May 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0719-1: important: Security update for dom4j
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0719-1 Rating: important References: #1169760 Cross-References: CVE-2020-10683 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-719=1 Package List: - openSUSE Leap 15.1 (noarch): dom4j-1.6.1-lp151.6.3.1 dom4j-demo-1.6.1-lp151.6.3.1 dom4j-javadoc-1.6.1-lp151.6.3.1 dom4j-manual-1.6.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-10683.html https://bugzilla.suse.com/1169760

1 0

openSUSE-RU-2020:0718-1: moderate: Recommended update for go1.9
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for go1.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0718-1 Rating: moderate References: #1082409 #1119634 #1121397 #974800 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for go1.9 fixes the following issues: - Fix for bootstrap to work gcc other than gcc9 at armv7l. (bsc#974800) - Fix for build failures with gcc7. (bsc#1121397) - Set GOPATH automatically and removes go.sh and GOROOT, in order to make switching between versions no longer break. (bsc#1119634) - Fix for an issue in build when symlinks pointing to versions that were never installed at all. (bsc#1082409) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-718=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go1.9-1.9.7-lp151.2.3.1 go1.9-doc-1.9.7-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): go1.9-race-1.9.7-lp151.2.3.1 References: https://bugzilla.suse.com/1082409 https://bugzilla.suse.com/1119634 https://bugzilla.suse.com/1121397 https://bugzilla.suse.com/974800

1 0

openSUSE-RU-2020:0723-1: moderate: Recommended update for libstorage-ng
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0723-1 Rating: moderate References: #1168615 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libstorage-ng fixes the following issues: - Fix for 'umount/swapoff' failure pop-up notification that stops automated installations. (bsc#1168615) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-723=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libstorage-ng-debuginfo-4.1.111-lp151.3.25.1 libstorage-ng-debugsource-4.1.111-lp151.3.25.1 libstorage-ng-devel-4.1.111-lp151.3.25.1 libstorage-ng-integration-tests-4.1.111-lp151.3.25.1 libstorage-ng-python3-4.1.111-lp151.3.25.1 libstorage-ng-python3-debuginfo-4.1.111-lp151.3.25.1 libstorage-ng-ruby-4.1.111-lp151.3.25.1 libstorage-ng-ruby-debuginfo-4.1.111-lp151.3.25.1 libstorage-ng-utils-4.1.111-lp151.3.25.1 libstorage-ng-utils-debuginfo-4.1.111-lp151.3.25.1 libstorage-ng1-4.1.111-lp151.3.25.1 libstorage-ng1-debuginfo-4.1.111-lp151.3.25.1 - openSUSE Leap 15.1 (noarch): libstorage-ng-lang-4.1.111-lp151.3.25.1 References: https://bugzilla.suse.com/1168615

1 0

openSUSE-RU-2020:0722-1: moderate: Recommended update for golang-packaging
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for golang-packaging ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0722-1 Rating: moderate References: #776058 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for golang-packaging fixes the following issues: - Fix for an issue when go installation fails due missing permissions. (bsc#776058) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-722=1 Package List: - openSUSE Leap 15.1 (noarch): golang-packaging-15.0.12-lp151.2.3.1 References: https://bugzilla.suse.com/776058

