June 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:0825-1: Security update for file-roller
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for file-roller ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0825-1 Rating: low References: #1151585 #1169428 Cross-References: CVE-2019-16680 CVE-2020-11736 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for file-roller fixes the following issues: - CVE-2020-11736: Fixed a directory traversal vulnerability due to improper checking whether a file's parent is an external symlink (bsc#1169428). - CVE-2019-16680: Fixed a path traversal vulnerability which could have allowed an overwriting of a file during extraction (bsc#1151585). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-825=1 Package List: - openSUSE Leap 15.1 (x86_64): file-roller-3.26.2-lp151.4.3.1 file-roller-debuginfo-3.26.2-lp151.4.3.1 file-roller-debugsource-3.26.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): file-roller-lang-3.26.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16680.html https://www.suse.com/security/cve/CVE-2020-11736.html https://bugzilla.suse.com/1151585 https://bugzilla.suse.com/1169428

1 0

openSUSE-RU-2020:0826-1: important: Recommended update for audit
by maintenance＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Recommended Update: Recommended update for audit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0826-1 Rating: important References: #1156159 #1172295 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for audit fixes the following issues: - Fix hang on startup. (bsc#1156159) - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs. (bsc#1172295) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-826=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): audit-2.8.1-lp151.5.3.1 audit-audispd-plugins-2.8.1-lp151.5.3.1 audit-audispd-plugins-debuginfo-2.8.1-lp151.5.3.1 audit-debuginfo-2.8.1-lp151.5.3.1 audit-debugsource-2.8.1-lp151.5.3.1 audit-devel-2.8.1-lp151.5.3.1 audit-secondary-debugsource-2.8.1-lp151.5.3.1 libaudit1-2.8.1-lp151.5.3.1 libaudit1-debuginfo-2.8.1-lp151.5.3.1 libauparse0-2.8.1-lp151.5.3.1 libauparse0-debuginfo-2.8.1-lp151.5.3.1 python2-audit-2.8.1-lp151.5.3.1 python2-audit-debuginfo-2.8.1-lp151.5.3.1 python3-audit-2.8.1-lp151.5.3.1 python3-audit-debuginfo-2.8.1-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): audit-devel-32bit-2.8.1-lp151.5.3.1 libaudit1-32bit-2.8.1-lp151.5.3.1 libaudit1-32bit-debuginfo-2.8.1-lp151.5.3.1 libauparse0-32bit-2.8.1-lp151.5.3.1 libauparse0-32bit-debuginfo-2.8.1-lp151.5.3.1 References: https://bugzilla.suse.com/1156159 https://bugzilla.suse.com/1172295

