June 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:0762-1: moderate: Recommended update for shorewall
by maintenance＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Recommended Update: Recommended update for shorewall ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0762-1 Rating: moderate References: #1047218 #1166114 #833999 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for shorewall to 5.2.4.4 fixes the following issues: - Update to bugfix version 5.2.4.4 + When DYNAMIC_BLACKLIST=ipset... or when SAVE_IPSETS=Yes in shorewall[6].conf, 'shorewall[6] start' could hang. Fixed. + 'shorewall[6] start' would not automatically create dynamic blacklisting ipsets. That has been corrected. - Update to version 5.2.4.2 https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt - Update to version 5.2.4.1 + Fixes for openSUSE shorewall-init will now ignore 'start' and 'stop' commands, for running firewalls + Spurious messages have been removed - To fix boo#1166114 never restart shorewall-init.service macro service_del_postun is replaced by simpler systemd_postun - Remove conflict between main and lite package. A managing station need main to build configuration and can use -lite to execute it. Users are in charge of choosing which service has to be started and used. - Update to version 5.2.4 https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt + Previously, when a Shorewall6 firewall was placed into the 'stopped' state, ICMP6 packets required by RFC 4890 were not automatically accepted by the generated ruleset. Beginning with this release, those packets are automatically accepted. + Previously, the output of 'shorewall[6] help' displayed the superseded 'load' command. That text has been deleted. + The QOSExample.html file in the documentation and on the web site previously showed tcrules content for the /etc/shorewall/mangle file (recall that 'mangle' superseded 'tcrules'). That page has been corrected. + The 'Starting and Stopping' and 'Configuration file basics' documents have been updated to align them with the current product behavior. + The 'ipsets' document has been updated to clarify the use of ipsets in the stoppedrules file. - Packaging + shorewall-init package has a removed %service_del_postun macro to close bug boo#1166114 Restarting this service can lock down admin out of the system. + shorewall(6) and shorewall(6)-lite conflict has they shouldn't be installed together on the same system. - Add version to requires in -lite version - Update to minor bugfix version 5.2.3.7 + When DOCKER=Yes, if both the DOCKER-ISOLATE and DOCKER-ISOLATE-STAGE-1 existed then the DOCKER-ISOLATE-STAGE-* chains were not preserved through shorewall state changes. That has been corrected so that both chains are preserved if present. + Previously, the compiler always detected the OLD_CONNTRACK_MATCH capability as being available in IPv6. When OLD_CONNTRACK_MATCH was available, the compiler also mishandled inversion ('!') in the ORIGDEST columns, leading to an assertion failure. Both the incorrect capability detection and the mishandled inversion have been corrected. + During 'enable' processing, if address variables associated with the interface have values different than those when the firewall was last started/restarted/reloaded, then a 'reload' is performed rather than a simple 'enable'. The logic that checks for those changes was incorrect in some configurations, leading to unneeded reload operations. That has been corrected. + When MANGLE_ENABLED=No in shorewall[6].conf, some features requiring use of the mangle table can be allowed, even though the mangle table is not updated. That has been corrected such that use of such features will raise an error. + When the IfEvent(...,reset) action was invoked, the compiler previously emitted a spurious "Resetting..." message. That message has been suppressed. - Packaging + Introduce define conf_need_update to track when we activate the post update warning for users when there's minor or major version update of shorewall boo#1166114 - Update to bugfix minor 5.2.3.6 + Fix for possible start failure when both Docker containers and Libvirt VMs were in use. - Update to bugfix minor 5.2.3.5 + A typo in the FTP documentation has been corrected. + The recommended mss setting when using IPSec with ipcomp has been corrected. + A number of incorrect links in the manpages have been corrected. + The 'bypass' option is now allowed when specifying an NFQUEUE policy. Previously, specifying that option resulted in an error. + Corrected IPv6 Address Range parsing. + Previously, such ranges were required to be of the form [<addr1>-<addr2>] rather than the more standard form [<addr1>]-[<addr2>]. In the snat file (and in nat actions), the latter form was actually flagged as an error while in other contexts, it resulted in a less obvious error being raised. + The manpages have been updated to refer to https://shorewall.org rather than http://www.shorewall.org. - Refresh spec file - Update to bugfix minor 5.2.3.4 + Update release documents. + Correct handling of multi-queue NFQUEUE as a policy. + Correct handling of multi-queue NFQUEUE as a macro parameter. + Correct the description of the 'bypass' NFQUEUE option in shorewall-rules(5). - Update to bugfix minor 5.2.3.3 Previously, if an ipset was specified in an SPORT column, the compiler would raise an error similar to: ERROR: Invalid ipset name () /etc/shorewall/rules (line 44) - Update to bugfix minor 5.2.3.2 Shorewall 5.2 automatically converts an existing 'masq' file to an equivalent 'snat' file. Regrettably, Shorewall 5.2.3 broke that automatic update, such that the following error message was issued: Use of uninitialized value $Shorewall::Nat::raw::currentline in pattern match (m//) at /usr/share/shorewall/Shorewall/Nat.pm line 511, <$currentfile> line nnn. and the generated 'masq' file contains only initial comments. That has been corrected. - Update to bugfix minor 5.2.3.1 release + An issue in the implementation of policy file zone exclusion, released in 5.2.3 has been resolved. In the original release, if more than one zone was excluded then the following error was raised: ERROR: 'all' is not allowed in a source zone list etc/shorewall/policy (line ...) - Update to new 5.2.3 bugfix release http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.3/releasenotes.txt This is the retirement of Tom Eastep see. https://sourceforge.net/p/shorewall/mailman/message/36589782/ - Removed module* in file section - Clean-up changes and spec (trailing slashes) - Update to new 5.2.2 bugfix release http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.2/releasenotes.txt - Packaging: + As seen with upstream recommend running shorewall update on all version update - Update to major version 5.2.1.4 A lot of changes occurs since last package please consult http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.1/releasenotes.txt and the know problem list at http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.1/known_problems.t xt - Update your configuration shorewall update This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-762=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): shorewall-5.2.4.4-bp151.4.3.1 shorewall-core-5.2.4.4-bp151.4.3.1 shorewall-docs-5.2.4.4-bp151.4.3.1 shorewall-init-5.2.4.4-bp151.4.3.1 shorewall-lite-5.2.4.4-bp151.4.3.1 shorewall6-5.2.4.4-bp151.4.3.1 shorewall6-lite-5.2.4.4-bp151.4.3.1 References: https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1166114 https://bugzilla.suse.com/833999