1 0

openSUSE-RU-2020:0717-1: moderate: Recommended update for go1.14
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for go1.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0717-1 Rating: moderate References: #1164903 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.14 fixes the following issues: go1.14.2 (released 2020-04-08) includes fixes to cgo, the go command, the runtime, os/exec, and testing packages. (bsc#1164903 ECO-1484) * go#38156 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes * go#38118 runtime/pprof: lostProfileEvent stack breaks gentraceback guarantee * go#38083 cmd/go/internal/test: data race in (*runCache).builderRunTest * go#38072 runtime: timer self-deadlock due to preemption point * go#38051 runtime: loops forever on sched_yield sometimes(timer related) * go#38005 runtime: "pipe failed with -89" at program startup(mipsle only), timer related netpoll init. * go#37970 runtime/pprof: panic: runtime error: index out of range [-1] * go#37968 runtime: fatal error: found bad pointer in Go heap (incorrect use of unsafe or cgo?) * go#37959 testing: data race between parallel panicking and normal subtest * go#37931 cmd/go: explain automatic vendoring in 'go help modules' * go#37928 runtime: GC pacing exhibits strange behavior with a low GOGC * go#37800 cmd/go: 'Access is denied' when renaming module cache directory * go#37699 PowerRegisterSuspendResumeNotification error on Azure App Services with go 1.13.7 * go#37622 cmd/cgo: fails to generate certain types with Go 1.14 * go#37480 runtime: "fatal error: unexpected signal" 0xC0000005 on Windows for a small program with a large allocation * go#37471 os/exec: environForSysProcAttr is never called as sysattr.Env is never nil go1.14.1 (released 2020-03-19) includes fixes to the go command, tools, and the runtime. * go#37905 cmd/compile: -d=checkptr should not reject unaligned pointers to non-pointer data * go#37833 runtime: sometimes 100% CPU spin during init phase in Go 1.14 with preemptive scheduler * go#37822 cmd/go: module's "go" version should be included in cache key * go#37807 runtime: mlock of signal stack failed: 12 * go#37782 runtime: crash on 1.14 with unexpected return pc, fatal error: unknown caller pc * go#37721 reflect: MakeMap() and not native map type wrong behavior * go#37671 cmd/go: tests that panic or exit are marked as passing when -json flag is used * go#37667 runtime: asyncPreempt should not try to save floating-point context for softfloat MIPS targets * go#37630 doc: missing documentation of quoting the URL of url.Errors in go1.14 release notes * go#37613 runtime: Go 1.14.rc1 3-5% performance regression from 1.13 during protobuf marshalling * go#37494 time: racy Timer access should either work or throw, not panic * go#37478 SIGILL: illegal instruction on any go tool under macOS * go#37447 runtime/pprof: inline frames may not use combined location * go#37343 cmd/trace: requires HTML imports, which doesn't work on any major browser anymore This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-717=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.14-1.14.2-lp151.10.1 go1.14-doc-1.14.2-lp151.10.1 go1.14-race-1.14.2-lp151.10.1 References: https://bugzilla.suse.com/1164903

1 0

openSUSE-RU-2020:0725-1: moderate: Recommended update for NetworkManager-openvpn
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for NetworkManager-openvpn ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0725-1 Rating: moderate References: #1127794 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager-openvpn fixes the following issues: - Fix for Network Manager for proper termination in openVPN when waiting for processes to exit. (bsc#1127794) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-725=1 Package List: - openSUSE Leap 15.1 (x86_64): NetworkManager-openvpn-1.8.2-lp151.4.6.1 NetworkManager-openvpn-debuginfo-1.8.2-lp151.4.6.1 NetworkManager-openvpn-debugsource-1.8.2-lp151.4.6.1 NetworkManager-openvpn-gnome-1.8.2-lp151.4.6.1 NetworkManager-openvpn-gnome-debuginfo-1.8.2-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): NetworkManager-openvpn-lang-1.8.2-lp151.4.6.1 References: https://bugzilla.suse.com/1127794

1 0

openSUSE-SU-2020:0721-1: moderate: Security update for memcached
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for memcached ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0721-1 Rating: moderate References: #1133817 #1149110 Cross-References: CVE-2019-11596 CVE-2019-15026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for memcached fixes the following issues: Security issue fixed: - CVE-2019-11596: Fixed a NULL pointer dereference in process_lru_command (bsc#1133817). - CVE-2019-15026: Fixed a stack-based buffer over-read (bsc#1149110). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-721=1 Package List: - openSUSE Leap 15.1 (x86_64): memcached-1.5.6-lp151.4.3.1 memcached-debuginfo-1.5.6-lp151.4.3.1 memcached-debugsource-1.5.6-lp151.4.3.1 memcached-devel-1.5.6-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-11596.html https://www.suse.com/security/cve/CVE-2019-15026.html https://bugzilla.suse.com/1133817 https://bugzilla.suse.com/1149110

1 0

openSUSE-SU-2020:0720-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0720-1 Rating: important References: #1171456 #1171457 #1171458 Cross-References: CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 to 2.3.10 fixes the following issues: Security issues fixed: - CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457). - CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458). - CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456). Non-security issues fixed: - The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-720=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debugsource-2.3.10-lp151.2.9.1 dovecot23-devel-2.3.10-lp151.2.9.1 dovecot23-fts-2.3.10-lp151.2.9.1 dovecot23-fts-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-solr-2.3.10-lp151.2.9.1 dovecot23-fts-solr-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-squat-2.3.10-lp151.2.9.1 dovecot23-fts-squat-debuginfo-2.3.10-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-10957.html https://www.suse.com/security/cve/CVE-2020-10958.html https://www.suse.com/security/cve/CVE-2020-10967.html https://bugzilla.suse.com/1171456 https://bugzilla.suse.com/1171457 https://bugzilla.suse.com/1171458