1 0

openSUSE-RU-2020:0828-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0828-1 Rating: moderate References: #1167951 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gtk3 fixes the following issue: - GtkMenu under X11 is it not able to handle touch events properly. (bsc#1167951) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-828=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gettext-its-gtk3-3.22.30-lp151.6.9.1 gtk3-debugsource-3.22.30-lp151.6.9.1 gtk3-devel-3.22.30-lp151.6.9.1 gtk3-devel-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-amharic-3.22.30-lp151.6.9.1 gtk3-immodule-amharic-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-broadway-3.22.30-lp151.6.9.1 gtk3-immodule-broadway-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-inuktitut-3.22.30-lp151.6.9.1 gtk3-immodule-inuktitut-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-multipress-3.22.30-lp151.6.9.1 gtk3-immodule-multipress-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-thai-3.22.30-lp151.6.9.1 gtk3-immodule-thai-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-vietnamese-3.22.30-lp151.6.9.1 gtk3-immodule-vietnamese-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-xim-3.22.30-lp151.6.9.1 gtk3-immodule-xim-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodules-tigrigna-3.22.30-lp151.6.9.1 gtk3-immodules-tigrigna-debuginfo-3.22.30-lp151.6.9.1 gtk3-tools-3.22.30-lp151.6.9.1 gtk3-tools-debuginfo-3.22.30-lp151.6.9.1 libgtk-3-0-3.22.30-lp151.6.9.1 libgtk-3-0-debuginfo-3.22.30-lp151.6.9.1 typelib-1_0-Gtk-3_0-3.22.30-lp151.6.9.1 - openSUSE Leap 15.1 (x86_64): gtk3-devel-32bit-3.22.30-lp151.6.9.1 gtk3-devel-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-amharic-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-amharic-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-inuktitut-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-multipress-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-multipress-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-thai-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-thai-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-vietnamese-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodule-xim-32bit-3.22.30-lp151.6.9.1 gtk3-immodule-xim-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-immodules-tigrigna-32bit-3.22.30-lp151.6.9.1 gtk3-immodules-tigrigna-32bit-debuginfo-3.22.30-lp151.6.9.1 gtk3-tools-32bit-3.22.30-lp151.6.9.1 gtk3-tools-32bit-debuginfo-3.22.30-lp151.6.9.1 libgtk-3-0-32bit-3.22.30-lp151.6.9.1 libgtk-3-0-32bit-debuginfo-3.22.30-lp151.6.9.1 - openSUSE Leap 15.1 (noarch): gtk3-branding-upstream-3.22.30-lp151.6.9.1 gtk3-data-3.22.30-lp151.6.9.1 gtk3-lang-3.22.30-lp151.6.9.1 gtk3-schema-3.22.30-lp151.6.9.1 References: https://bugzilla.suse.com/1167951

1 0

openSUSE-RU-2020:0824-1: moderate: Recommended update for texworks
by maintenance＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Recommended Update: Recommended update for texworks ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0824-1 Rating: moderate References: #1172296 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for texworks fixes the following issues: - Update to version 0.6.5 (boo#1172296): * Fix text selection handling when moving the mouse. * Fix auto-reloading of TeX documents that were changed outside TeXworks. * Updated translations. - Changes from version 0.6.4: * Add shortcut (Ctrl+Shift+J) to invoke SyncTeX at the cursor position. * Make shortcuts for autocompletion configurable. * Make "Auto-Follow Focus" configurable in the preferences. * Make editor line spacing customizable. * Make console output accessible by keyboard; among other thigs, this makes the console