June 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0908-1: important: Security update for curl
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0908-1 Rating: important References: #1173027 Cross-References: CVE-2020-8177 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious server to overwrite a local file when using the -J option (bsc#1173027). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-908=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): curl-7.60.0-lp151.5.12.1 curl-debuginfo-7.60.0-lp151.5.12.1 curl-debugsource-7.60.0-lp151.5.12.1 curl-mini-7.60.0-lp151.5.12.1 curl-mini-debuginfo-7.60.0-lp151.5.12.1 curl-mini-debugsource-7.60.0-lp151.5.12.1 libcurl-devel-7.60.0-lp151.5.12.1 libcurl-mini-devel-7.60.0-lp151.5.12.1 libcurl4-7.60.0-lp151.5.12.1 libcurl4-debuginfo-7.60.0-lp151.5.12.1 libcurl4-mini-7.60.0-lp151.5.12.1 libcurl4-mini-debuginfo-7.60.0-lp151.5.12.1 - openSUSE Leap 15.1 (x86_64): libcurl-devel-32bit-7.60.0-lp151.5.12.1 libcurl4-32bit-7.60.0-lp151.5.12.1 libcurl4-32bit-debuginfo-7.60.0-lp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2020-8177.html https://bugzilla.suse.com/1173027

1 0

openSUSE-SU-2020:0914-1: important: Security update for squid
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0914-1 Rating: important References: #1173304 Cross-References: CVE-2020-14059 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for squid fixes the following issues: squid was updated to version 4.12 Security issue fixed: - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304). Other issues addressed: - Reverted to slow search for new SMP shm pages due to a regression - Fixed an issue where negative responses were never cached - Fixed stall if transaction was overwriting a recently active cache entry This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-914=1 Package List: - openSUSE Leap 15.2 (x86_64): squid-4.12-lp152.2.3.1 squid-debuginfo-4.12-lp152.2.3.1 squid-debugsource-4.12-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14059.html https://bugzilla.suse.com/1173304

1 0

openSUSE-SU-2020:0915-1: important: Security update for mutt
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0915-1 Rating: important References: #1172906 #1172935 #1173197 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mutt fixes the following issues: - CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197). - CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935). - CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-915=1 Package List: - openSUSE Leap 15.2 (x86_64): mutt-1.10.1-lp152.3.3.1 mutt-debuginfo-1.10.1-lp152.3.3.1 mutt-debugsource-1.10.1-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): mutt-doc-1.10.1-lp152.3.3.1 mutt-lang-1.10.1-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-14093.html https://www.suse.com/security/cve/CVE-2020-14154.html https://www.suse.com/security/cve/CVE-2020-14954.html https://bugzilla.suse.com/1172906 https://bugzilla.suse.com/1172935 https://bugzilla.suse.com/1173197

1 0

openSUSE-SU-2020:0912-1: important: Security update for unbound
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for unbound ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0912-1 Rating: important References: #1157268 #1171889 Cross-References: CVE-2019-18934 CVE-2020-12662 CVE-2020-12663 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for unbound fixes the following issues: - CVE-2020-12662: Fixed an issue where unbound could have been tricked into amplifying an incoming query into a large number of queries directed to a target (bsc#1171889). - CVE-2020-12663: Fixed an issue where malformed answers from upstream name servers could have been used to make unbound unresponsive (bsc#1171889). - CVE-2019-18934: Fixed a vulnerability in the IPSec module which could have allowed code execution after receiving a special crafted answer (bsc#1157268). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-912=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libunbound-devel-mini-1.6.8-lp151.8.3.1 libunbound-devel-mini-debuginfo-1.6.8-lp151.8.3.1 libunbound-devel-mini-debugsource-1.6.8-lp151.8.3.1 - openSUSE Leap 15.1 (noarch): unbound-munin-1.6.8-lp151.8.3.1 - openSUSE Leap 15.1 (x86_64): libunbound2-1.6.8-lp151.8.3.1 libunbound2-debuginfo-1.6.8-lp151.8.3.1 unbound-1.6.8-lp151.8.3.1 unbound-anchor-1.6.8-lp151.8.3.1 unbound-anchor-debuginfo-1.6.8-lp151.8.3.1 unbound-debuginfo-1.6.8-lp151.8.3.1 unbound-debugsource-1.6.8-lp151.8.3.1 unbound-devel-1.6.8-lp151.8.3.1 unbound-python-1.6.8-lp151.8.3.1 unbound-python-debuginfo-1.6.8-lp151.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-18934.html https://www.suse.com/security/cve/CVE-2020-12662.html https://www.suse.com/security/cve/CVE-2020-12663.html https://bugzilla.suse.com/1157268 https://bugzilla.suse.com/1171889

