April 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0556-1: important: Recommended update for corosync
by maintenance＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Recommended Update: Recommended update for corosync ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0556-1 Rating: important References: #1168771 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for corosync fixes the following issues: - Revert the change done for bsc#1163460, which caused interoperability problems between different versions of corosync, such as during a rolling upgrade (bsc#1168771) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-556=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): corosync-2.4.4-lp151.5.6.1 corosync-debuginfo-2.4.4-lp151.5.6.1 corosync-debugsource-2.4.4-lp151.5.6.1 corosync-qdevice-2.4.4-lp151.5.6.1 corosync-qdevice-debuginfo-2.4.4-lp151.5.6.1 corosync-qnetd-2.4.4-lp151.5.6.1 corosync-qnetd-debuginfo-2.4.4-lp151.5.6.1 corosync-testagents-2.4.4-lp151.5.6.1 corosync-testagents-debuginfo-2.4.4-lp151.5.6.1 libcfg6-2.4.4-lp151.5.6.1 libcfg6-debuginfo-2.4.4-lp151.5.6.1 libcmap4-2.4.4-lp151.5.6.1 libcmap4-debuginfo-2.4.4-lp151.5.6.1 libcorosync-devel-2.4.4-lp151.5.6.1 libcorosync_common4-2.4.4-lp151.5.6.1 libcorosync_common4-debuginfo-2.4.4-lp151.5.6.1 libcpg4-2.4.4-lp151.5.6.1 libcpg4-debuginfo-2.4.4-lp151.5.6.1 libquorum5-2.4.4-lp151.5.6.1 libquorum5-debuginfo-2.4.4-lp151.5.6.1 libsam4-2.4.4-lp151.5.6.1 libsam4-debuginfo-2.4.4-lp151.5.6.1 libtotem_pg5-2.4.4-lp151.5.6.1 libtotem_pg5-debuginfo-2.4.4-lp151.5.6.1 libvotequorum8-2.4.4-lp151.5.6.1 libvotequorum8-debuginfo-2.4.4-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libcfg6-32bit-2.4.4-lp151.5.6.1 libcfg6-32bit-debuginfo-2.4.4-lp151.5.6.1 libcmap4-32bit-2.4.4-lp151.5.6.1 libcmap4-32bit-debuginfo-2.4.4-lp151.5.6.1 libcorosync_common4-32bit-2.4.4-lp151.5.6.1 libcorosync_common4-32bit-debuginfo-2.4.4-lp151.5.6.1 libcpg4-32bit-2.4.4-lp151.5.6.1 libcpg4-32bit-debuginfo-2.4.4-lp151.5.6.1 libquorum5-32bit-2.4.4-lp151.5.6.1 libquorum5-32bit-debuginfo-2.4.4-lp151.5.6.1 libsam4-32bit-2.4.4-lp151.5.6.1 libsam4-32bit-debuginfo-2.4.4-lp151.5.6.1 libtotem_pg5-32bit-2.4.4-lp151.5.6.1 libtotem_pg5-32bit-debuginfo-2.4.4-lp151.5.6.1 libvotequorum8-32bit-2.4.4-lp151.5.6.1 libvotequorum8-32bit-debuginfo-2.4.4-lp151.5.6.1 References: https://bugzilla.suse.com/1168771