1 0

openSUSE-SU-2020:0764-1: moderate: Security update for mailman
by opensuse-security＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0764-1 Rating: moderate References: #1171363 #682920 Cross-References: CVE-2020-12108 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mailman fixes the following issues: Security issue fixed: - CVE-2020-12108: Fixed a content injection bug (boo#1171363). Non-security issue fixed: - Don't default to invalid hosts for DEFAULT_EMAIL_HOST (boo#682920) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-764=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): mailman-2.1.29-bp151.5.9.1 References: https://www.suse.com/security/cve/CVE-2020-12108.html https://bugzilla.suse.com/1171363 https://bugzilla.suse.com/682920

1 0

openSUSE-RU-2020:0766-1: moderate: Recommended update for golang-packaging
by maintenance＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Recommended Update: Recommended update for golang-packaging ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0766-1 Rating: moderate References: #776058 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for golang-packaging fixes the following issues: - Fix for an issue when go installation fails due missing permissions. (bsc#776058) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-766=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): golang-packaging-15.0.12-bp151.2.3.1 References: https://bugzilla.suse.com/776058

1 0

openSUSE-SU-2020:0765-1: moderate: Security update for imapfilter
by opensuse-security＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Security Update: Security update for imapfilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0765-1 Rating: moderate References: #1149931 Cross-References: CVE-2016-10937 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation (boo#1149931). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-765=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): imapfilter-2.6.16-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-10937.html https://bugzilla.suse.com/1149931

1 0

openSUSE-RU-2020:0761-1: moderate: Recommended update for syslog-ng
by maintenance＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Recommended Update: Recommended update for syslog-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0761-1 Rating: moderate References: #1169385 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for syslog-ng fixes the following issues: - removed creating news log files from the RPM %post section. Added syslog-ng.conf options to create files/directories automatically, and commenting the relevant part out. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-761=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libevtlog-3_19-0-3.19.1-bp151.4.6.1 syslog-ng-3.19.1-bp151.4.6.1 syslog-ng-curl-3.19.1-bp151.4.6.1 syslog-ng-devel-3.19.1-bp151.4.6.1 syslog-ng-geoip-3.19.1-bp151.4.6.1 syslog-ng-java-3.19.1-bp151.4.6.1 syslog-ng-python-3.19.1-bp151.4.6.1 syslog-ng-redis-3.19.1-bp151.4.6.1 syslog-ng-smtp-3.19.1-bp151.4.6.1 syslog-ng-sql-3.19.1-bp151.4.6.1 References: https://bugzilla.suse.com/1169385