1 0

openSUSE-SU-2020:0910-1: important: Security update for squid
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0910-1 Rating: important References: #1173304 Cross-References: CVE-2020-14059 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for squid fixes the following issues: squid was updated to version 4.12 Security issue fixed: - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake (bsc#1173304). Other issues addressed: - Reverted to slow search for new SMP shm pages due to a regression - Fixed an issue where negative responses were never cached - Fixed stall if transaction was overwriting a recently active cache entry This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-910=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.12-lp151.2.21.1 squid-debuginfo-4.12-lp151.2.21.1 squid-debugsource-4.12-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-14059.html https://bugzilla.suse.com/1173304

1 0

openSUSE-SU-2020:0913-1: important: Security update for unbound
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for unbound ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0913-1 Rating: important References: #1157268 #1171889 Cross-References: CVE-2019-18934 CVE-2020-12662 CVE-2020-12663 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for unbound fixes the following issues: - CVE-2020-12662: Fixed an issue where unbound could have been tricked into amplifying an incoming query into a large number of queries directed to a target (bsc#1171889). - CVE-2020-12663: Fixed an issue where malformed answers from upstream name servers could have been used to make unbound unresponsive (bsc#1171889). - CVE-2019-18934: Fixed a vulnerability in the IPSec module which could have allowed code execution after receiving a special crafted answer (bsc#1157268). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-913=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libunbound-devel-mini-1.6.8-lp152.9.3.1 libunbound-devel-mini-debuginfo-1.6.8-lp152.9.3.1 libunbound-devel-mini-debugsource-1.6.8-lp152.9.3.1 - openSUSE Leap 15.2 (noarch): unbound-munin-1.6.8-lp152.9.3.1 - openSUSE Leap 15.2 (x86_64): libunbound2-1.6.8-lp152.9.3.1 libunbound2-debuginfo-1.6.8-lp152.9.3.1 unbound-1.6.8-lp152.9.3.1 unbound-anchor-1.6.8-lp152.9.3.1 unbound-anchor-debuginfo-1.6.8-lp152.9.3.1 unbound-debuginfo-1.6.8-lp152.9.3.1 unbound-debugsource-1.6.8-lp152.9.3.1 unbound-devel-1.6.8-lp152.9.3.1 unbound-python-1.6.8-lp152.9.3.1 unbound-python-debuginfo-1.6.8-lp152.9.3.1 References: https://www.suse.com/security/cve/CVE-2019-18934.html https://www.suse.com/security/cve/CVE-2020-12662.html https://www.suse.com/security/cve/CVE-2020-12663.html https://bugzilla.suse.com/1157268 https://bugzilla.suse.com/1171889

1 0

openSUSE-OU-2020:0909-1: Recommended update for python-scipy
by maintenance＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Optional Update: Recommended update for python-scipy ______________________________________________________________________________ Announcement ID: openSUSE-OU-2020:0909-1 Rating: low References: #1171510 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for python-scipy doesn't fix any user visible issues, but improves the package building process. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-909=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-scipy-debuginfo-1.2.0-lp151.3.3.1 python-scipy-debugsource-1.2.0-lp151.3.3.1 python2-scipy-1.2.0-lp151.3.3.1 python2-scipy-debuginfo-1.2.0-lp151.3.3.1 python3-scipy-1.2.0-lp151.3.3.1 python3-scipy-debuginfo-1.2.0-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): python-scipy_1_2_0-gnu-hpc-debuginfo-1.2.0-lp151.3.3.1 python-scipy_1_2_0-gnu-hpc-debugsource-1.2.0-lp151.3.3.1 python2-scipy-gnu-hpc-1.2.0-lp151.3.3.1 python2-scipy_1_2_0-gnu-hpc-1.2.0-lp151.3.3.1 python2-scipy_1_2_0-gnu-hpc-debuginfo-1.2.0-lp151.3.3.1 python3-scipy-gnu-hpc-1.2.0-lp151.3.3.1 python3-scipy_1_2_0-gnu-hpc-1.2.0-lp151.3.3.1 python3-scipy_1_2_0-gnu-hpc-debuginfo-1.2.0-lp151.3.3.1 References: https://bugzilla.suse.com/1171510

1 0

openSUSE-SU-2020:0911-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0911-1 Rating: important References: #1172405 Cross-References: CVE-2020-8022 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: - CVE-2020-8022: Fixed a local root exploit due to improper permissions (bsc#1172405) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-911=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.35-lp151.3.21.1 tomcat-admin-webapps-9.0.35-lp151.3.21.1 tomcat-docs-webapp-9.0.35-lp151.3.21.1 tomcat-el-3_0-api-9.0.35-lp151.3.21.1 tomcat-embed-9.0.35-lp151.3.21.1 tomcat-javadoc-9.0.35-lp151.3.21.1 tomcat-jsp-2_3-api-9.0.35-lp151.3.21.1 tomcat-jsvc-9.0.35-lp151.3.21.1 tomcat-lib-9.0.35-lp151.3.21.1 tomcat-servlet-4_0-api-9.0.35-lp151.3.21.1 tomcat-webapps-9.0.35-lp151.3.21.1 References: https://www.suse.com/security/cve/CVE-2020-8022.html https://bugzilla.suse.com/1172405

