April 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0504-1: moderate: Recommended update for nvmetcli
by maintenance＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Recommended Update: Recommended update for nvmetcli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0504-1 Rating: moderate References: #1167644 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvmetcli fixes the following issues: - Update from version 0.6 to version 0.7: * nvmetcli: ANA configuration support * nvmetcli: simplify the enabled logic * nvmetcli: pep8 fixes * nvmetcli: support inline_data_size port parameter * Revert "nvmetcli: expose nvmet port status and state" * Support python3 dictionary access. * nvmetcli: expose nvmet port status and state - 'clear' command doesn't handle ANA groups correctly. (bsc#1167644) The first ANA group is maintained by the kernel so it cannot be deleted. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-504=1 Package List: - openSUSE Leap 15.1 (noarch): nvmetcli-0.7-lp151.6.3.1 References: https://bugzilla.suse.com/1167644

1 0

openSUSE-RU-2020:0505-1: moderate: Recommended update for e2fsprogs
by maintenance＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Recommended Update: Recommended update for e2fsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0505-1 Rating: moderate References: #1160979 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for e2fsprogs fixes the following issues: - e2fsck: clarify overflow link count error message (bsc#1160979) - ext2fs: update allocation info earlier in ext2fs_mkdir() (bsc#1160979) - ext2fs: implement dir entry creation in htree directories (bsc#1160979) - tests: add test to excercise indexed directories with metadata_csum (bsc#1160979) - tune2fs: update dir checksums when clearing dir_index feature (bsc#1160979) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-505=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): e2fsprogs-1.43.8-lp151.5.15.1 e2fsprogs-debuginfo-1.43.8-lp151.5.15.1 e2fsprogs-debugsource-1.43.8-lp151.5.15.1 e2fsprogs-devel-1.43.8-lp151.5.15.1 libcom_err-devel-1.43.8-lp151.5.15.1 libcom_err-devel-static-1.43.8-lp151.5.15.1 libcom_err2-1.43.8-lp151.5.15.1 libcom_err2-debuginfo-1.43.8-lp151.5.15.1 libext2fs-devel-1.43.8-lp151.5.15.1 libext2fs-devel-static-1.43.8-lp151.5.15.1 libext2fs2-1.43.8-lp151.5.15.1 libext2fs2-debuginfo-1.43.8-lp151.5.15.1 - openSUSE Leap 15.1 (x86_64): e2fsprogs-32bit-debuginfo-1.43.8-lp151.5.15.1 libcom_err-devel-32bit-1.43.8-lp151.5.15.1 libcom_err2-32bit-1.43.8-lp151.5.15.1 libcom_err2-32bit-debuginfo-1.43.8-lp151.5.15.1 libext2fs-devel-32bit-1.43.8-lp151.5.15.1 libext2fs2-32bit-1.43.8-lp151.5.15.1 libext2fs2-32bit-debuginfo-1.43.8-lp151.5.15.1 References: https://bugzilla.suse.com/1160979

1 0

openSUSE-SU-2020:0507-1: important: Security update for python-PyYAML
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for python-PyYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0507-1 Rating: important References: #1165439 Cross-References: CVE-2020-1747 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-PyYAML fixes the following issues: - CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-507=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python-PyYAML-debugsource-5.1.2-lp151.2.6.1 python2-PyYAML-5.1.2-lp151.2.6.1 python2-PyYAML-debuginfo-5.1.2-lp151.2.6.1 python3-PyYAML-5.1.2-lp151.2.6.1 python3-PyYAML-debuginfo-5.1.2-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-1747.html https://bugzilla.suse.com/1165439

1 0

openSUSE-SU-2020:0506-1: moderate: Security update for mgetty
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0506-1 Rating: moderate References: #1142770 #1168170 Cross-References: CVE-2019-1010190 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mgetty fixes the following issues: - CVE-2019-1010190: Fixed a denial of service which could be caused by a local attacker in putwhitespan() (bsc#1142770). - Fixed a permission issue which have resulted in build failures (bsc#1168170). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-506=1 Package List: - openSUSE Leap 15.1 (x86_64): g3utils-1.1.37-lp151.4.3.1 g3utils-debuginfo-1.1.37-lp151.4.3.1 mgetty-1.1.37-lp151.4.3.1 mgetty-debuginfo-1.1.37-lp151.4.3.1 mgetty-debugsource-1.1.37-lp151.4.3.1 sendfax-1.1.37-lp151.4.3.1 sendfax-debuginfo-1.1.37-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-1010190.html https://bugzilla.suse.com/1142770 https://bugzilla.suse.com/1168170