1 0

openSUSE-RU-2020:0760-1: Recommended update for Mesa
by maintenance＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Recommended Update: Recommended update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0760-1 Rating: low References: #1172302 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Mesa was updated to Mesa-libGL-devel-32bit. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-760=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): Mesa-18.3.2-lp151.23.11.1 Mesa-KHR-devel-18.3.2-lp151.23.11.1 Mesa-debugsource-18.3.2-lp151.23.11.1 Mesa-devel-18.3.2-lp151.23.11.1 Mesa-dri-18.3.2-lp151.23.11.1 Mesa-dri-debuginfo-18.3.2-lp151.23.11.1 Mesa-dri-devel-18.3.2-lp151.23.11.1 Mesa-dri-nouveau-18.3.2-lp151.23.11.1 Mesa-dri-nouveau-debuginfo-18.3.2-lp151.23.11.1 Mesa-drivers-debugsource-18.3.2-lp151.23.11.1 Mesa-gallium-18.3.2-lp151.23.11.1 Mesa-gallium-debuginfo-18.3.2-lp151.23.11.1 Mesa-libEGL-devel-18.3.2-lp151.23.11.1 Mesa-libEGL1-18.3.2-lp151.23.11.1 Mesa-libEGL1-debuginfo-18.3.2-lp151.23.11.1 Mesa-libGL-devel-18.3.2-lp151.23.11.1 Mesa-libGL1-18.3.2-lp151.23.11.1 Mesa-libGL1-debuginfo-18.3.2-lp151.23.11.1 Mesa-libGLESv1_CM-devel-18.3.2-lp151.23.11.1 Mesa-libGLESv1_CM1-18.3.2-lp151.23.11.1 Mesa-libGLESv2-2-18.3.2-lp151.23.11.1 Mesa-libGLESv2-devel-18.3.2-lp151.23.11.1 Mesa-libGLESv3-devel-18.3.2-lp151.23.11.1 Mesa-libOpenCL-18.3.2-lp151.23.11.1 Mesa-libOpenCL-debuginfo-18.3.2-lp151.23.11.1 Mesa-libVulkan-devel-18.3.2-lp151.23.11.1 Mesa-libd3d-18.3.2-lp151.23.11.1 Mesa-libd3d-debuginfo-18.3.2-lp151.23.11.1 Mesa-libd3d-devel-18.3.2-lp151.23.11.1 Mesa-libglapi-devel-18.3.2-lp151.23.11.1 Mesa-libglapi0-18.3.2-lp151.23.11.1 Mesa-libglapi0-debuginfo-18.3.2-lp151.23.11.1 Mesa-libva-18.3.2-lp151.23.11.1 Mesa-libva-debuginfo-18.3.2-lp151.23.11.1 libOSMesa-devel-18.3.2-lp151.23.11.1 libOSMesa8-18.3.2-lp151.23.11.1 libOSMesa8-debuginfo-18.3.2-lp151.23.11.1 libXvMC_nouveau-18.3.2-lp151.23.11.1 libXvMC_nouveau-debuginfo-18.3.2-lp151.23.11.1 libXvMC_r600-18.3.2-lp151.23.11.1 libXvMC_r600-debuginfo-18.3.2-lp151.23.11.1 libgbm-devel-18.3.2-lp151.23.11.1 libgbm1-18.3.2-lp151.23.11.1 libgbm1-debuginfo-18.3.2-lp151.23.11.1 libvdpau_nouveau-18.3.2-lp151.23.11.1 libvdpau_nouveau-debuginfo-18.3.2-lp151.23.11.1 libvdpau_r300-18.3.2-lp151.23.11.1 libvdpau_r300-debuginfo-18.3.2-lp151.23.11.1 libvdpau_r600-18.3.2-lp151.23.11.1 libvdpau_r600-debuginfo-18.3.2-lp151.23.11.1 libvdpau_radeonsi-18.3.2-lp151.23.11.1 libvdpau_radeonsi-debuginfo-18.3.2-lp151.23.11.1 libvulkan_intel-18.3.2-lp151.23.11.1 libvulkan_intel-debuginfo-18.3.2-lp151.23.11.1 libvulkan_radeon-18.3.2-lp151.23.11.1 libvulkan_radeon-debuginfo-18.3.2-lp151.23.11.1 libxatracker-devel-1.0.0-lp151.23.11.1 libxatracker2-1.0.0-lp151.23.11.1 libxatracker2-debuginfo-1.0.0-lp151.23.11.1 - openSUSE Leap 15.1 (x86_64): Mesa-32bit-18.3.2-lp151.23.11.1 Mesa-dri-32bit-18.3.2-lp151.23.11.1 Mesa-dri-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-dri-nouveau-32bit-18.3.2-lp151.23.11.1 Mesa-dri-nouveau-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-gallium-32bit-18.3.2-lp151.23.11.1 Mesa-gallium-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-libEGL1-32bit-18.3.2-lp151.23.11.1 Mesa-libEGL1-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-libGL1-32bit-18.3.2-lp151.23.11.1 Mesa-libGL1-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-libd3d-32bit-18.3.2-lp151.23.11.1 Mesa-libd3d-32bit-debuginfo-18.3.2-lp151.23.11.1 Mesa-libd3d-devel-32bit-18.3.2-lp151.23.11.1 Mesa-libglapi-devel-32bit-18.3.2-lp151.23.11.1 Mesa-libglapi0-32bit-18.3.2-lp151.23.11.1 Mesa-libglapi0-32bit-debuginfo-18.3.2-lp151.23.11.1 libOSMesa-devel-32bit-18.3.2-lp151.23.11.1 libOSMesa8-32bit-18.3.2-lp151.23.11.1 libOSMesa8-32bit-debuginfo-18.3.2-lp151.23.11.1 libXvMC_nouveau-32bit-18.3.2-lp151.23.11.1 libXvMC_nouveau-32bit-debuginfo-18.3.2-lp151.23.11.1 libXvMC_r600-32bit-18.3.2-lp151.23.11.1 libXvMC_r600-32bit-debuginfo-18.3.2-lp151.23.11.1 libgbm-devel-32bit-18.3.2-lp151.23.11.1 libgbm1-32bit-18.3.2-lp151.23.11.1 libgbm1-32bit-debuginfo-18.3.2-lp151.23.11.1 libvdpau_nouveau-32bit-18.3.2-lp151.23.11.1 libvdpau_nouveau-32bit-debuginfo-18.3.2-lp151.23.11.1 libvdpau_r300-32bit-18.3.2-lp151.23.11.1 libvdpau_r300-32bit-debuginfo-18.3.2-lp151.23.11.1 libvdpau_r600-32bit-18.3.2-lp151.23.11.1 libvdpau_r600-32bit-debuginfo-18.3.2-lp151.23.11.1 libvdpau_radeonsi-32bit-18.3.2-lp151.23.11.1 libvdpau_radeonsi-32bit-debuginfo-18.3.2-lp151.23.11.1 libvulkan_intel-32bit-18.3.2-lp151.23.11.1 libvulkan_intel-32bit-debuginfo-18.3.2-lp151.23.11.1 libvulkan_radeon-32bit-18.3.2-lp151.23.11.1 libvulkan_radeon-32bit-debuginfo-18.3.2-lp151.23.11.1 References: https://bugzilla.suse.com/1172302