1 0

openSUSE-SU-2020:0716-1: moderate: Security update for gcc9
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for gcc9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0716-1 Rating: moderate References: #1114592 #1135254 #1141897 #1142649 #1142654 #1148517 #1149145 #1149995 #1152590 #1167898 Cross-References: CVE-2019-14250 CVE-2019-15847 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on: https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages. To use it, install "gcc9" or "gcc9-c++" or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it. Security issues fixed: - CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145) - CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649) Non-security issues fixed: - Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254) - Fixed miscompilation for vector shift on s390. (bsc#1141897) - Includes a fix for Internal compiler error when building HepMC (bsc#1167898) - Includes fix for binutils version parsing - Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10. - Add gcc9 autodetect -g at lto link (bsc#1149995) - Install go tool buildid for bootstrapping go Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-716=1 Package List: - openSUSE Leap 15.1 (noarch): gcc9-info-9.3.1+git1296-lp151.2.2 - openSUSE Leap 15.1 (x86_64): cpp9-9.3.1+git1296-lp151.2.2 cpp9-debuginfo-9.3.1+git1296-lp151.2.2 cross-nvptx-gcc9-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debuginfo-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debugsource-9.3.1+git1296-lp151.2.1 cross-nvptx-newlib9-devel-9.3.1+git1296-lp151.2.1 gcc9-32bit-9.3.1+git1296-lp151.2.2 gcc9-9.3.1+git1296-lp151.2.2 gcc9-ada-32bit-9.3.1+git1296-lp151.2.2 gcc9-ada-9.3.1+git1296-lp151.2.2 gcc9-ada-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-c++-32bit-9.3.1+git1296-lp151.2.2 gcc9-c++-9.3.1+git1296-lp151.2.2 gcc9-c++-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debugsource-9.3.1+git1296-lp151.2.2 gcc9-fortran-32bit-9.3.1+git1296-lp151.2.2 gcc9-fortran-9.3.1+git1296-lp151.2.2 gcc9-fortran-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-go-32bit-9.3.1+git1296-lp151.2.2 gcc9-go-9.3.1+git1296-lp151.2.2 gcc9-go-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-locale-9.3.1+git1296-lp151.2.2 libada9-32bit-9.3.1+git1296-lp151.2.2 libada9-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libada9-9.3.1+git1296-lp151.2.2 libada9-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-32bit-9.3.1+git1296-lp151.2.2 libasan5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-9.3.1+git1296-lp151.2.2 libasan5-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-32bit-9.3.1+git1296-lp151.2.2 libatomic1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-9.3.1+git1296-lp151.2.2 libatomic1-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-9.3.1+git1296-lp151.2.2 libgcc_s1-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-9.3.1+git1296-lp151.2.2 libgfortran5-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-32bit-9.3.1+git1296-lp151.2.2 libgo14-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-9.3.1+git1296-lp151.2.2 libgo14-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-32bit-9.3.1+git1296-lp151.2.2 libgomp1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-9.3.1+git1296-lp151.2.2 libgomp1-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-32bit-9.3.1+git1296-lp151.2.2 libitm1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-9.3.1+git1296-lp151.2.2 libitm1-debuginfo-9.3.1+git1296-lp151.2.2 liblsan0-9.3.1+git1296-lp151.2.2 liblsan0-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-9.3.1+git1296-lp151.2.2 libquadmath0-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-9.3.1+git1296-lp151.2.2 libstdc++6-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-9.3.1+git1296-lp151.2.2 libstdc++6-locale-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-9.3.1+git1296-lp151.2.2 libtsan0-9.3.1+git1296-lp151.2.2 libtsan0-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-32bit-9.3.1+git1296-lp151.2.2 libubsan1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-9.3.1+git1296-lp151.2.2 libubsan1-debuginfo-9.3.1+git1296-lp151.2.2 References: https://www.suse.com/security/cve/CVE-2019-14250.html https://www.suse.com/security/cve/CVE-2019-15847.html https://bugzilla.suse.com/1114592 https://bugzilla.suse.com/1135254 https://bugzilla.suse.com/1141897 https://bugzilla.suse.com/1142649 https://bugzilla.suse.com/1142654 https://bugzilla.suse.com/1148517 https://bugzilla.suse.com/1149145 https://bugzilla.suse.com/1149995 https://bugzilla.suse.com/1152590 https://bugzilla.suse.com/1167898

1 0

openSUSE-RU-2020:0714-1: moderate: Recommended update for go1.10
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0714-1 Rating: moderate References: #1170826 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.10 fixes the following issues: - Add 'binutils-gold' as a dependency for arm and aarch64 architectures. (bsc#1170826) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-714=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go1.10-1.10.8-lp151.2.6.1 go1.10-doc-1.10.8-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): go1.10-race-1.10.8-lp151.2.6.1 References: https://bugzilla.suse.com/1170826