work with screen readers. * Migrate to a more powerful regular expressions engine (e.g. for finding and replacing). * Fix opening empty files. * Fix the highlighting of TeX commands that include non-ASCII characters. * Fix the auto-closing of PDFs with the associated TeXs. * Fix the PDF display on high-dpi screens like Retina displays. * Properly handle "&" for recent files menu. * Fix syntax highlighting in the "New from template" dialog. * Sort interface locales alphabetically in the preferences. * Don't show invalid PDF page sizes in the meta data dock. * Properly show the PDF file size in the meta data dock even for locked or invalid files. * Fix the conversion of Lua tables in Lua scripts. * Fix the installation of icons on *nix platforms. * Update libraries for pre-built binaries. * Modernize and restructure the code to improve quality, stability, maintainability, and the possibilities for future enhancements. * Improve unit tests and add automated testing on Windows; this ensures better code quality across all supported operating systems. * Discontinue Qt4 support. * Updated translations. - Adapt to changed location of icons: * Add BuildRequires: hicolor-icon-theme. * Update file list with new icon directory. - Update to version 0.6.3: * New features and improvements: - Implement "Insert Citations..." dialog - Implement indenting/unindenting by Tab/Shift+Tab - Make synchronization granularity configurable (highlight corresponding character, word, or line) - Add ability to distinguish identically named files by displaying the respective folders they are in in the window title, window menu, and under "Open Recent" - Implement "Fit to content width" PDF zoom (which ignores empty space around the text) - Disable unavailable typesetting engines - Allow to change the editor font size by Ctrl+Mousewheel - Improve the detection of spellchecking languages (add ability to search multiple directories and list all results) - Hide the menu bar in PDF full screen mode - Rework/expand code completion strings - Add/update syntax highlighting for LaTeX, ConTeXt, Lua, DTX, and BibTeX - Add cleanup-patterns for beamer files .nav & .snm - Add new/unified icons for typeset and zooming - Display paper size and file size in the PDF metadata * Bug fixes: - Fix infinite loop in syntax highlighter (which caused significant slow-down especially for large files) - Fix underline when spellchecking with syntax highlighting - Fix "Place on Left/Right", especially on multi-screen setups - Avoid 'file "" not found' errors when synchronizing - Fix synchronization while searching in a PDF - Fix fine-grained synchronization near paragraph boundaries - Fix the PDF copy menu command - Fix PDF text selection - Fix font color reset when searching and using stylesheets - Fix crashes when working with locked PDFs - Fix unexpected cursor movement when using a combination of backspace and up/down arrow keys (thanks to @mgkuhn) - Fix the font in the log parser output - Fix persistent magnifying glass - Remove unimplemented PDF menu items cut, paste, clear Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-824=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-824=1 Package List: - openSUSE Leap 15.1 (x86_64): texworks-0.6.5-lp151.3.3.1 texworks-debuginfo-0.6.5-lp151.3.3.1 texworks-debugsource-0.6.5-lp151.3.3.1 texworks-plugin-lua-0.6.5-lp151.3.3.1 texworks-plugin-lua-debuginfo-0.6.5-lp151.3.3.1 texworks-plugin-python-0.6.5-lp151.3.3.1 texworks-plugin-python-debuginfo-0.6.5-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): texworks-0.6.5-bp151.4.3.1 texworks-plugin-lua-0.6.5-bp151.4.3.1 texworks-plugin-python-0.6.5-bp151.4.3.1 References: https://bugzilla.suse.com/1172296