1 0

openSUSE-RU-2020:0759-1: Recommended update for openal-soft
by maintenance＠opensuse.org 03 Jun '20

03 Jun '20

openSUSE Recommended Update: Recommended update for openal-soft ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0759-1 Rating: low References: #1172301 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: openal-soft was updated to provide corrected requires for openal-soft-devel-32bit for use for Wine development. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-759=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenal0-1.17.2-lp151.5.3.1 libopenal0-debuginfo-1.17.2-lp151.5.3.1 libopenal1-1.17.2-lp151.5.3.1 libopenal1-debuginfo-1.17.2-lp151.5.3.1 openal-soft-1.17.2-lp151.5.3.1 openal-soft-debuginfo-1.17.2-lp151.5.3.1 openal-soft-debugsource-1.17.2-lp151.5.3.1 openal-soft-devel-1.17.2-lp151.5.3.1 openal-soft-devel-debuginfo-1.17.2-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libopenal0-32bit-1.17.2-lp151.5.3.1 libopenal0-32bit-debuginfo-1.17.2-lp151.5.3.1 libopenal1-32bit-1.17.2-lp151.5.3.1 libopenal1-32bit-debuginfo-1.17.2-lp151.5.3.1 openal-soft-devel-32bit-1.17.2-lp151.5.3.1 openal-soft-devel-32bit-debuginfo-1.17.2-lp151.5.3.1 References: https://bugzilla.suse.com/1172301