1 0

openSUSE-SU-2020:0554-1: important: Security update for kubernetes
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for kubernetes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0554-1 Rating: important References: #1039663 #1042383 #1042387 #1057277 #1059207 #1061027 #1065972 #1069469 #1084765 #1084766 #1085009 #1086185 #1086412 #1095131 #1095154 #1096773 #1097473 #1100838 #1101010 #1104598 #1104821 #1112980 #1118897 #1118898 #1136403 #1144065 #1155323 #1161056 #1161179 Cross-References: CVE-2016-5195 CVE-2016-8859 CVE-2017-1002101 CVE-2018-1002105 CVE-2018-16873 CVE-2018-16874 CVE-2019-10214 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 22 fixes is now available. Description: This update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-554=1 Package List: - openSUSE Leap 15.1 (x86_64): cri-o-1.17.1-lp151.2.2 cri-o-kubeadm-criconfig-1.17.1-lp151.2.2 cri-tools-1.18.0-lp151.2.1 go1.14-1.14-lp151.6.1 go1.14-doc-1.14-lp151.6.1 go1.14-race-1.14-lp151.6.1 kubernetes-apiserver-1.18.0-lp151.5.1 kubernetes-client-1.18.0-lp151.5.1 kubernetes-controller-manager-1.18.0-lp151.5.1 kubernetes-kubeadm-1.18.0-lp151.5.1 kubernetes-kubelet-common-1.18.0-lp151.5.1 kubernetes-kubelet1.17-1.18.0-lp151.5.1 kubernetes-kubelet1.18-1.18.0-lp151.5.1 kubernetes-master-1.18.0-lp151.5.1 kubernetes-node-1.18.0-lp151.5.1 kubernetes-proxy-1.18.0-lp151.5.1 kubernetes-scheduler-1.18.0-lp151.5.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-8859.html https://www.suse.com/security/cve/CVE-2017-1002101.html https://www.suse.com/security/cve/CVE-2018-1002105.html https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2019-10214.html https://bugzilla.suse.com/1039663 https://bugzilla.suse.com/1042383 https://bugzilla.suse.com/1042387 https://bugzilla.suse.com/1057277 https://bugzilla.suse.com/1059207 https://bugzilla.suse.com/1061027 https://bugzilla.suse.com/1065972 https://bugzilla.suse.com/1069469 https://bugzilla.suse.com/1084765 https://bugzilla.suse.com/1084766 https://bugzilla.suse.com/1085009 https://bugzilla.suse.com/1086185 https://bugzilla.suse.com/1086412 https://bugzilla.suse.com/1095131 https://bugzilla.suse.com/1095154 https://bugzilla.suse.com/1096773 https://bugzilla.suse.com/1097473 https://bugzilla.suse.com/1100838 https://bugzilla.suse.com/1101010 https://bugzilla.suse.com/1104598 https://bugzilla.suse.com/1104821 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1136403 https://bugzilla.suse.com/1144065 https://bugzilla.suse.com/1155323 https://bugzilla.suse.com/1161056 https://bugzilla.suse.com/1161179

1 0

openSUSE-SU-2020:0555-1: important: Security update for cups
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0555-1 Rating: important References: #1168422 Cross-References: CVE-2020-3898 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: - CVE-2020-3898: Fixed a heap buffer overflow in ppdFindOption() (bsc#1168422). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-555=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cups-2.2.7-lp151.6.6.1 cups-client-2.2.7-lp151.6.6.1 cups-client-debuginfo-2.2.7-lp151.6.6.1 cups-config-2.2.7-lp151.6.6.1 cups-ddk-2.2.7-lp151.6.6.1 cups-ddk-debuginfo-2.2.7-lp151.6.6.1 cups-debuginfo-2.2.7-lp151.6.6.1 cups-debugsource-2.2.7-lp151.6.6.1 cups-devel-2.2.7-lp151.6.6.1 libcups2-2.2.7-lp151.6.6.1 libcups2-debuginfo-2.2.7-lp151.6.6.1 libcupscgi1-2.2.7-lp151.6.6.1 libcupscgi1-debuginfo-2.2.7-lp151.6.6.1 libcupsimage2-2.2.7-lp151.6.6.1 libcupsimage2-debuginfo-2.2.7-lp151.6.6.1 libcupsmime1-2.2.7-lp151.6.6.1 libcupsmime1-debuginfo-2.2.7-lp151.6.6.1 libcupsppdc1-2.2.7-lp151.6.6.1 libcupsppdc1-debuginfo-2.2.7-lp151.6.6.1 - openSUSE Leap 15.1 (x86_64): cups-devel-32bit-2.2.7-lp151.6.6.1 libcups2-32bit-2.2.7-lp151.6.6.1 libcups2-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupscgi1-32bit-2.2.7-lp151.6.6.1 libcupscgi1-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsimage2-32bit-2.2.7-lp151.6.6.1 libcupsimage2-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsmime1-32bit-2.2.7-lp151.6.6.1 libcupsmime1-32bit-debuginfo-2.2.7-lp151.6.6.1 libcupsppdc1-32bit-2.2.7-lp151.6.6.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp151.6.6.1 References: https://www.suse.com/security/cve/CVE-2020-3898.html https://bugzilla.suse.com/1168422