1 0

openSUSE-SU-2020:0823-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Jun '20

17 Jun '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0823-1 Rating: important References: #1170107 #1171910 #1171975 #1172496 Cross-References: CVE-2020-6463 CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 CVE-2020-6493 CVE-2020-6494 CVE-2020-6495 CVE-2020-6496 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496): * CVE-2020-6463: Use after free in ANGLE (boo#1170107 boo#1171975). * CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21 * CVE-2020-6466: Use after free in media. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-04-26 * CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song on 2020-04-06 * CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake Corina of Seaside Security, Chani Jindal of Shellphish on 2020-04-30 * CVE-2020-6469: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-02 * CVE-2020-6470: Insufficient validation of untrusted input in clipboard. Reported by Michał Bentkowski of Securitum on 2020-03-30 * CVE-2020-6471: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-08 * CVE-2020-6472: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-25 * CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by Soroush Karami and Panagiotis Ilia on 2020-02-06 * CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-03-07 * CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil Zhani on 2019-10-31 * CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by Alexandre Le Borgne on 2019-12-18 * CVE-2020-6477: Inappropriate implementation in installer. Reported by RACK911 Labs on 2019-03-26 * CVE-2020-6478: Inappropriate implementation in full screen. Reported by Khalil Zhani on 2019-12-24 * CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong Zhaochen of andsecurity.cn on 2020-01-14 * CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by Marvin Witt on 2020-02-21 * CVE-2020-6481: Insufficient policy enforcement in URL formatting. Reported by Rayyan Bijoora on 2020-04-07 * CVE-2020-6482: Insufficient policy enforcement in developer tools. Reported by Abdulrahman Alqabandi (@qab) on 2017-12-17 * CVE-2020-6483: Insufficient policy enforcement in payments. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-23 * CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by Artem Zinenko on 2020-01-26 * CVE-2020-6485: Insufficient data validation in media router. Reported by Sergei Glazunov of Google Project Zero on 2020-01-30 * CVE-2020-6486: Insufficient policy enforcement in navigations. Reported by David Erceg on 2020-02-24 * CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by Jun Kokatsu (@shhnjk) on 2015-10-06 * CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by David Erceg on 2020-01-21 * CVE-2020-6489: Inappropriate implementation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-02-10 * CVE-2020-6490: Insufficient data validation in loader. Reported by Twitter on 2019-12-19 * CVE-2020-6491: Incorrect security UI in site information. Reported by Sultan Haikal M.A on 2020-02-07 * CVE-2020-6493: Use after free in WebAuthentication. * CVE-2020-6494: Incorrect security UI in payments. * CVE-2020-6495: Insufficient policy enforcement in developer tools. * CVE-2020-6496: Use after free in payments. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-823=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-83.0.4103.97-lp151.2.96.1 chromedriver-debuginfo-83.0.4103.97-lp151.2.96.1 chromium-83.0.4103.97-lp151.2.96.1 chromium-debuginfo-83.0.4103.97-lp151.2.96.1 chromium-debugsource-83.0.4103.97-lp151.2.96.1 References: https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6465.html https://www.suse.com/security/cve/CVE-2020-6466.html https://www.suse.com/security/cve/CVE-2020-6467.html https://www.suse.com/security/cve/CVE-2020-6468.html https://www.suse.com/security/cve/CVE-2020-6469.html https://www.suse.com/security/cve/CVE-2020-6470.html https://www.suse.com/security/cve/CVE-2020-6471.html https://www.suse.com/security/cve/CVE-2020-6472.html https://www.suse.com/security/cve/CVE-2020-6473.html https://www.suse.com/security/cve/CVE-2020-6474.html https://www.suse.com/security/cve/CVE-2020-6475.html https://www.suse.com/security/cve/CVE-2020-6476.html https://www.suse.com/security/cve/CVE-2020-6477.html https://www.suse.com/security/cve/CVE-2020-6478.html https://www.suse.com/security/cve/CVE-2020-6479.html https://www.suse.com/security/cve/CVE-2020-6480.html https://www.suse.com/security/cve/CVE-2020-6481.html https://www.suse.com/security/cve/CVE-2020-6482.html https://www.suse.com/security/cve/CVE-2020-6483.html https://www.suse.com/security/cve/CVE-2020-6484.html https://www.suse.com/security/cve/CVE-2020-6485.html https://www.suse.com/security/cve/CVE-2020-6486.html https://www.suse.com/security/cve/CVE-2020-6487.html https://www.suse.com/security/cve/CVE-2020-6488.html https://www.suse.com/security/cve/CVE-2020-6489.html https://www.suse.com/security/cve/CVE-2020-6490.html https://www.suse.com/security/cve/CVE-2020-6491.html https://www.suse.com/security/cve/CVE-2020-6493.html https://www.suse.com/security/cve/CVE-2020-6494.html https://www.suse.com/security/cve/CVE-2020-6495.html https://www.suse.com/security/cve/CVE-2020-6496.html https://bugzilla.suse.com/1170107 https://bugzilla.suse.com/1171910 https://bugzilla.suse.com/1171975 https://bugzilla.suse.com/1172496

1 0

openSUSE-RU-2020:0815-1: moderate: Recommended update for gnu-compilers-hpc
by maintenance＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Recommended Update: Recommended update for gnu-compilers-hpc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0815-1 Rating: moderate References: #1160924 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnu-compilers-hpc fixes the following issues: - Added gcc9 flavors (jsc#SLE-8604 bsc#1160924) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-815=1 Package List: - openSUSE Leap 15.1 (noarch): gnu-compilers-hpc-1.4-lp151.2.6.1 gnu-compilers-hpc-devel-1.4-lp151.2.6.1 gnu-compilers-hpc-macros-devel-1.4-lp151.2.6.1 gnu8-compilers-hpc-1.4-lp151.2.6.1 gnu8-compilers-hpc-devel-1.4-lp151.2.6.1 gnu8-compilers-hpc-macros-devel-1.4-lp151.2.6.1 gnu9-compilers-hpc-1.4-lp151.2.6.1 gnu9-compilers-hpc-devel-1.4-lp151.2.6.1 gnu9-compilers-hpc-macros-devel-1.4-lp151.2.6.1 References: https://bugzilla.suse.com/1160924