1 0

openSUSE-RU-2020:0758-1: Recommened update for opencl
by maintenance＠opensuse.org 02 Jun '20

02 Jun '20

openSUSE Recommended Update: Recommened update for opencl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:0758-1 Rating: low References: #1172303 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides OpenCL 32bit packages for Wine usage. (bsc#1172303) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-758=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libOpenCL1-2.2.11-lp151.4.4.1 libOpenCL1-debuginfo-2.2.11-lp151.4.4.1 ocl-icd-debugsource-2.2.11-lp151.4.4.1 ocl-icd-devel-2.2.11-lp151.4.4.1 - openSUSE Leap 15.1 (noarch): opencl-headers-2.2+git.20170617-lp151.3.2.1 - openSUSE Leap 15.1 (x86_64): libOpenCL1-32bit-2.2.11-lp151.4.4.1 libOpenCL1-32bit-debuginfo-2.2.11-lp151.4.4.1 ocl-icd-devel-32bit-2.2.11-lp151.4.4.1 References: https://bugzilla.suse.com/1172303

1 0

openSUSE-SU-2020:0756-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 02 Jun '20

02 Jun '20

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0756-1 Rating: moderate References: #1158880 #1167816 #1170940 Cross-References: CVE-2020-1983 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issue fixed: - CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940). Non-security issues fixed: - Fixed an issue where limiting the memory bandwidth was not possible (bsc#1167816). - Fixed the issue that s390x could not read IPL channel program when using dasd as boot device (bsc#1158880). - Miscellaneous fixes to the in-package support documentation. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-756=1 Package List: - openSUSE Leap 15.1 (noarch): qemu-ipxe-1.0.0+-lp151.7.15.2 qemu-seabios-1.12.0-lp151.7.15.2 qemu-sgabios-8-lp151.7.15.2 qemu-vgabios-1.12.0-lp151.7.15.2 - openSUSE Leap 15.1 (x86_64): qemu-3.1.1.1-lp151.7.15.2 qemu-arm-3.1.1.1-lp151.7.15.2 qemu-arm-debuginfo-3.1.1.1-lp151.7.15.2 qemu-audio-alsa-3.1.1.1-lp151.7.15.2 qemu-audio-alsa-debuginfo-3.1.1.1-lp151.7.15.2 qemu-audio-oss-3.1.1.1-lp151.7.15.2 qemu-audio-oss-debuginfo-3.1.1.1-lp151.7.15.2 qemu-audio-pa-3.1.1.1-lp151.7.15.2 qemu-audio-pa-debuginfo-3.1.1.1-lp151.7.15.2 qemu-audio-sdl-3.1.1.1-lp151.7.15.2 qemu-audio-sdl-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-curl-3.1.1.1-lp151.7.15.2 qemu-block-curl-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-dmg-3.1.1.1-lp151.7.15.2 qemu-block-dmg-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-gluster-3.1.1.1-lp151.7.15.2 qemu-block-gluster-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-iscsi-3.1.1.1-lp151.7.15.2 qemu-block-iscsi-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-nfs-3.1.1.1-lp151.7.15.2 qemu-block-nfs-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-rbd-3.1.1.1-lp151.7.15.2 qemu-block-rbd-debuginfo-3.1.1.1-lp151.7.15.2 qemu-block-ssh-3.1.1.1-lp151.7.15.2 qemu-block-ssh-debuginfo-3.1.1.1-lp151.7.15.2 qemu-debuginfo-3.1.1.1-lp151.7.15.2 qemu-debugsource-3.1.1.1-lp151.7.15.2 qemu-extra-3.1.1.1-lp151.7.15.2 qemu-extra-debuginfo-3.1.1.1-lp151.7.15.2 qemu-guest-agent-3.1.1.1-lp151.7.15.2 qemu-guest-agent-debuginfo-3.1.1.1-lp151.7.15.2 qemu-ksm-3.1.1.1-lp151.7.15.2 qemu-kvm-3.1.1.1-lp151.7.15.2 qemu-lang-3.1.1.1-lp151.7.15.2 qemu-linux-user-3.1.1.1-lp151.7.15.2 qemu-linux-user-debuginfo-3.1.1.1-lp151.7.15.2 qemu-linux-user-debugsource-3.1.1.1-lp151.7.15.2 qemu-ppc-3.1.1.1-lp151.7.15.2 qemu-ppc-debuginfo-3.1.1.1-lp151.7.15.2 qemu-s390-3.1.1.1-lp151.7.15.2 qemu-s390-debuginfo-3.1.1.1-lp151.7.15.2 qemu-tools-3.1.1.1-lp151.7.15.2 qemu-tools-debuginfo-3.1.1.1-lp151.7.15.2 qemu-ui-curses-3.1.1.1-lp151.7.15.2 qemu-ui-curses-debuginfo-3.1.1.1-lp151.7.15.2 qemu-ui-gtk-3.1.1.1-lp151.7.15.2 qemu-ui-gtk-debuginfo-3.1.1.1-lp151.7.15.2 qemu-ui-sdl-3.1.1.1-lp151.7.15.2 qemu-ui-sdl-debuginfo-3.1.1.1-lp151.7.15.2 qemu-x86-3.1.1.1-lp151.7.15.2 qemu-x86-debuginfo-3.1.1.1-lp151.7.15.2 References: https://www.suse.com/security/cve/CVE-2020-1983.html https://bugzilla.suse.com/1158880 https://bugzilla.suse.com/1167816 https://bugzilla.suse.com/1170940