1 0

openSUSE-RU-2020:0715-1: moderate: Recommended update for google-compute-engine
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0715-1 Rating: moderate References: #1170719 #1170720 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for google-compute-engine contain the following fix: - Do not add the created user to the adm, docker, or lxd groups if they exist. (bsc#1170719, bsc#1170720) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-715=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): google-compute-engine-debugsource-20190801-lp151.2.22.1 google-compute-engine-oslogin-20190801-lp151.2.22.1 google-compute-engine-oslogin-debuginfo-20190801-lp151.2.22.1 - openSUSE Leap 15.1 (x86_64): google-compute-engine-oslogin-32bit-20190801-lp151.2.22.1 google-compute-engine-oslogin-32bit-debuginfo-20190801-lp151.2.22.1 - openSUSE Leap 15.1 (noarch): google-compute-engine-init-20190801-lp151.2.22.1 References: https://bugzilla.suse.com/1170719 https://bugzilla.suse.com/1170720

1 0

openSUSE-SU-2020:0711-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 25 May '20

25 May '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0711-1 Rating: important References: #1171928 Cross-References: CVE-2020-9484 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt ) * CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a remote code execution via deserialization of the file under their control. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-711=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.35-lp151.3.18.1 tomcat-admin-webapps-9.0.35-lp151.3.18.1 tomcat-docs-webapp-9.0.35-lp151.3.18.1 tomcat-el-3_0-api-9.0.35-lp151.3.18.1 tomcat-embed-9.0.35-lp151.3.18.1 tomcat-javadoc-9.0.35-lp151.3.18.1 tomcat-jsp-2_3-api-9.0.35-lp151.3.18.1 tomcat-jsvc-9.0.35-lp151.3.18.1 tomcat-lib-9.0.35-lp151.3.18.1 tomcat-servlet-4_0-api-9.0.35-lp151.3.18.1 tomcat-webapps-9.0.35-lp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-9484.html https://bugzilla.suse.com/1171928

1 0

openSUSE-RU-2020:0713-1: moderate: Recommended update for mokutil
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for mokutil ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0713-1 Rating: moderate References: #1170889 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mokutil fixes the following issues: - Fix for 'mokutil' to check the error number when listing keys. (bsc#1170889) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-713=1 Package List: - openSUSE Leap 15.1 (x86_64): mokutil-0.3.0-lp151.6.4.1 mokutil-debuginfo-0.3.0-lp151.6.4.1 mokutil-debugsource-0.3.0-lp151.6.4.1 References: https://bugzilla.suse.com/1170889

1 0

openSUSE-RU-2020:0712-1: moderate: Recommended update for bsf
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for bsf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0712-1 Rating: moderate References: #1134000 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bsf fixes the following issues: - Add missing Java classes that required for Bean Scripting Framework. (bsc#1134000) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-712=1 Package List: - openSUSE Leap 15.1 (noarch): bsf-2.4.0-lp151.5.3.1 bsf-javadoc-2.4.0-lp151.5.3.1 References: https://bugzilla.suse.com/1134000

1 0

openSUSE-RU-2020:0710-1: moderate: Recommended update for libgcrypt
by maintenance＠opensuse.org 24 May '20

24 May '20

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0710-1 Rating: moderate References: #1171872 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgcrypt fixes the following issues: - FIPS: RSA/DSA/ECC test_keys() print out debug messages only in debug mode (bsc#1171872) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-710=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libgcrypt-cavs-1.8.2-lp151.9.25.1 libgcrypt-cavs-debuginfo-1.8.2-lp151.9.25.1 libgcrypt-debugsource-1.8.2-lp151.9.25.1 libgcrypt-devel-1.8.2-lp151.9.25.1 libgcrypt-devel-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-1.8.2-lp151.9.25.1 libgcrypt20-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-hmac-1.8.2-lp151.9.25.1 - openSUSE Leap 15.1 (x86_64): libgcrypt-devel-32bit-1.8.2-lp151.9.25.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-32bit-1.8.2-lp151.9.25.1 libgcrypt20-32bit-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-hmac-32bit-1.8.2-lp151.9.25.1 References: https://bugzilla.suse.com/1171872

1 0

openSUSE-RU-2020:0708-1: moderate: Recommended update for git
by maintenance＠opensuse.org 24 May '20