1 0

openSUSE-SU-2020:0906-1: moderate: Security update for graphviz
by opensuse-security＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Security Update: Security update for graphviz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0906-1 Rating: moderate References: #1132091 Cross-References: CVE-2019-11023 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphviz fixes the following issues: Security issue fixed: - CVE-2019-11023: Fixed a denial of service vulnerability, which was caused by a NULL pointer dereference in agroot() (bsc#1132091). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-906=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): graphviz-2.40.1-lp152.7.4.2 graphviz-addons-debuginfo-2.40.1-lp152.7.4.2 graphviz-addons-debugsource-2.40.1-lp152.7.4.2 graphviz-debuginfo-2.40.1-lp152.7.4.2 graphviz-debugsource-2.40.1-lp152.7.4.2 graphviz-devel-2.40.1-lp152.7.4.2 graphviz-doc-2.40.1-lp152.7.4.2 graphviz-gd-2.40.1-lp152.7.4.2 graphviz-gd-debuginfo-2.40.1-lp152.7.4.2 graphviz-gnome-2.40.1-lp152.7.4.2 graphviz-gnome-debuginfo-2.40.1-lp152.7.4.2 graphviz-guile-2.40.1-lp152.7.4.2 graphviz-guile-debuginfo-2.40.1-lp152.7.4.2 graphviz-gvedit-2.40.1-lp152.7.4.2 graphviz-gvedit-debuginfo-2.40.1-lp152.7.4.2 graphviz-java-2.40.1-lp152.7.4.2 graphviz-java-debuginfo-2.40.1-lp152.7.4.2 graphviz-lua-2.40.1-lp152.7.4.2 graphviz-lua-debuginfo-2.40.1-lp152.7.4.2 graphviz-perl-2.40.1-lp152.7.4.2 graphviz-perl-debuginfo-2.40.1-lp152.7.4.2 graphviz-php-2.40.1-lp152.7.4.2 graphviz-php-debuginfo-2.40.1-lp152.7.4.2 graphviz-plugins-core-2.40.1-lp152.7.4.2 graphviz-plugins-core-debuginfo-2.40.1-lp152.7.4.2 graphviz-python-2.40.1-lp152.7.4.2 graphviz-python-debuginfo-2.40.1-lp152.7.4.2 graphviz-ruby-2.40.1-lp152.7.4.2 graphviz-ruby-debuginfo-2.40.1-lp152.7.4.2 graphviz-smyrna-2.40.1-lp152.7.4.2 graphviz-smyrna-debuginfo-2.40.1-lp152.7.4.2 graphviz-tcl-2.40.1-lp152.7.4.2 graphviz-tcl-debuginfo-2.40.1-lp152.7.4.2 libgraphviz6-2.40.1-lp152.7.4.2 libgraphviz6-debuginfo-2.40.1-lp152.7.4.2 References: https://www.suse.com/security/cve/CVE-2019-11023.html https://bugzilla.suse.com/1132091

1 0

openSUSE-RU-2020:0907-1: moderate: Recommended update for bcc
by maintenance＠opensuse.org 29 Jun '20

29 Jun '20

openSUSE Recommended Update: Recommended update for bcc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0907-1 Rating: moderate References: #1172230 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bcc fixes the following issues: - Recommends kernel-default-devel to be installed when kernel-default or kernel-default-base are installed (bsc#1172230) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-907=1 Package List: - openSUSE Leap 15.1 (x86_64): bcc-debuginfo-0.5.0-lp151.12.6.1 bcc-debugsource-0.5.0-lp151.12.6.1 bcc-devel-0.5.0-lp151.12.6.1 bcc-docs-0.5.0-lp151.12.6.1 bcc-examples-0.5.0-lp151.12.6.1 bcc-lua-0.5.0-lp151.12.6.1 bcc-lua-debuginfo-0.5.0-lp151.12.6.1 bcc-tools-0.5.0-lp151.12.6.1 libbcc0-0.5.0-lp151.12.6.1 libbcc0-debuginfo-0.5.0-lp151.12.6.1 libbpf0-0.5.0-lp151.12.6.1 libbpf0-debuginfo-0.5.0-lp151.12.6.1 python2-bcc-0.5.0-lp151.12.6.1 python3-bcc-0.5.0-lp151.12.6.1 References: https://bugzilla.suse.com/1172230

1 0