1 0

openSUSE-SU-2020:0553-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 26 Apr '20

26 Apr '20

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0553-1 Rating: moderate References: #1144524 #1146848 #1166847 Cross-References: CVE-2019-13456 CVE-2019-17185 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524). - CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847). - Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-553=1 Package List: - openSUSE Leap 15.1 (x86_64): freeradius-server-3.0.16-lp151.4.4.1 freeradius-server-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-debugsource-3.0.16-lp151.4.4.1 freeradius-server-devel-3.0.16-lp151.4.4.1 freeradius-server-doc-3.0.16-lp151.4.4.1 freeradius-server-krb5-3.0.16-lp151.4.4.1 freeradius-server-krb5-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-ldap-3.0.16-lp151.4.4.1 freeradius-server-ldap-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-libs-3.0.16-lp151.4.4.1 freeradius-server-libs-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-mysql-3.0.16-lp151.4.4.1 freeradius-server-mysql-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-perl-3.0.16-lp151.4.4.1 freeradius-server-perl-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-postgresql-3.0.16-lp151.4.4.1 freeradius-server-postgresql-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-python-3.0.16-lp151.4.4.1 freeradius-server-python-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-sqlite-3.0.16-lp151.4.4.1 freeradius-server-sqlite-debuginfo-3.0.16-lp151.4.4.1 freeradius-server-utils-3.0.16-lp151.4.4.1 freeradius-server-utils-debuginfo-3.0.16-lp151.4.4.1 References: https://www.suse.com/security/cve/CVE-2019-13456.html https://www.suse.com/security/cve/CVE-2019-17185.html https://bugzilla.suse.com/1144524 https://bugzilla.suse.com/1146848 https://bugzilla.suse.com/1166847

1 0

openSUSE-RU-2020:0552-1: moderate: Recommended update for evolution
by maintenance＠opensuse.org 25 Apr '20

25 Apr '20

openSUSE Recommended Update: Recommended update for evolution ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0552-1 Rating: moderate References: #1161669 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for evolution fixes the following issue: - Display language names of spelling dictionaries in settings. (bsc#1161669) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-552=1 Package List: - openSUSE Leap 15.1 (noarch): evolution-lang-3.26.6-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): evolution-3.26.6-lp151.4.6.1 evolution-debuginfo-3.26.6-lp151.4.6.1 evolution-debugsource-3.26.6-lp151.4.6.1 evolution-devel-3.26.6-lp151.4.6.1 evolution-plugin-bogofilter-3.26.6-lp151.4.6.1 evolution-plugin-bogofilter-debuginfo-3.26.6-lp151.4.6.1 evolution-plugin-pst-import-3.26.6-lp151.4.6.1 evolution-plugin-pst-import-debuginfo-3.26.6-lp151.4.6.1 evolution-plugin-spamassassin-3.26.6-lp151.4.6.1 evolution-plugin-spamassassin-debuginfo-3.26.6-lp151.4.6.1 glade-catalog-evolution-3.26.6-lp151.4.6.1 glade-catalog-evolution-debuginfo-3.26.6-lp151.4.6.1 References: https://bugzilla.suse.com/1161669

1 0

openSUSE-SU-2020:0551-1: moderate: Recommended update for otrs
by opensuse-security＠opensuse.org 25 Apr '20

