May 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0725-1: moderate: Recommended update for NetworkManager-openvpn
by maintenance＠opensuse.org 26 May '20

26 May '20

openSUSE Recommended Update: Recommended update for NetworkManager-openvpn ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0725-1 Rating: moderate References: #1127794 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for NetworkManager-openvpn fixes the following issues: - Fix for Network Manager for proper termination in openVPN when waiting for processes to exit. (bsc#1127794) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-725=1 Package List: - openSUSE Leap 15.1 (x86_64): NetworkManager-openvpn-1.8.2-lp151.4.6.1 NetworkManager-openvpn-debuginfo-1.8.2-lp151.4.6.1 NetworkManager-openvpn-debugsource-1.8.2-lp151.4.6.1 NetworkManager-openvpn-gnome-1.8.2-lp151.4.6.1 NetworkManager-openvpn-gnome-debuginfo-1.8.2-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): NetworkManager-openvpn-lang-1.8.2-lp151.4.6.1 References: https://bugzilla.suse.com/1127794

1 0

openSUSE-SU-2020:0721-1: moderate: Security update for memcached
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for memcached ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0721-1 Rating: moderate References: #1133817 #1149110 Cross-References: CVE-2019-11596 CVE-2019-15026 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for memcached fixes the following issues: Security issue fixed: - CVE-2019-11596: Fixed a NULL pointer dereference in process_lru_command (bsc#1133817). - CVE-2019-15026: Fixed a stack-based buffer over-read (bsc#1149110). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-721=1 Package List: - openSUSE Leap 15.1 (x86_64): memcached-1.5.6-lp151.4.3.1 memcached-debuginfo-1.5.6-lp151.4.3.1 memcached-debugsource-1.5.6-lp151.4.3.1 memcached-devel-1.5.6-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-11596.html https://www.suse.com/security/cve/CVE-2019-15026.html https://bugzilla.suse.com/1133817 https://bugzilla.suse.com/1149110

1 0

openSUSE-SU-2020:0720-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0720-1 Rating: important References: #1171456 #1171457 #1171458 Cross-References: CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 to 2.3.10 fixes the following issues: Security issues fixed: - CVE-2020-10957: Fixed a crash caused by malformed NOOP commands (bsc#1171457). - CVE-2020-10958: Fixed a use-after-free when receiving too many newlines (bsc#1171458). - CVE-2020-10967: Fixed a crash in the lmtp and submission components caused by mails with empty quoted localparts (bsc#1171456). Non-security issues fixed: - The update to 2.3.10 fixes several bugs. Please refer to https://dovecot.org/doc/NEWS for a complete list of changes. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-720=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-2.3.10-lp151.2.9.1 dovecot23-backend-mysql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-2.3.10-lp151.2.9.1 dovecot23-backend-pgsql-debuginfo-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-2.3.10-lp151.2.9.1 dovecot23-backend-sqlite-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debuginfo-2.3.10-lp151.2.9.1 dovecot23-debugsource-2.3.10-lp151.2.9.1 dovecot23-devel-2.3.10-lp151.2.9.1 dovecot23-fts-2.3.10-lp151.2.9.1 dovecot23-fts-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-2.3.10-lp151.2.9.1 dovecot23-fts-lucene-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-solr-2.3.10-lp151.2.9.1 dovecot23-fts-solr-debuginfo-2.3.10-lp151.2.9.1 dovecot23-fts-squat-2.3.10-lp151.2.9.1 dovecot23-fts-squat-debuginfo-2.3.10-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-10957.html https://www.suse.com/security/cve/CVE-2020-10958.html https://www.suse.com/security/cve/CVE-2020-10967.html https://bugzilla.suse.com/1171456 https://bugzilla.suse.com/1171457 https://bugzilla.suse.com/1171458

1 0

openSUSE-SU-2020:0716-1: moderate: Security update for gcc9
by opensuse-security＠opensuse.org 26 May '20