1 0

openSUSE-SU-2020:0805-1: moderate: Security update for libupnp
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0805-1 Rating: moderate References: #1172625 Cross-References: CVE-2020-13848 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libupnp fixes the following issues: - CVE-2020-13848: A NULL ptr denial of service via crafted SSDP message was fixed (boo#1172625) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-805=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libupnp-debugsource-1.6.25-lp151.3.3.1 libupnp-devel-1.6.25-lp151.3.3.1 libupnp6-1.6.25-lp151.3.3.1 libupnp6-debuginfo-1.6.25-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libupnp6-32bit-1.6.25-lp151.3.3.1 libupnp6-32bit-debuginfo-1.6.25-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13848.html https://bugzilla.suse.com/1172625

1 0

openSUSE-SU-2020:0806-1: moderate: Security update for libntlm
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for libntlm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0806-1 Rating: moderate References: #1153669 Cross-References: CVE-2019-17455 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libntlm fixes the following issues: Update to release 1.6: * CVE-2019-17455: Fixed a buffer overflow in buildSmbNtlmAuth* function. (boo#1153669) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-806=1 Package List: - openSUSE Leap 15.1 (x86_64): libntlm-debugsource-1.6-lp151.3.3.1 libntlm-devel-1.6-lp151.3.3.1 libntlm0-1.6-lp151.3.3.1 libntlm0-debuginfo-1.6-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-17455.html https://bugzilla.suse.com/1153669