25 Apr '20

openSUSE Security Update: Recommended update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0551-1 Rating: moderate References: #1122560 #1137614 #1137615 #1139406 #1141430 #1141431 #1141432 #1156431 #1157001 #1160663 #1168029 #1168030 #1168031 #1168032 Cross-References: CVE-2019-10067 CVE-2019-12248 CVE-2019-12497 CVE-2019-12746 CVE-2019-13457 CVE-2019-13458 CVE-2019-16375 CVE-2019-18179 CVE-2019-18180 CVE-2019-9752 CVE-2019-9892 CVE-2020-1765 CVE-2020-1766 CVE-2020-1769 CVE-2020-1770 CVE-2020-1771 CVE-2020-1772 CVE-2020-1773 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Otrs was updated to 5.0.42, fixing lots of bugs and security issues: https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo#1168029 OSA-2020-10: * Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. - CVE-2020-1772 boo#1168029 OSA-2020-09: * Information Disclosure It’s possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. - CVE-2020-1771 boo#1168030 OSA-2020-08: * Possible XSS in Customer user address book Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. - CVE-2020-1770 boo#1168031 OSA-2020-07: * Information disclosure in support bundle files Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. - CVE-2020-1769 boo#1168032 OSA-2020-06: * Autocomplete in the form login screens In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. Update to 5.0.41 https://community.otrs.com/otrs-community-edition-5s-patch-level-41/ * bug#14912 - Installer refers to non-existing documentation - added code to upgrade OTRS from 4 to 5 READ UPGRADING.SUSE * steps 1 to 4 are done by rpm pkg * steps 5 to *END* need to be done manually cause of DB backup Update to 5.0.40 https://community.otrs.com/otrs-community-edition-5s-patch-level-40/ - CVE-2020-1766 boo#1160663 OSA-2020-02: Improper handling of uploaded inline images Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. * CVE-2020-1765, OSA-2020-01: Spoofing of From field in several screens An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade - Update 5.0.39 https://community.otrs.com/otrs-community-edition-5s-patch-level-39/ * CVE-2019-18180 boo#1157001 OSA-2019-15: Denial of service OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). * CVE-2019-18179 OSA-2019-14: Information Disclosure An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. Update to 5.0.38 https://community.otrs.com/release-notes-otrs-5s-patch-level-38/ * CVE-2019-16375, boo#1156431 OSA-2019-13: Stored XXS An attacker who is logged into OTRS as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent compose an answer to the original article. Update to 5.0.37 https://community.otrs.com/release-notes-otrs-5s-patch-level-37/ * CVE-2019-13458, boo#1141432, OSA-2019-12: Information Disclosure An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS tags in templates in order to disclose hashed user passwords. * CVE-2019-13457, boo#1141431, OSA-2019-11: Information Disclosure A customer user can use the search results to disclose information from their “company” tickets (with the same CustomerID), even when CustomerDisableCompanyTicketAccess setting is turned on. * CVE-2019-12746, boo#1141430, OSA-2019-10: Session ID Disclosure A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then potentially abused in order to impersonate the agent user. Update to 5.0.36 https://community.otrs.com/release-notes-otrs-5s-patch-level-36/ * CVE-2019-12497, boo#1137614, OSA-2019-09: Information Disclosure In the customer or external frontend, personal information of agents can be disclosed like Name and mail address in external notes. * CVE-2019-12248, boo#1137615, OSA-2019-08: Loading External Image Resources An attacker could send a malicious email to an OTRS system. If a logged in agent user quotes it, the email could cause the browser to load external image resources. Update to 5.0.35 https://community.otrs.com/release-notes-otrs-5s-patch-level-35/ * CVE-2019-10067, boo#1139406, OSA-2019-05: Reflected and Stored XSS An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. * CVE-2019-9892, boo#1139406, OSA-2019-04: XXE Processing An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files of OTRS filesystem. - update missing CVE for OSA-2018-10, OSA-2019-01 Update to 5.0.34 * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/ * CVE-2019-9752, boo#1122560, OSA-2019-01: Stored XSS An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. Update to 5.0.33 * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/ Update to 5.0.26 * https://www.otrs.com/release-notes-otrs-5s-patch-level-26 * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/ - remove obsolete * otrs-scheduler.service * otrs-scheduler.init Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-551=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-551=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-551=1 Package List: - openSUSE Leap 15.1 (noarch): otrs-5.0.42-lp151.2.3.1 otrs-doc-5.0.42-lp151.2.3.1 otrs-itsm-5.0.42-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): otrs-5.0.42-bp151.3.3.1 otrs-doc-5.0.42-bp151.3.3.1 otrs-itsm-5.0.42-bp151.3.3.1 - openSUSE Backports SLE-15 (noarch): otrs-5.0.42-bp150.2.10.1 otrs-doc-5.0.42-bp150.2.10.1 otrs-itsm-5.0.42-bp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2019-10067.html https://www.suse.com/security/cve/CVE-2019-12248.html https://www.suse.com/security/cve/CVE-2019-12497.html https://www.suse.com/security/cve/CVE-2019-12746.html https://www.suse.com/security/cve/CVE-2019-13457.html https://www.suse.com/security/cve/CVE-2019-13458.html https://www.suse.com/security/cve/CVE-2019-16375.html https://www.suse.com/security/cve/CVE-2019-18179.html https://www.suse.com/security/cve/CVE-2019-18180.html https://www.suse.com/security/cve/CVE-2019-9752.html https://www.suse.com/security/cve/CVE-2019-9892.html https://www.suse.com/security/cve/CVE-2020-1765.html https://www.suse.com/security/cve/CVE-2020-1766.html https://www.suse.com/security/cve/CVE-2020-1769.html https://www.suse.com/security/cve/CVE-2020-1770.html https://www.suse.com/security/cve/CVE-2020-1771.html https://www.suse.com/security/cve/CVE-2020-1772.html https://www.suse.com/security/cve/CVE-2020-1773.html https://bugzilla.suse.com/1122560 https://bugzilla.suse.com/1137614 https://bugzilla.suse.com/1137615 https://bugzilla.suse.com/1139406 https://bugzilla.suse.com/1141430 https://bugzilla.suse.com/1141431 https://bugzilla.suse.com/1141432 https://bugzilla.suse.com/1156431 https://bugzilla.suse.com/1157001 https://bugzilla.suse.com/1160663 https://bugzilla.suse.com/1168029 https://bugzilla.suse.com/1168030 https://bugzilla.suse.com/1168031 https://bugzilla.suse.com/1168032