24 May '20

openSUSE Recommended Update: Recommended update for git ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0708-1 Rating: moderate References: #1149792 #1169786 #1169936 #1170302 #1170741 #1170939 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for git to version 2.26.2 fixes the following issues: - Fixed git-daemon not starting after conversion from sysvinit to systemd service (bsc#1169605). - Enabled access for git-daemon in firewall configuration (bsc#1170302). - Fixed problems with recent switch to protocol v2, which caused fetches transferring unreasonable amount of data (bsc#1170741). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-708=1 Package List: - openSUSE Leap 15.1 (x86_64): git-2.26.2-lp151.4.12.1 git-arch-2.26.2-lp151.4.12.1 git-core-2.26.2-lp151.4.12.1 git-core-debuginfo-2.26.2-lp151.4.12.1 git-credential-gnome-keyring-2.26.2-lp151.4.12.1 git-credential-gnome-keyring-debuginfo-2.26.2-lp151.4.12.1 git-credential-libsecret-2.26.2-lp151.4.12.1 git-credential-libsecret-debuginfo-2.26.2-lp151.4.12.1 git-cvs-2.26.2-lp151.4.12.1 git-daemon-2.26.2-lp151.4.12.1 git-daemon-debuginfo-2.26.2-lp151.4.12.1 git-debuginfo-2.26.2-lp151.4.12.1 git-debugsource-2.26.2-lp151.4.12.1 git-email-2.26.2-lp151.4.12.1 git-gui-2.26.2-lp151.4.12.1 git-p4-2.26.2-lp151.4.12.1 git-svn-2.26.2-lp151.4.12.1 git-svn-debuginfo-2.26.2-lp151.4.12.1 git-web-2.26.2-lp151.4.12.1 gitk-2.26.2-lp151.4.12.1 - openSUSE Leap 15.1 (noarch): git-doc-2.26.2-lp151.4.12.1 References: https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1169786 https://bugzilla.suse.com/1169936 https://bugzilla.suse.com/1170302 https://bugzilla.suse.com/1170741 https://bugzilla.suse.com/1170939

1 0

openSUSE-SU-2020:0709-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 May '20

24 May '20

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0709-1 Rating: important References: Cross-References: CVE-2020-6464 CVE-2020-6831 Affected Products: openSUSE Leap 15.1:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 68.0.3618.104 - CHR-7909 Update chromium on desktop-stable-81-3618 to 81.0.4044.138 - CVE-2020-6831, CVE-2020-6464 - DNA-85609 [Mac] Tabs shrinking & disappearing - DNA-85629 Crash at opera::DownloadButtonPanel::ShouldShowCancelButton() - DNA-85669 Add mocking of AddressDropdownModel in AddressBarControllerTest - DNA-85678 Wrong badge icon on pages with mixed content on desktop-stable-81-3618 - DNA-85820 Flags are blue in default [D] state after restart - DNA-85822 Full screen snap on pkobp.pl - DNA-86077 Problem to upload .JPG file as an wallpaper - DNA-86165 Downloads list doesn’t returns to its original state after clearing search filter - DNA-86236 [Mac] Plus button click area too small - DNA-86241 X tab button is not visible - DNA-86217 Fix performance issue with Background Worker Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2020-709=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-68.0.3618.104-lp151.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-6464.html https://www.suse.com/security/cve/CVE-2020-6831.html

1 0

openSUSE-RU-2020:0707-1: moderate: Recommended update for man-pages
by maintenance＠opensuse.org 24 May '20

24 May '20

openSUSE Recommended Update: Recommended update for man-pages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0707-1 Rating: moderate References: #1160568 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for man-pages fixes the following issues: - Move 'man.7' and 'mdoc.7' into separate directories to avoid conflicts with mandoc which is a light-weight man alternative for small systems. (bsc#1160568). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-707=1 Package List: - openSUSE Leap 15.1 (noarch): man-pages-4.16-lp151.4.6.1 References: https://bugzilla.suse.com/1160568

1 0

openSUSE-SU-2020:0703-1: moderate: Security update for ant
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for ant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0703-1 Rating: moderate References: #1100053 #1133997 #1134001 Cross-References: CVE-2018-10886 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053). Non-security issues fixed: - Add rhino to the ant-apache-bsf optional tasks (bsc#1134001). - Remove jakarta-commons-logging dependencies (bsc#1133997). - Use apache-commons-logging in optional tasks This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-703=1 Package List: - openSUSE Leap 15.1 (noarch): ant-1.9.10-lp151.4.3.1 ant-antlr-1.9.10-lp151.4.3.1 ant-apache-bcel-1.9.10-lp151.4.3.1 ant-apache-bsf-1.9.10-lp151.4.3.1 ant-apache-log4j-1.9.10-lp151.4.3.1 ant-apache-oro-1.9.10-lp151.4.3.1 ant-apache-regexp-1.9.10-lp151.4.3.1 ant-apache-resolver-1.9.10-lp151.4.3.1 ant-apache-xalan2-1.9.10-lp151.4.3.1 ant-commons-logging-1.9.10-lp151.4.3.1 ant-commons-net-1.9.10-lp151.4.3.1 ant-javamail-1.9.10-lp151.4.3.1 ant-jdepend-1.9.10-lp151.4.3.1 ant-jmf-1.9.10-lp151.4.3.1 ant-jsch-1.9.10-lp151.4.3.1 ant-junit-1.9.10-lp151.4.3.1 ant-manual-1.9.10-lp151.4.3.1 ant-scripts-1.9.10-lp151.4.3.1 ant-swing-1.9.10-lp151.4.3.1 ant-testutil-1.9.10-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10886.html https://bugzilla.suse.com/1100053 https://bugzilla.suse.com/1133997 https://bugzilla.suse.com/1134001