1 0

openSUSE-SU-2020:0501-1: moderate: Security update for gmp, gnutls, libnettle
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for gmp, gnutls, libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0501-1 Rating: moderate References: #1152692 #1155327 #1166881 #1168345 Cross-References: CVE-2020-11501 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for gmp, gnutls, libnettle fixes the following issues: Security issue fixed: - CVE-2020-11501: Fixed zero random value in DTLS client hello (bsc#1168345) FIPS related bugfixes: - FIPS: Install checksums for binary integrity verification which are required when running in FIPS mode (bsc#1152692, jsc#SLE-9518) - FIPS: Fixed a cfb8 decryption issue, no longer truncate output IV if input is shorter than block size. (bsc#1166881) - FIPS: Added Diffie Hellman public key verification test. (bsc#1155327) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-501=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gmp-debugsource-6.1.2-lp151.4.3.1 gmp-devel-6.1.2-lp151.4.3.1 gnutls-3.6.7-lp151.2.6.1 gnutls-debuginfo-3.6.7-lp151.2.6.1 gnutls-debugsource-3.6.7-lp151.2.6.1 gnutls-guile-3.6.7-lp151.2.6.1 gnutls-guile-debuginfo-3.6.7-lp151.2.6.1 libgmp10-6.1.2-lp151.4.3.1 libgmp10-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-6.1.2-lp151.4.3.1 libgmpxx4-debuginfo-6.1.2-lp151.4.3.1 libgnutls-dane-devel-3.6.7-lp151.2.6.1 libgnutls-dane0-3.6.7-lp151.2.6.1 libgnutls-dane0-debuginfo-3.6.7-lp151.2.6.1 libgnutls-devel-3.6.7-lp151.2.6.1 libgnutls30-3.6.7-lp151.2.6.1 libgnutls30-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-3.6.7-lp151.2.6.1 libgnutlsxx-devel-3.6.7-lp151.2.6.1 libgnutlsxx28-3.6.7-lp151.2.6.1 libgnutlsxx28-debuginfo-3.6.7-lp151.2.6.1 libhogweed4-3.4.1-lp151.2.3.2 libhogweed4-debuginfo-3.4.1-lp151.2.3.2 libnettle-debugsource-3.4.1-lp151.2.3.2 libnettle-devel-3.4.1-lp151.2.3.2 libnettle6-3.4.1-lp151.2.3.2 libnettle6-debuginfo-3.4.1-lp151.2.3.2 nettle-3.4.1-lp151.2.3.2 nettle-debuginfo-3.4.1-lp151.2.3.2 - openSUSE Leap 15.1 (x86_64): gmp-devel-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-6.1.2-lp151.4.3.1 libgmp10-32bit-debuginfo-6.1.2-lp151.4.3.1 libgmpxx4-32bit-6.1.2-lp151.4.3.1 libgmpxx4-32bit-debuginfo-6.1.2-lp151.4.3.1 libgnutls-devel-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-3.6.7-lp151.2.6.1 libgnutls30-32bit-debuginfo-3.6.7-lp151.2.6.1 libgnutls30-hmac-32bit-3.6.7-lp151.2.6.1 libhogweed4-32bit-3.4.1-lp151.2.3.2 libhogweed4-32bit-debuginfo-3.4.1-lp151.2.3.2 libnettle-devel-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-3.4.1-lp151.2.3.2 libnettle6-32bit-debuginfo-3.4.1-lp151.2.3.2 References: https://www.suse.com/security/cve/CVE-2020-11501.html https://bugzilla.suse.com/1152692 https://bugzilla.suse.com/1155327 https://bugzilla.suse.com/1166881 https://bugzilla.suse.com/1168345