1 0

openSUSE-RU-2020:0550-1: important: Recommended update for cloud-init
by maintenance＠opensuse.org 24 Apr '20

24 Apr '20

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0550-1 Rating: important References: #1099358 #1144881 #1145622 #1148645 #1163178 #1165296 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for cloud-init contains the following fixes: - Update previous patches with the following additions: + In cases where the config contains 2 or more default gateway specifications for an interface only write the first default route, log warning message about skipped routes + Avoid writing invalid route specification if neither the network nor destination is specified in the route configuration + Still need to consider the "network" configuration uption for the v1 config implementation. Fixes regression introduced with update from Wed Feb 12 19:30:42. + Add the default gateway to the ifroute config file when specified as part of the subnet configuration. (bsc#1165296) + Fix typo to properly extrakt provided netmask data (bsc#1163178, bsc#1165296) + Fix for default gateway and IPv6. (bsc#1144881) + Routes will be written if there is only a default gateway. (bsc#1148645) - BuildRequire pkgconfig(udev) instead of udev, which allow OS to shortcut through the -mini flavor. - Update to cloud-init 19.2. (bsc#1099358, bsc#1145622) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-550=1 Package List: - openSUSE Leap 15.1 (x86_64): cloud-init-19.4-lp151.2.18.1 cloud-init-config-suse-19.4-lp151.2.18.1 cloud-init-doc-19.4-lp151.2.18.1 References: https://bugzilla.suse.com/1099358 https://bugzilla.suse.com/1144881 https://bugzilla.suse.com/1145622 https://bugzilla.suse.com/1148645 https://bugzilla.suse.com/1163178 https://bugzilla.suse.com/1165296

1 0

openSUSE-SU-2020:0549-1: moderate: Security update for crawl
by opensuse-security＠opensuse.org 24 Apr '20