1 0

openSUSE-RU-2020:0702-1: important: Recommended update for permissions
by maintenance＠opensuse.org 23 May '20

23 May '20

openSUSE Recommended Update: Recommended update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0702-1 Rating: important References: #1171173 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for permissions fixes the following issues: - Remove setuid bit for newgidmap and newuidmap in paranoid profile. (bsc#1171173) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-702=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): permissions-20181116-lp151.4.21.1 permissions-debuginfo-20181116-lp151.4.21.1 permissions-debugsource-20181116-lp151.4.21.1 - openSUSE Leap 15.1 (noarch): permissions-zypp-plugin-20181116-lp151.4.21.1 References: https://bugzilla.suse.com/1171173

1 0

openSUSE-RU-2020:0706-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 23 May '20

23 May '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0706-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: - Update to version 0.6.11: * Bugfixes: + Fixed MPRIS missing art url when playing albums with embedded cover. + Fixed updating local non collection songs when manually unsetting cover. + Fixed infinite loop and preceding crash when CSS background-color was set in qt5ct. + Fixed UI freeze when updating the database from a large Subsonic or Tidal collection. + Fixed crash when CD loading fails in devices. + Fixed CD devices showing up with having 0 songs after loading. + Fixed the album cover loading indicator being stuck if no cover providers were available. + Fixed the playing widget not updating artist, album or title after metadata has changed for a song when no album cover was loaded. * Enhancements: + Sort songs in collection by song title instead of track if previous grouping is not the album. + Added option to switch on/off automatically searching for album covers to context settings. + Reset last played song when playlist is finished. + Checking content type of received HTTP request for image when receiving album covers. + Added option to scrobbler setting for turning off login error popup. + Made MusicBrainz and Discogs cover providers respect rate limiting. * New features: + Added option to show/hide sidebar. + Added settings for selecting album cover and lyrics providers. + Added album covers from Musixmatch and Spotify. + Added lyrics from Genius, Musixmatch and ChartLyrics. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-706=1 Package List: - openSUSE Leap 15.1 (x86_64): strawberry-0.6.11-lp151.2.21.1 strawberry-debuginfo-0.6.11-lp151.2.21.1 strawberry-debugsource-0.6.11-lp151.2.21.1 References:

1 0

openSUSE-RU-2020:0705-1: moderate: Recommended update for inkscape
by maintenance＠opensuse.org 23 May '20

23 May '20

openSUSE Recommended Update: Recommended update for inkscape ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0705-1 Rating: moderate References: #1171258 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for inkscape fixes the following issue: - Remove inkscape-extension-skencil completely for Leap 15.2 by now. (jsc#SLE-12254, bsc#1171258) The extension was built only on openSUSE in the past, nowadays: * Tumbleweed does not build it since skencil does not support python 3. * SLE has never built and shipped the extension. Hence this submission actually disables the extension on Leap 15.2 and above to keep it consistent with SLE and TW. The stub for packaging the extension is still kept in the spec for future needs when we bring skencil back to the release. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-705=1 Package List: - openSUSE Leap 15.1 (x86_64): inkscape-0.92.2-lp151.6.6.1 inkscape-debuginfo-0.92.2-lp151.6.6.1 inkscape-debugsource-0.92.2-lp151.6.6.1 inkscape-extensions-dia-0.92.2-lp151.6.6.1 inkscape-extensions-extra-0.92.2-lp151.6.6.1 inkscape-extensions-fig-0.92.2-lp151.6.6.1 inkscape-extensions-gimp-0.92.2-lp151.6.6.1 inkscape-extensions-skencil-0.92.2-lp151.6.6.1 - openSUSE Leap 15.1 (noarch): inkscape-lang-0.92.2-lp151.6.6.1 References: https://bugzilla.suse.com/1171258

1 0

openSUSE-SU-2020:0704-1: moderate: Security update for freetype2
by opensuse-security＠opensuse.org 23 May '20