26 May '20

openSUSE Security Update: Security update for gcc9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0716-1 Rating: moderate References: #1114592 #1135254 #1141897 #1142649 #1142654 #1148517 #1149145 #1149995 #1152590 #1167898 Cross-References: CVE-2019-14250 CVE-2019-15847 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on: https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages. To use it, install "gcc9" or "gcc9-c++" or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it. Security issues fixed: - CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145) - CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649) Non-security issues fixed: - Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254) - Fixed miscompilation for vector shift on s390. (bsc#1141897) - Includes a fix for Internal compiler error when building HepMC (bsc#1167898) - Includes fix for binutils version parsing - Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10. - Add gcc9 autodetect -g at lto link (bsc#1149995) - Install go tool buildid for bootstrapping go Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-716=1 Package List: - openSUSE Leap 15.1 (noarch): gcc9-info-9.3.1+git1296-lp151.2.2 - openSUSE Leap 15.1 (x86_64): cpp9-9.3.1+git1296-lp151.2.2 cpp9-debuginfo-9.3.1+git1296-lp151.2.2 cross-nvptx-gcc9-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debuginfo-9.3.1+git1296-lp151.2.1 cross-nvptx-gcc9-debugsource-9.3.1+git1296-lp151.2.1 cross-nvptx-newlib9-devel-9.3.1+git1296-lp151.2.1 gcc9-32bit-9.3.1+git1296-lp151.2.2 gcc9-9.3.1+git1296-lp151.2.2 gcc9-ada-32bit-9.3.1+git1296-lp151.2.2 gcc9-ada-9.3.1+git1296-lp151.2.2 gcc9-ada-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-c++-32bit-9.3.1+git1296-lp151.2.2 gcc9-c++-9.3.1+git1296-lp151.2.2 gcc9-c++-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-debugsource-9.3.1+git1296-lp151.2.2 gcc9-fortran-32bit-9.3.1+git1296-lp151.2.2 gcc9-fortran-9.3.1+git1296-lp151.2.2 gcc9-fortran-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-go-32bit-9.3.1+git1296-lp151.2.2 gcc9-go-9.3.1+git1296-lp151.2.2 gcc9-go-debuginfo-9.3.1+git1296-lp151.2.2 gcc9-locale-9.3.1+git1296-lp151.2.2 libada9-32bit-9.3.1+git1296-lp151.2.2 libada9-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libada9-9.3.1+git1296-lp151.2.2 libada9-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-32bit-9.3.1+git1296-lp151.2.2 libasan5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libasan5-9.3.1+git1296-lp151.2.2 libasan5-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-32bit-9.3.1+git1296-lp151.2.2 libatomic1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libatomic1-9.3.1+git1296-lp151.2.2 libatomic1-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-9.3.1+git1296-lp151.2.2 libgcc_s1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgcc_s1-9.3.1+git1296-lp151.2.2 libgcc_s1-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-9.3.1+git1296-lp151.2.2 libgfortran5-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgfortran5-9.3.1+git1296-lp151.2.2 libgfortran5-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-32bit-9.3.1+git1296-lp151.2.2 libgo14-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgo14-9.3.1+git1296-lp151.2.2 libgo14-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-32bit-9.3.1+git1296-lp151.2.2 libgomp1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libgomp1-9.3.1+git1296-lp151.2.2 libgomp1-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-32bit-9.3.1+git1296-lp151.2.2 libitm1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libitm1-9.3.1+git1296-lp151.2.2 libitm1-debuginfo-9.3.1+git1296-lp151.2.2 liblsan0-9.3.1+git1296-lp151.2.2 liblsan0-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-9.3.1+git1296-lp151.2.2 libquadmath0-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libquadmath0-9.3.1+git1296-lp151.2.2 libquadmath0-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-9.3.1+git1296-lp151.2.2 libstdc++6-debuginfo-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-devel-gcc9-9.3.1+git1296-lp151.2.2 libstdc++6-locale-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-32bit-9.3.1+git1296-lp151.2.2 libstdc++6-pp-gcc9-9.3.1+git1296-lp151.2.2 libtsan0-9.3.1+git1296-lp151.2.2 libtsan0-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-32bit-9.3.1+git1296-lp151.2.2 libubsan1-32bit-debuginfo-9.3.1+git1296-lp151.2.2 libubsan1-9.3.1+git1296-lp151.2.2 libubsan1-debuginfo-9.3.1+git1296-lp151.2.2 References: https://www.suse.com/security/cve/CVE-2019-14250.html https://www.suse.com/security/cve/CVE-2019-15847.html https://bugzilla.suse.com/1114592 https://bugzilla.suse.com/1135254 https://bugzilla.suse.com/1141897 https://bugzilla.suse.com/1142649 https://bugzilla.suse.com/1142654 https://bugzilla.suse.com/1148517 https://bugzilla.suse.com/1149145 https://bugzilla.suse.com/1149995 https://bugzilla.suse.com/1152590 https://bugzilla.suse.com/1167898

1 0

openSUSE-RU-2020:0714-1: moderate: Recommended update for go1.10
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0714-1 Rating: moderate References: #1170826 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.10 fixes the following issues: - Add 'binutils-gold' as a dependency for arm and aarch64 architectures. (bsc#1170826) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-714=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go1.10-1.10.8-lp151.2.6.1 go1.10-doc-1.10.8-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): go1.10-race-1.10.8-lp151.2.6.1 References: https://bugzilla.suse.com/1170826

