July 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1116-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 31 Jul '20

31 Jul '20

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1116-1 Rating: moderate References: #1174457 Cross-References: CVE-2020-15917 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: - CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1116=1 Package List: - openSUSE Leap 15.1 (noarch): claws-mail-lang-3.17.3-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): claws-mail-3.17.3-lp151.2.3.1 claws-mail-debuginfo-3.17.3-lp151.2.3.1 claws-mail-debugsource-3.17.3-lp151.2.3.1 claws-mail-devel-3.17.3-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15917.html https://bugzilla.suse.com/1174457

1 0

openSUSE-RU-2020:1114-1: Recommended update for go1.12
by maintenance＠opensuse.org 30 Jul '20

30 Jul '20

openSUSE Recommended Update: Recommended update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1114-1 Rating: low References: #1169832 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.12 fixes the following issues: - Fix for an issue when installing on Raspberry Pi causes illegal instruction due to unproper ARM arch set. (bsc#1169832) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1114=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.17-lp151.2.37.1 go1.12-doc-1.12.17-lp151.2.37.1 go1.12-race-1.12.17-lp151.2.37.1 References: https://bugzilla.suse.com/1169832

1 0

openSUSE-RU-2020:1115-1: moderate: Recommended update for nodejs12
by maintenance＠opensuse.org 30 Jul '20

30 Jul '20

openSUSE Recommended Update: Recommended update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1115-1 Rating: moderate References: #1173653 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nodejs12 fixes the following issues: - Fixes reported memory leak. (bsc#1173653) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1115=1 Package List: - openSUSE Leap 15.2 (x86_64): nodejs12-12.18.2-lp152.3.3.1 nodejs12-debuginfo-12.18.2-lp152.3.3.1 nodejs12-debugsource-12.18.2-lp152.3.3.1 nodejs12-devel-12.18.2-lp152.3.3.1 npm12-12.18.2-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.18.2-lp152.3.3.1 References: https://bugzilla.suse.com/1173653

1 0

openSUSE-RU-2020:1113-1: moderate: Recommended update for go1.12
by maintenance＠opensuse.org 30 Jul '20

30 Jul '20

openSUSE Recommended Update: Recommended update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1113-1 Rating: moderate References: #1170826 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.12 fixes the following issues: - Add 'binutils-gold' as a dependency for arm and aarch64 architectures. (bsc#1170826) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1113=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): go1.12-1.12.17-lp152.3.3.1 go1.12-doc-1.12.17-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): go1.12-race-1.12.17-lp152.3.3.1 References: https://bugzilla.suse.com/1170826

1 0

openSUSE-SU-2020:1112-1: moderate: Security update for knot
by opensuse-security＠opensuse.org 29 Jul '20

29 Jul '20

openSUSE Security Update: Security update for knot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1112-1 Rating: moderate References: #1047841 Cross-References: CVE-2017-11104 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for knot fixes the following issues: - CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1112=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): knot-1.6.8-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-11104.html https://bugzilla.suse.com/1047841

1 0

openSUSE-SU-2020:1111-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 29 Jul '20

29 Jul '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1111-1 Rating: important References: #1174117 #1174121 Cross-References: CVE-2020-13934 CVE-2020-13935 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tomcat fixes the following issues: - Fixed CVEs: * CVE-2020-13934 (bsc#1174121) * CVE-2020-13935 (bsc#1174117) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1111=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.4.1 tomcat-admin-webapps-9.0.36-lp152.2.4.1 tomcat-docs-webapp-9.0.36-lp152.2.4.1 tomcat-el-3_0-api-9.0.36-lp152.2.4.1 tomcat-embed-9.0.36-lp152.2.4.1 tomcat-javadoc-9.0.36-lp152.2.4.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.4.1 tomcat-jsvc-9.0.36-lp152.2.4.1 tomcat-lib-9.0.36-lp152.2.4.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.4.1 tomcat-webapps-9.0.36-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-13934.html https://www.suse.com/security/cve/CVE-2020-13935.html https://bugzilla.suse.com/1174117 https://bugzilla.suse.com/1174121