23 May '20

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: #1079603 #1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for freetype2 to version 2.10.1 fixes the following issues: Security issue fixed: - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c (bsc#1079603). Non-security issues fixed: - Update to version 2.10.1 * The bytecode hinting of OpenType variation fonts was flawed, since the data in the `CVAR' table wasn't correctly applied. * Auto-hinter support for Mongolian. * The handling of the default character in PCF fonts as introduced in version 2.10.0 was partially broken, causing premature abortion of charmap iteration for many fonts. * If `FT_Set_Named_Instance' was called with the same arguments twice in a row, the function returned an incorrect error code the second time. * Direct rendering using FT_RASTER_FLAG_DIRECT crashed (bug introduced in version 2.10.0). * Increased precision while computing OpenType font variation instances. * The flattening algorithm of cubic Bezier curves was slightly changed to make it faster. This can cause very subtle rendering changes, which aren't noticeable by the eye, however. * The auto-hinter now disables hinting if there are blue zones defined for a `style' (i.e., a certain combination of a script and its related typographic features) but the font doesn't contain any characters needed to set up at least one blue zone. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * A bunch of new functions has been added to access and process COLR/CPAL data of OpenType fonts with color-layered glyphs. * As a GSoC 2018 project, Nikhil Ramakrishnan completely overhauled and modernized the API reference. * The logic for computing the global ascender, descender, and height of OpenType fonts has been slightly adjusted for consistency. * `TT_Set_MM_Blend' could fail if called repeatedly with the same arguments. * The precision of handling deltas in Variation Fonts has been increased.The problem did only show up with multidimensional designspaces. * New function `FT_Library_SetLcdGeometry' to set up the geometry of LCD subpixels. * FreeType now uses the `defaultChar' property of PCF fonts to set the glyph for the undefined character at glyph index 0 (as FreeType already does for all other supported font formats). As a consequence, the order of glyphs of a PCF font if accessed with FreeType can be different now compared to previous versions. This change doesn't affect PCF font access with cmaps. * `FT_Select_Charmap' has been changed to allow parameter value `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT formats to access built-in cmaps that don't have a predefined `FT_Encoding' value. * A previously reserved field in the `FT_GlyphSlotRec' structure now holds the glyph index. * The usual round of fuzzer bug fixes to better reject malformed fonts. * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have been removed.These two functions were public by oversight only and were never documented. * A new function `FT_Error_String' returns descriptions of error codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is defined. * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new functions limited to Adobe MultiMaster fonts to directly set and get the weight vector. - Enable subpixel rendering with infinality config: - Re-enable freetype-config, there is just too many fallouts. - Update to version 2.9.1 * Type 1 fonts containing flex features were not rendered correctly (bug introduced in version 2.9). * CVE-2018-6942: Older FreeType versions can crash with certain malformed variation fonts. * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage. * Emboldening of bitmaps didn't work correctly sometimes, showing various artifacts (bug introduced in version 2.8.1). * The auto-hinter script ranges have been updated for Unicode 11. No support for new scripts have been added, however, with the exception of Georgian Mtavruli. - freetype-config is now deprecated by upstream and not enabled by default. - Update to version 2.10.1 * The `ftmulti' demo program now supports multiple hidden axes with the same name tag. * `ftview', `ftstring', and `ftgrid' got a `-k' command line option to emulate a sequence of keystrokes at start-up. * `ftview', `ftstring', and `ftgrid' now support screen dumping to a PNG file. * The bytecode debugger, `ttdebug', now supports variation TrueType fonts; a variation font instance can be selected with the new `-d' command line option. - Add tarball signatures and freetype2.keyring - Update to version 2.10.0 * The `ftdump' demo program has new options `-c' and `-C' to display charmaps in compact and detailed format, respectively. Option `-V' has been removed. * The `ftview', `ftstring', and `ftgrid' demo programs use a new command line option `-d' to specify the program window's width, height, and color depth. * The `ftview' demo program now displays red boxes for zero-width glyphs. * `ftglyph' has limited support to display fonts with color-layered glyphs.This will be improved later on. * `ftgrid' can now display bitmap fonts also. * The `ttdebug' demo program has a new option `-f' to select a member of a TrueType collection (TTC). * Other various improvements to the demo programs. - Remove "Supplements: fonts-config" to avoid accidentally pulling in Qt dependencies on some non-Qt based desktops.(bsc#1091109) fonts-config is fundamental but ft2demos seldom installs by end users. only fonts-config maintainers/debuggers may use ft2demos along to debug some issues. - Update to version 2.9.1 * No changelog upstream. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-704=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): freetype2-debugsource-2.10.1-lp151.4.3.1 freetype2-devel-2.10.1-lp151.4.3.1 libfreetype6-2.10.1-lp151.4.3.1 libfreetype6-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): freetype2-devel-32bit-2.10.1-lp151.4.3.1 ft2demos-2.10.1-lp151.4.3.1 ftbench-2.10.1-lp151.4.3.1 ftdiff-2.10.1-lp151.4.3.1 ftdump-2.10.1-lp151.4.3.1 ftgamma-2.10.1-lp151.4.3.1 ftgrid-2.10.1-lp151.4.3.1 ftinspect-2.10.1-lp151.4.3.1 ftlint-2.10.1-lp151.4.3.1 ftmulti-2.10.1-lp151.4.3.1 ftstring-2.10.1-lp151.4.3.1 ftvalid-2.10.1-lp151.4.3.1 ftview-2.10.1-lp151.4.3.1 libfreetype6-32bit-2.10.1-lp151.4.3.1 libfreetype6-32bit-debuginfo-2.10.1-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): freetype2-profile-tti35-2.10.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-6942.html https://bugzilla.suse.com/1079603 https://bugzilla.suse.com/1091109