1 0

openSUSE-RU-2020:0715-1: moderate: Recommended update for google-compute-engine
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for google-compute-engine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0715-1 Rating: moderate References: #1170719 #1170720 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for google-compute-engine contain the following fix: - Do not add the created user to the adm, docker, or lxd groups if they exist. (bsc#1170719, bsc#1170720) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-715=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): google-compute-engine-debugsource-20190801-lp151.2.22.1 google-compute-engine-oslogin-20190801-lp151.2.22.1 google-compute-engine-oslogin-debuginfo-20190801-lp151.2.22.1 - openSUSE Leap 15.1 (x86_64): google-compute-engine-oslogin-32bit-20190801-lp151.2.22.1 google-compute-engine-oslogin-32bit-debuginfo-20190801-lp151.2.22.1 - openSUSE Leap 15.1 (noarch): google-compute-engine-init-20190801-lp151.2.22.1 References: https://bugzilla.suse.com/1170719 https://bugzilla.suse.com/1170720

1 0

openSUSE-SU-2020:0711-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 25 May '20

25 May '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0711-1 Rating: important References: #1171928 Cross-References: CVE-2020-9484 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt ) * CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a remote code execution via deserialization of the file under their control. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-711=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.35-lp151.3.18.1 tomcat-admin-webapps-9.0.35-lp151.3.18.1 tomcat-docs-webapp-9.0.35-lp151.3.18.1 tomcat-el-3_0-api-9.0.35-lp151.3.18.1 tomcat-embed-9.0.35-lp151.3.18.1 tomcat-javadoc-9.0.35-lp151.3.18.1 tomcat-jsp-2_3-api-9.0.35-lp151.3.18.1 tomcat-jsvc-9.0.35-lp151.3.18.1 tomcat-lib-9.0.35-lp151.3.18.1 tomcat-servlet-4_0-api-9.0.35-lp151.3.18.1 tomcat-webapps-9.0.35-lp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2020-9484.html https://bugzilla.suse.com/1171928

1 0

openSUSE-RU-2020:0713-1: moderate: Recommended update for mokutil
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for mokutil ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0713-1 Rating: moderate References: #1170889 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mokutil fixes the following issues: - Fix for 'mokutil' to check the error number when listing keys. (bsc#1170889) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-713=1 Package List: - openSUSE Leap 15.1 (x86_64): mokutil-0.3.0-lp151.6.4.1 mokutil-debuginfo-0.3.0-lp151.6.4.1 mokutil-debugsource-0.3.0-lp151.6.4.1 References: https://bugzilla.suse.com/1170889

1 0

openSUSE-RU-2020:0712-1: moderate: Recommended update for bsf
by maintenance＠opensuse.org 25 May '20

25 May '20

openSUSE Recommended Update: Recommended update for bsf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0712-1 Rating: moderate References: #1134000 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bsf fixes the following issues: - Add missing Java classes that required for Bean Scripting Framework. (bsc#1134000) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-712=1 Package List: - openSUSE Leap 15.1 (noarch): bsf-2.4.0-lp151.5.3.1 bsf-javadoc-2.4.0-lp151.5.3.1 References: https://bugzilla.suse.com/1134000

1 0

openSUSE-RU-2020:0710-1: moderate: Recommended update for libgcrypt
by maintenance＠opensuse.org 24 May '20

24 May '20

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0710-1 Rating: moderate References: #1171872 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgcrypt fixes the following issues: - FIPS: RSA/DSA/ECC test_keys() print out debug messages only in debug mode (bsc#1171872) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-710=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libgcrypt-cavs-1.8.2-lp151.9.25.1 libgcrypt-cavs-debuginfo-1.8.2-lp151.9.25.1 libgcrypt-debugsource-1.8.2-lp151.9.25.1 libgcrypt-devel-1.8.2-lp151.9.25.1 libgcrypt-devel-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-1.8.2-lp151.9.25.1 libgcrypt20-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-hmac-1.8.2-lp151.9.25.1 - openSUSE Leap 15.1 (x86_64): libgcrypt-devel-32bit-1.8.2-lp151.9.25.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-32bit-1.8.2-lp151.9.25.1 libgcrypt20-32bit-debuginfo-1.8.2-lp151.9.25.1 libgcrypt20-hmac-32bit-1.8.2-lp151.9.25.1 References: https://bugzilla.suse.com/1171872

1 0