUSE Recommended Update: Recommended update for skelcd-control-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0372-1 Rating: moderate References: #1162320 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for skelcd-control-openSUSE fixes the following issues: - Add /boot/grub2/arm64-efi subvolume for all roles (boo#1162320). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-372=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): skelcd-control-openSUSE-15.1.19-bp151.2.3.1 skelcd-control-openSUSE-promo-15.1.19-bp151.2.3.1 References: https://bugzilla.suse.com/1162320

1 0

openSUSE-SU-2020:0368-1: moderate: Security update for texlive-filesystem
by opensuse-security＠opensuse.org 23 Mar '20

23 Mar '20

openSUSE Security Update: Security update for texlive-filesystem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0368-1 Rating: moderate References: #1150556 #1155381 #1158910 #1159740 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for texlive-filesystem fixes the following issues: Security issues fixed: - Changed default user for ls-R files and font cache directories to user nobody (bsc#1159740) - Switched to rm instead of safe-rm or safe-rmdir to avoid race conditions (bsc#1158910) . - Made cron script more failsafe (bsc#1150556) Non-security issue fixed: - Refreshed font map files on update (bsc#1155381) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-368=1 Package List: - openSUSE Leap 15.1 (noarch): texlive-collection-basic-2017.135.svn41616-lp151.8.3.1 texlive-collection-bibtexextra-2017.135.svn44385-lp151.8.3.1 texlive-collection-binextra-2017.135.svn44515-lp151.8.3.1 texlive-collection-context-2017.135.svn42330-lp151.8.3.1 texlive-collection-fontsextra-2017.135.svn43356-lp151.8.3.1 texlive-collection-fontsrecommended-2017.135.svn35830-lp151.8.3.1 texlive-collection-fontutils-2017.135.svn37105-lp151.8.3.1 texlive-collection-formatsextra-2017.135.svn44177-lp151.8.3.1 texlive-collection-games-2017.135.svn42992-lp151.8.3.1 texlive-collection-humanities-2017.135.svn42268-lp151.8.3.1 texlive-collection-langarabic-2017.135.svn44496-lp151.8.3.1 texlive-collection-langchinese-2017.135.svn42675-lp151.8.3.1 texlive-collection-langcjk-2017.135.svn43009-lp151.8.3.1 texlive-collection-langcyrillic-2017.135.svn44401-lp151.8.3.1 texlive-collection-langczechslovak-2017.135.svn32550-lp151.8.3.1 texlive-collection-langenglish-2017.135.svn43650-lp151.8.3.1 texlive-collection-langeuropean-2017.135.svn44414-lp151.8.3.1 texlive-collection-langfrench-2017.135.svn40375-lp151.8.3.1 texlive-collection-langgerman-2017.135.svn42045-lp151.8.3.1 texlive-collection-langgreek-2017.135.svn44192-lp151.8.3.1 texlive-collection-langitalian-2017.135.svn30372-lp151.8.3.1 texlive-collection-langjapanese-2017.135.svn44554-lp151.8.3.1 texlive-collection-langkorean-2017.135.svn42106-lp151.8.3.1 texlive-collection-langother-2017.135.svn44414-lp151.8.3.1 texlive-collection-langpolish-2017.135.svn44371-lp151.8.3.1 texlive-collection-langportuguese-2017.135.svn30962-lp151.8.3.1 texlive-collection-langspanish-2017.135.svn40587-lp151.8.3.1 texlive-collection-latex-2017.135.svn41614-lp151.8.3.1 texlive-collection-latexextra-2017.135.svn44544-lp151.8.3.1 texlive-collection-latexrecommended-2017.135.svn44177-lp151.8.3.1 texlive-collection-luatex-2017.135.svn44500-lp151.8.3.1 texlive-collection-mathscience-2017.135.svn44396-lp151.8.3.1 texlive-collection-metapost-2017.135.svn44297-lp151.8.3.1 texlive-collection-music-2017.135.svn40561-lp151.8.3.1 texlive-collection-pictures-2017.135.svn44395-lp151.8.3.1 texlive-collection-plaingeneric-2017.135.svn44177-lp151.8.3.1 texlive-collection-pstricks-2017.135.svn44460-lp151.8.3.1 texlive-collection-publishers-2017.135.svn44485-lp151.8.3.1 texlive-collection-xetex-2017.135.svn43059-lp151.8.3.1 texlive-devel-2017.135-lp151.8.3.1 texlive-extratools-2017.135-lp151.8.3.1 texlive-filesystem-2017.135-lp151.8.3.1 texlive-scheme-basic-2017.135.svn25923-lp151.8.3.1 texlive-scheme-context-2017.135.svn35799-lp151.8.3.1 texlive-scheme-full-2017.135.svn44177-lp151.8.3.1 texlive-scheme-gust-2017.135.svn44177-lp151.8.3.1 texlive-scheme-infraonly-2017.135.svn41515-lp151.8.3.1 texlive-scheme-medium-2017.135.svn44177-lp151.8.3.1 texlive-scheme-minimal-2017.135.svn13822-lp151.8.3.1 texlive-scheme-small-2017.135.svn41825-lp151.8.3.1 texlive-scheme-tetex-2017.135.svn44187-lp151.8.3.1 References: https://bugzilla.suse.com/1150556 https://bugzilla.suse.com/1155381 https://bugzilla.suse.com/1158910 https://bugzilla.suse.com/1159740