1 0

openSUSE-RU-2020:0701-1: moderate: Recommended update for mozilla-nss
by maintenance＠opensuse.org 23 May '20

23 May '20

openSUSE Recommended Update: Recommended update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0701-1 Rating: moderate References: #1170908 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mozilla-nss fixes the following issues: The following issues are fixed: - Add AES Keywrap POST. - Accept EACCES in lieu of ENOENT when trying to access /proc/sys/crypto/fips_enabled (bsc#1170908). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-701=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.47.1-lp151.2.20.1 libfreebl3-debuginfo-3.47.1-lp151.2.20.1 libfreebl3-hmac-3.47.1-lp151.2.20.1 libsoftokn3-3.47.1-lp151.2.20.1 libsoftokn3-debuginfo-3.47.1-lp151.2.20.1 libsoftokn3-hmac-3.47.1-lp151.2.20.1 mozilla-nss-3.47.1-lp151.2.20.1 mozilla-nss-certs-3.47.1-lp151.2.20.1 mozilla-nss-certs-debuginfo-3.47.1-lp151.2.20.1 mozilla-nss-debuginfo-3.47.1-lp151.2.20.1 mozilla-nss-debugsource-3.47.1-lp151.2.20.1 mozilla-nss-devel-3.47.1-lp151.2.20.1 mozilla-nss-sysinit-3.47.1-lp151.2.20.1 mozilla-nss-sysinit-debuginfo-3.47.1-lp151.2.20.1 mozilla-nss-tools-3.47.1-lp151.2.20.1 mozilla-nss-tools-debuginfo-3.47.1-lp151.2.20.1 - openSUSE Leap 15.1 (x86_64): libfreebl3-32bit-3.47.1-lp151.2.20.1 libfreebl3-32bit-debuginfo-3.47.1-lp151.2.20.1 libfreebl3-hmac-32bit-3.47.1-lp151.2.20.1 libsoftokn3-32bit-3.47.1-lp151.2.20.1 libsoftokn3-32bit-debuginfo-3.47.1-lp151.2.20.1 libsoftokn3-hmac-32bit-3.47.1-lp151.2.20.1 mozilla-nss-32bit-3.47.1-lp151.2.20.1 mozilla-nss-32bit-debuginfo-3.47.1-lp151.2.20.1 mozilla-nss-certs-32bit-3.47.1-lp151.2.20.1 mozilla-nss-certs-32bit-debuginfo-3.47.1-lp151.2.20.1 mozilla-nss-sysinit-32bit-3.47.1-lp151.2.20.1 mozilla-nss-sysinit-32bit-debuginfo-3.47.1-lp151.2.20.1 References: https://bugzilla.suse.com/1170908

1 0

openSUSE-RU-2020:0700-1: moderate: Recommended update for syslog-ng
by maintenance＠opensuse.org 23 May '20

23 May '20

openSUSE Recommended Update: Recommended update for syslog-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0700-1 Rating: moderate References: #1169385 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for syslog-ng fixes the following issues: - removed creating news log files from the RPM %post section. Added syslog-ng.conf options to create files/directories automatically, and commenting the relevant part out. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-700=1 Package List: - openSUSE Leap 15.1 (x86_64): libevtlog-3_19-0-3.19.1-lp151.3.6.1 libevtlog-3_19-0-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-3.19.1-lp151.3.6.1 syslog-ng-curl-3.19.1-lp151.3.6.1 syslog-ng-curl-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-debugsource-3.19.1-lp151.3.6.1 syslog-ng-devel-3.19.1-lp151.3.6.1 syslog-ng-geoip-3.19.1-lp151.3.6.1 syslog-ng-geoip-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-java-3.19.1-lp151.3.6.1 syslog-ng-java-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-python-3.19.1-lp151.3.6.1 syslog-ng-python-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-redis-3.19.1-lp151.3.6.1 syslog-ng-redis-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-smtp-3.19.1-lp151.3.6.1 syslog-ng-smtp-debuginfo-3.19.1-lp151.3.6.1 syslog-ng-sql-3.19.1-lp151.3.6.1 syslog-ng-sql-debuginfo-3.19.1-lp151.3.6.1 References: https://bugzilla.suse.com/1169385

1 0