1 0

openSUSE-RU-2020:0502-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0502-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for virtualbox fixes the following issues: Version bump to 6.0.18 (released February 21 2020 by Oracle) This is a maintenance release. The following items were fixed and/or added: - GUI: Update medium location shown im VM details when the Virtual Media Manager was used to move it - Virtualization core: Ignore writes to MSR_IA32_TSX_CTRL to avoid Windows 10 VM crashes on very new Intel CPUs (bug #19169) - DVD: Fix possible crash when ejecting the medium - USB: Fix isochronous transfers to the VM for xHCI - Serial: Avoid hangs due to inconsistent handshake signals when the config keeps it is disconnected - Serial: Improve host serial port passthrough handling on Windows host - VBoxManage: fixed creating a new VM using the default settings parameter (bug #19310) - Linux guest: Support Linux 5.5 (bug #19145) - Linux guest: Shared folder fix for loopback mounting of images Version bump to 6.0.16 (released January 14 2020 by Oracle) This is a maintenance release. The following items were fixed and/or added: - Virtualization core: fixed delivery of debug exceptions when the guest single-steps under certain rare conditions (6.0.0 regression) - Virtualization core: fixed performance issue observed with Windows XP guests on AMD hosts (6.0.0 regression; bug #19152) - Storage: Fix crash when using host DVD drive without medium - Graphics: Improved fix for flickering on Windows host - Audio: fixed crash in the HDA emulation when using multi-speaker configurations - VBoxManage: fix "updateguestadditions" sub-command of "guestcontrol" - VBoxManage: show graphics controller type in VM info - API: support Python 3.8 - Linux host: fix systemd service dependency for web service - Linux host: Support Linux 5.5 (guest additions not yet) - Linux host and guest: Support Linux 5.4 (bug #18945) - Windows guest: Many fixes for drawing problems in the driver for VBoxSVGA - Linux guest: improve resize and multi-monitor handling for VMs using VMSVGA (known remaining issue: do not disable a monitor "in the middle", causes confusion) - Linux guest: Fix missing symbol issue for shared folder kernel module affecting some Linux 4.x kernels (bug #18926) - macOS Guest Additions: Fix permissions of the uninstall tool (bug #19044) Version bump to 6.0.14 (released October 15 2019 by Oracle) This is a maintenance release. The following items were fixed and/or added: - Virtualization core: fixed an invalid-guest state guru meditation in some rare circumstances on Intel hosts - Virtualization core: some fixes for systems with lots of processors - Audio: relaxed VRM / VRA (variable rate audio) bit checks to provide more compatibility for guests running ALSA setups with the AC'97 emulation - USB: made device capturing for passthrough more accurate and reliable on Windows host - Network: fixed potential issue with interrupt signalling for network adapters in UEFI guests - 3D: fixed flicker and redraw issues when using VBoxSVGA or VMSVGA graphics adapter (bugs #18562, #18956) - 3D: fixed crash with some applications when using VBoxSVGA or VMSVGA graphics adapter (bug #18638) - Linux host: support Linux 5.3, thank you Larry Finger (see also bug #18911) - Linux host: improve python version detection during rpm package creation, can change package dependencies and fix some installation problems - Linux guests: calls to aio_read(3) and aio_write(3) may fail inside shared folders (bug #18805) - Linux guests: fix problem with shared folder unmounting in service script, thank you Denis Ryndine (bug #18853) - Linux guests: VBox 6.0.10 GAs fail to compile on Red Hat/CentOS/Oracle Linux 7.7 and Red Hat 8.1 Beta (bug #18917) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-502=1 Package List: - openSUSE Leap 15.1 (x86_64): python3-virtualbox-6.0.18-lp151.2.12.1 python3-virtualbox-debuginfo-6.0.18-lp151.2.12.1 virtualbox-6.0.18-lp151.2.12.1 virtualbox-debuginfo-6.0.18-lp151.2.12.1 virtualbox-debugsource-6.0.18-lp151.2.12.1 virtualbox-devel-6.0.18-lp151.2.12.1 virtualbox-guest-tools-6.0.18-lp151.2.12.1 virtualbox-guest-tools-debuginfo-6.0.18-lp151.2.12.1 virtualbox-guest-x11-6.0.18-lp151.2.12.1 virtualbox-guest-x11-debuginfo-6.0.18-lp151.2.12.1 virtualbox-kmp-default-6.0.18_k4.12.14_lp151.28.44-lp151.2.12.1 virtualbox-kmp-default-debuginfo-6.0.18_k4.12.14_lp151.28.44-lp151.2.12.1 virtualbox-qt-6.0.18-lp151.2.12.1 virtualbox-qt-debuginfo-6.0.18-lp151.2.12.1 virtualbox-vnc-6.0.18-lp151.2.12.1 virtualbox-websrv-6.0.18-lp151.2.12.1 virtualbox-websrv-debuginfo-6.0.18-lp151.2.12.1 - openSUSE Leap 15.1 (noarch): virtualbox-guest-desktop-icons-6.0.18-lp151.2.12.1 virtualbox-guest-source-6.0.18-lp151.2.12.1 virtualbox-host-source-6.0.18-lp151.2.12.1 References:

1 0

openSUSE-RU-2020:0503-1: important: Recommended update for yast2-storage-ng
by maintenance＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Recommended Update: Recommended update for yast2-storage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0503-1 Rating: important References: #1159201 #1162043 #1162545 #1168325 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-storage-ng fixes the following issues: - Include a 'partitions' section in AutoYaST when exporting an unpartitioned software RAID which is not used as a filesystem. (bsc#1159201) - Fix for showing an error message when no suitable physical volumes are found for a given volume group instead of crashing. (bsc#1162043) - Adds the ability to prevent LUKS activation (bsc#1162545) - Fixed a crash when at least two devices are modified before and after reprobing the hardware (bsc#1168325) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-503=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): yast2-storage-ng-4.1.95-lp151.2.19.1 References: https://bugzilla.suse.com/1159201 https://bugzilla.suse.com/1162043 https://bugzilla.suse.com/1162545 https://bugzilla.suse.com/1168325

1 0

openSUSE-SU-2020:0500-1: moderate: Security update for nagios
by opensuse-security＠opensuse.org 11 Apr '20

11 Apr '20

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0500-1 Rating: moderate References: #1028975 #1119832 #1156309 Cross-References: CVE-2018-13441 CVE-2018-13457 CVE-2018-13458 CVE-2018-18245 CVE-2019-3698 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nagios to version 4.4.5 fixes the following issues: - CVE-2019-3698: Symbolic link following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges. (boo#1156309) - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary report (boo#1119832) - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a few denial of service vulnerabilities caused by null pointer dereference (boo#1101293, boo#1101289, boo#1101290). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-500=1 Package List: - openSUSE Leap 15.1 (x86_64): nagios-4.4.5-lp151.5.4.1 nagios-contrib-4.4.5-lp151.5.4.1 nagios-debuginfo-4.4.5-lp151.5.4.1 nagios-debugsource-4.4.5-lp151.5.4.1 nagios-devel-4.4.5-lp151.5.4.1 nagios-www-4.4.5-lp151.5.4.1 nagios-www-dch-4.4.5-lp151.5.4.1 nagios-www-debuginfo-4.4.5-lp151.5.4.1 - openSUSE Leap 15.1 (noarch): nagios-theme-exfoliation-4.4.5-lp151.5.4.1 References: https://www.suse.com/security/cve/CVE-2018-13441.html https://www.suse.com/security/cve/CVE-2018-13457.html https://www.suse.com/security/cve/CVE-2018-13458.html https://www.suse.com/security/cve/CVE-2018-18245.html https://www.suse.com/security/cve/CVE-2019-3698.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1119832 https://bugzilla.suse.com/1156309

1 0

openSUSE-RU-2020:0499-1: moderate: Recommended update for yast2-iscsi-client
by maintenance＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Recommended Update: Recommended update for yast2-iscsi-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0499-1 Rating: moderate References: #1158443 #1160374 #1160606 #1162078 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-iscsi-client fixes the following issues: - Fixes an issue where the installer was unable to connect an iSCSI target, when the system has been reinstalled with AutoYaST (bsc#1158443, bsc#1160606) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-499=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-iscsi-client-4.1.10-lp151.2.3.1 References: https://bugzilla.suse.com/1158443 https://bugzilla.suse.com/1160374 https://bugzilla.suse.com/1160606 https://bugzilla.suse.com/1162078

1 0

openSUSE-RU-2020:0496-1: moderate: Recommended update for xfsprogs
by maintenance＠opensuse.org 10 Apr '20

10 Apr '20

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0496-1 Rating: moderate References: #1158630 #1167205 #1167206 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for xfsprogs fixes the following issues: - xfs_quota: reformat commands in the manpage. (bsc#1167206) Reformat commands in the manpage so that fstest can check that each command is actually documented. - xfs_db: document missing commands. (bsc#1167205) Document the commands 'attr_set', 'attr_remove', 'logformat' in the manpage. - xfs_io: allow size suffixes for the copy_range command. (bsc#1158630) Allow the usage of size suffixes k,m,g for kilobytes, megabytes or gigabytes respectively for the copy_range command This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-496=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xfsprogs-4.15.0-lp151.7.12.1 xfsprogs-debuginfo-4.15.0-lp151.7.12.1 xfsprogs-debugsource-4.15.0-lp151.7.12.1 xfsprogs-devel-4.15.0-lp151.7.12.1 References: https://bugzilla.suse.com/1158630 https://bugzilla.suse.com/1167205 https://bugzilla.suse.com/1167206

1 0