1 0

openSUSE-SU-2020:0757-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 02 Jun '20

02 Jun '20

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0757-1 Rating: important References: #1167462 #1169511 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2767 CVE-2020-2773 CVE-2020-2778 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2816 CVE-2020-2830 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 (April 2020 CPU, bsc#1169511). Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2755: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2756: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2757: Fixed an object deserialization issue that could have resulted in denial of service via crafted serialized input (bsc#1169511). - CVE-2020-2767: Fixed an incorrect handling of certificate messages during TLS handshakes (bsc#1169511). - CVE-2020-2773: Fixed the incorrect handling of exceptions thrown by unmarshalKeyInfo() and unmarshalXMLSignature() (bsc#1169511). - CVE-2020-2778: Fixed the incorrect handling of SSLParameters in setAlgorithmConstraints(), which could have been abused to override the defined systems security policy and lead to the use of weak crypto algorithms (bsc#1169511). - CVE-2020-2781: Fixed the incorrect re-use of single null TLS sessions (bsc#1169511). - CVE-2020-2800: Fixed an HTTP header injection issue caused by mishandling of CR/LF in header values (bsc#1169511). - CVE-2020-2803: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511). - CVE-2020-2805: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511). - CVE-2020-2816: Fixed an incorrect handling of application data packets during TLS handshakes (bsc#1169511). - CVE-2020-2830: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-757=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.7.0-lp151.3.16.1 java-11-openjdk-accessibility-11.0.7.0-lp151.3.16.1 java-11-openjdk-accessibility-debuginfo-11.0.7.0-lp151.3.16.1 java-11-openjdk-debuginfo-11.0.7.0-lp151.3.16.1 java-11-openjdk-debugsource-11.0.7.0-lp151.3.16.1 java-11-openjdk-demo-11.0.7.0-lp151.3.16.1 java-11-openjdk-devel-11.0.7.0-lp151.3.16.1 java-11-openjdk-headless-11.0.7.0-lp151.3.16.1 java-11-openjdk-jmods-11.0.7.0-lp151.3.16.1 java-11-openjdk-src-11.0.7.0-lp151.3.16.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.7.0-lp151.3.16.1 References: https://www.suse.com/security/cve/CVE-2020-2754.html https://www.suse.com/security/cve/CVE-2020-2755.html https://www.suse.com/security/cve/CVE-2020-2756.html https://www.suse.com/security/cve/CVE-2020-2757.html https://www.suse.com/security/cve/CVE-2020-2767.html https://www.suse.com/security/cve/CVE-2020-2773.html https://www.suse.com/security/cve/CVE-2020-2778.html https://www.suse.com/security/cve/CVE-2020-2781.html https://www.suse.com/security/cve/CVE-2020-2800.html https://www.suse.com/security/cve/CVE-2020-2803.html https://www.suse.com/security/cve/CVE-2020-2805.html https://www.suse.com/security/cve/CVE-2020-2816.html https://www.suse.com/security/cve/CVE-2020-2830.html https://bugzilla.suse.com/1167462 https://bugzilla.suse.com/1169511

1 0