1 0

openSUSE-RU-2020:0817-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0817-1 Rating: moderate References: #1152100 #1155045 #1155262 #1156087 #1156409 #1159689 #1160626 #1161718 #1162553 #1163119 #1164571 #1165713 #1165835 #1165840 #1166297 #1166393 #1166624 #1166670 #1166932 #1168403 #1169356 #1170938 #1171367 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 23 recommended fixes can now be installed. Description: This update for ceph to version 14.2.9-969-g9917342dc8d, fixes the following issues: - monitoring: add details to Prometheus alerts (jsc#SES-680) - mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking (bsc#1155045) - monitoring: alert for prediction of disk and pool fill up broken (bsc#1152100) - mgr/dashboard: iSCSI targets not available if any gateway is down (bsc#1155262) - os/bluestore: more flexible DB volume space usage (bsc#1159689) - ceph-volume: make get_devices fs location independent (bsc#1156087) - monitoring: wait before firing osd full alert (bsc#1156409) - mgr/dashboard: Unable to remove an iSCSI gateway that is already in use (bsc#1160626) - mount.ceph: remove arbitrary limit on size of name= option (bsc#1161718) - ceph-volume: strip _dmcrypt suffix in simple scan json output (bsc#1162553) - mgr/dashboard: Not able to restrict bucket creation for new user (bsc#1163119) - mgr/dashboard: Prevent iSCSI target recreation when editing controls (bsc#1164571) - mgr/dashboard: Repair broken grafana panels (bsc#1165713) - rgw: get barbican secret key request maybe return error code (bsc#1165835) - rgw: making implicit_tenants backwards compatible (bsc#1165840) - mgr/dashboard: Repair broken grafana panels (bsc#1166297) - mgr/dashboard: KeyError on dashboard reload (bsc#1166393) - mgr/dashboard: Fix iSCSI's username and password validation (bsc#1166624) - monitoring: root volume full alert fires false positives (bsc#1166670) - mgr: synchronize ClusterState's health and mon_status (bsc#1166932) - mgr/dashboard: Add more debug information to Dashboard RGW backend (bsc#1168403) - rgw: reshard: skip stale bucket id entries from reshard queue (bsc#1169356) - mon/OSDMonitor: allow trimming maps even if osds are down (bsc#1170938) - Set OSD's bluefs-buffered-io param to false by default (bsc#1171367) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-817=1 Package List: - openSUSE Leap 15.1 (noarch): ceph-dashboard-e2e-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-grafana-dashboards-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-dashboard-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-diskprediction-cloud-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-diskprediction-local-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-k8sevents-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-rook-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-ssh-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-prometheus-alerts-14.2.9.969+g9917342dc8-lp151.2.16.1 - openSUSE Leap 15.1 (x86_64): ceph-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-base-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-base-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-common-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-common-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-debugsource-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-fuse-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-fuse-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mds-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mds-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mgr-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mon-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-mon-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-osd-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-osd-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-radosgw-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-radosgw-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-resource-agents-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-test-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-test-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 ceph-test-debugsource-14.2.9.969+g9917342dc8-lp151.2.16.1 cephfs-shell-14.2.9.969+g9917342dc8-lp151.2.16.1 libcephfs-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 libcephfs2-14.2.9.969+g9917342dc8-lp151.2.16.1 libcephfs2-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 librados-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 librados-devel-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 librados2-14.2.9.969+g9917342dc8-lp151.2.16.1 librados2-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 libradospp-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 libradosstriper-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 libradosstriper1-14.2.9.969+g9917342dc8-lp151.2.16.1 libradosstriper1-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 librbd-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 librbd1-14.2.9.969+g9917342dc8-lp151.2.16.1 librbd1-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 librgw-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 librgw2-14.2.9.969+g9917342dc8-lp151.2.16.1 librgw2-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-ceph-argparse-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-cephfs-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-cephfs-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rados-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rados-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rbd-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rbd-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rgw-14.2.9.969+g9917342dc8-lp151.2.16.1 python3-rgw-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 rados-objclass-devel-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-fuse-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-fuse-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-mirror-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-mirror-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-nbd-14.2.9.969+g9917342dc8-lp151.2.16.1 rbd-nbd-debuginfo-14.2.9.969+g9917342dc8-lp151.2.16.1 References: https://bugzilla.suse.com/1152100 https://bugzilla.suse.com/1155045 https://bugzilla.suse.com/1155262 https://bugzilla.suse.com/1156087 https://bugzilla.suse.com/1156409 https://bugzilla.suse.com/1159689 https://bugzilla.suse.com/1160626 https://bugzilla.suse.com/1161718 https://bugzilla.suse.com/1162553 https://bugzilla.suse.com/1163119 https://bugzilla.suse.com/1164571 https://bugzilla.suse.com/1165713 https://bugzilla.suse.com/1165835 https://bugzilla.suse.com/1165840 https://bugzilla.suse.com/1166297 https://bugzilla.suse.com/1166393 https://bugzilla.suse.com/1166624 https://bugzilla.suse.com/1166670 https://bugzilla.suse.com/1166932 https://bugzilla.suse.com/1168403 https://bugzilla.suse.com/1169356 https://bugzilla.suse.com/1170938 https://bugzilla.suse.com/1171367

1 0

openSUSE-SU-2020:0819-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 16 Jun '20

16 Jun '20

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0819-1 Rating: moderate References: #1169039 #1169040 Cross-References: CVE-2019-20637 CVE-2020-11653 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for varnish fixes the following issues: - CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040) - CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-819=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libvarnishapi2-6.2.1-bp151.4.6.1 varnish-6.2.1-bp151.4.6.1 varnish-devel-6.2.1-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-20637.html https://www.suse.com/security/cve/CVE-2020-11653.html https://bugzilla.suse.com/1169039 https://bugzilla.suse.com/1169040

1 0