24 Apr '20

openSUSE Security Update: Security update for crawl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0549-1 Rating: moderate References: #1169381 Cross-References: CVE-2020-11722 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for crawl fixes the following issues: * CVE-2020-11722: Fixed a remote code evaluation issue with lua loadstring (boo#1169381) Update to version 0.24.0 * Vampire species simplified * Thrown weapons streamlined * Fedhas reimagined * Sif Muna reworked Update to version 0.23.2 * Trap system overhaul * New Gauntlet portal to replace Labyrinths * Nemelex Xobeh rework * Nine unrandarts reworked and the new "Rift" unrandart added * Support for seeded dungeon play * build requires python and python-pyYAML Update to 0.22.0 * Player ghosts now only appear in sealed ghost vaults * New spell library interface * User interface revamp for Tiles and WebTiles Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-549=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-549=1 Package List: - openSUSE Leap 15.1 (x86_64): crawl-0.24.0-lp151.3.3.2 crawl-debugsource-0.24.0-lp151.3.3.2 crawl-sdl-0.24.0-lp151.3.3.2 crawl-sdl-debuginfo-0.24.0-lp151.3.3.2 - openSUSE Leap 15.1 (noarch): crawl-data-0.24.0-lp151.3.3.2 - openSUSE Backports SLE-15-SP1 (aarch64 s390x x86_64): crawl-0.24.0-bp151.4.3.2 crawl-sdl-0.24.0-bp151.4.3.2 - openSUSE Backports SLE-15-SP1 (noarch): crawl-data-0.24.0-bp151.4.3.2 References: https://www.suse.com/security/cve/CVE-2020-11722.html https://bugzilla.suse.com/1169381

1 0

openSUSE-RU-2020:0548-1: moderate: Recommended update for gnutls
by maintenance＠opensuse.org 24 Apr '20

24 Apr '20

openSUSE Recommended Update: Recommended update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0548-1 Rating: moderate References: #1168835 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnutls fixes the following issues: - Backport AES XTS support (bsc#1168835) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-548=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gnutls-3.6.7-lp151.2.9.1 gnutls-debuginfo-3.6.7-lp151.2.9.1 gnutls-debugsource-3.6.7-lp151.2.9.1 gnutls-guile-3.6.7-lp151.2.9.1 gnutls-guile-debuginfo-3.6.7-lp151.2.9.1 libgnutls-dane-devel-3.6.7-lp151.2.9.1 libgnutls-dane0-3.6.7-lp151.2.9.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.9.1 libgnutls-devel-3.6.7-lp151.2.9.1 libgnutls30-3.6.7-lp151.2.9.1 libgnutls30-debuginfo-3.6.7-lp151.2.9.1 libgnutls30-hmac-3.6.7-lp151.2.9.1 libgnutlsxx-devel-3.6.7-lp151.2.9.1 libgnutlsxx28-3.6.7-lp151.2.9.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): libgnutls-devel-32bit-3.6.7-lp151.2.9.1 libgnutls30-32bit-3.6.7-lp151.2.9.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.9.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.9.1 References: https://bugzilla.suse.com/1168835

1 0

openSUSE-RU-2020:0547-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 24 Apr '20

24 Apr '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0547-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.6.9 * BugFixes: + Fixed playlist metadata updating interfering with manual tag editing. + Fixed order of tabs in all windows. + Fixed playlist right click using wrong songs for determining menu options when playlist was filtered. + Fixed possible crashes on playlist right click. + Fixed possible null pointer crash in OSD pretty. + Fixed track and title in playlist not being movable. + Fixed Subsonic support to handle numeric Json values like track and disc both as strings and integers. + Fixed Subsonic compatibility with LMS (Lightweight Music Server). + Disabled "open Audio CD" from menu on Windows where CD support is currently not supported. + Fixed files containing "MAC" being detected as Monkey's Audio. * Enhancements: + Improved support for High DPI displays. + Added CMake check for backtrace() to fix compilation with musl libc. + Made album cover in context adjust to width. + Made settings, cover manager, organise dialog and transcode music dialog center on the same display where the mainwindow is located. + Removing empty directories when organizing music. + Made file selection work in "Show file in browser" for Dolphin and Nautilus. + Implemented disk caching of album thumbnails in collection tree. + Use a shorter playlist name when songs are added from file view. + Disabled optical drives in copy to device menu. + Added better error handling for CDDA loading. + Added Polish, Hungarian and Korean translations. * Removed features: + Chartlyrics support (Unstable API). + Tidal support (No agreement). + QObuz support (No agreement). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-547=1 Package List: - openSUSE Leap 15.1 (x86_64): strawberry-0.6.9-lp151.2.15.1 strawberry-debuginfo-0.6.9-lp151.2.15.1 strawberry-debugsource-0.6.9-lp151.2.15.1 References:

1 0