1 0

openSUSE-RU-2020:0370-1: moderate: Recommended update for xen
by maintenance＠opensuse.org 23 Mar '20

23 Mar '20

openSUSE Recommended Update: Recommended update for xen ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0370-1 Rating: moderate References: #1027519 #1162040 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xen fixes the following issues: - Booting Fedora31 VM on SLES-15-SP1 Xen Domain 0. (bsc#1162040) This solve a Grub2ConfigFile issue with a wrong handling of next and saved entries. - Update to Xen 4.12.2 including upstream fixes (bsc#1027519) This update will also clear stubs.addr and stubs.mfn in order to allocate a new stub page when needed, whether the CPU gets parked or removed. Event channels are the basic primitive provided by Xen for event notifications. This fix will also improve the event channel handling. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-370=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.2_02-lp151.2.12.1 xen-devel-4.12.2_02-lp151.2.12.1 xen-libs-4.12.2_02-lp151.2.12.1 xen-libs-debuginfo-4.12.2_02-lp151.2.12.1 xen-tools-domU-4.12.2_02-lp151.2.12.1 xen-tools-domU-debuginfo-4.12.2_02-lp151.2.12.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.2_02-lp151.2.12.1 xen-doc-html-4.12.2_02-lp151.2.12.1 xen-libs-32bit-4.12.2_02-lp151.2.12.1 xen-libs-32bit-debuginfo-4.12.2_02-lp151.2.12.1 xen-tools-4.12.2_02-lp151.2.12.1 xen-tools-debuginfo-4.12.2_02-lp151.2.12.1 References: https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1162040

1 0

openSUSE-RU-2020:0369-1: moderate: Recommended update for bcache-tools
by maintenance＠opensuse.org 23 Mar '20

23 Mar '20

openSUSE Recommended Update: Recommended update for bcache-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0369-1 Rating: moderate References: #1139948 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bcache-tools fixes the following issues: - Fix failure by using 'lvm lv' to create a bcache device. (bsc#1139948) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-369=1 Package List: - openSUSE Leap 15.1 (x86_64): bcache-tools-1.0.9-lp151.2.3.1 bcache-tools-debuginfo-1.0.9-lp151.2.3.1 bcache-tools-debugsource-1.0.9-lp151.2.3.1 References: https://bugzilla.suse.com/1139948

1 0

openSUSE-RU-2020:0367-1: moderate: Recommended update for calamares
by maintenance＠opensuse.org 23 Mar '20

23 Mar '20

openSUSE Recommended Update: Recommended update for calamares ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0367-1 Rating: moderate References: #1164072 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calamares fixes the following issues: Use kdesu to start Calamares: - xdg-su may autoselect gnomesu which fails (boo#1164072); - pkexec may have theme issues. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-367=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): calamares-3.2.15-bp151.4.9.5 calamares-webview-3.2.15-bp151.4.9.5 - openSUSE Backports SLE-15-SP1 (noarch): calamares-branding-upstream-3.2.15-bp151.4.9.5 References: https://bugzilla.suse.com/1164072

1 0