1 0

openSUSE-SU-2020:1108-1: important: Security update for qemu
by opensuse-security＠opensuse.org 28 Jul '20

28 Jul '20

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1108-1 Rating: important References: #1172383 #1172384 #1172386 #1172495 #1172710 Cross-References: CVE-2020-10761 CVE-2020-13361 CVE-2020-13362 CVE-2020-13659 CVE-2020-13800 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for qemu to version 4.2.1 fixes the following issues: - CVE-2020-10761: Fixed a denial of service in Network Block Device (nbd) support infrastructure (bsc#1172710). - CVE-2020-13800: Fixed a denial of service possibility in ati-vga emulation (bsc#1172495). - CVE-2020-13659: Fixed a null pointer dereference possibility in MegaRAID SAS 8708EM2 emulation (bsc#1172386). - CVE-2020-13362: Fixed an OOB access possibility in MegaRAID SAS 8708EM2 emulation (bsc#1172383). - CVE-2020-13361: Fixed an OOB access possibility in ES1370 audio device emulation (bsc#1172384). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1108=1 Package List: - openSUSE Leap 15.2 (noarch): qemu-ipxe-1.0.0+-lp152.9.3.1 qemu-microvm-4.2.1-lp152.9.3.1 qemu-seabios-1.12.1+-lp152.9.3.1 qemu-sgabios-8-lp152.9.3.1 qemu-vgabios-1.12.1+-lp152.9.3.1 - openSUSE Leap 15.2 (x86_64): qemu-4.2.1-lp152.9.3.1 qemu-arm-4.2.1-lp152.9.3.1 qemu-arm-debuginfo-4.2.1-lp152.9.3.1 qemu-audio-alsa-4.2.1-lp152.9.3.1 qemu-audio-alsa-debuginfo-4.2.1-lp152.9.3.1 qemu-audio-pa-4.2.1-lp152.9.3.1 qemu-audio-pa-debuginfo-4.2.1-lp152.9.3.1 qemu-audio-sdl-4.2.1-lp152.9.3.1 qemu-audio-sdl-debuginfo-4.2.1-lp152.9.3.1 qemu-block-curl-4.2.1-lp152.9.3.1 qemu-block-curl-debuginfo-4.2.1-lp152.9.3.1 qemu-block-dmg-4.2.1-lp152.9.3.1 qemu-block-dmg-debuginfo-4.2.1-lp152.9.3.1 qemu-block-gluster-4.2.1-lp152.9.3.1 qemu-block-gluster-debuginfo-4.2.1-lp152.9.3.1 qemu-block-iscsi-4.2.1-lp152.9.3.1 qemu-block-iscsi-debuginfo-4.2.1-lp152.9.3.1 qemu-block-nfs-4.2.1-lp152.9.3.1 qemu-block-nfs-debuginfo-4.2.1-lp152.9.3.1 qemu-block-rbd-4.2.1-lp152.9.3.1 qemu-block-rbd-debuginfo-4.2.1-lp152.9.3.1 qemu-block-ssh-4.2.1-lp152.9.3.1 qemu-block-ssh-debuginfo-4.2.1-lp152.9.3.1 qemu-debuginfo-4.2.1-lp152.9.3.1 qemu-debugsource-4.2.1-lp152.9.3.1 qemu-extra-4.2.1-lp152.9.3.1 qemu-extra-debuginfo-4.2.1-lp152.9.3.1 qemu-guest-agent-4.2.1-lp152.9.3.1 qemu-guest-agent-debuginfo-4.2.1-lp152.9.3.1 qemu-ksm-4.2.1-lp152.9.3.1 qemu-kvm-4.2.1-lp152.9.3.1 qemu-lang-4.2.1-lp152.9.3.1 qemu-linux-user-4.2.1-lp152.9.3.1 qemu-linux-user-debuginfo-4.2.1-lp152.9.3.1 qemu-linux-user-debugsource-4.2.1-lp152.9.3.1 qemu-ppc-4.2.1-lp152.9.3.1 qemu-ppc-debuginfo-4.2.1-lp152.9.3.1 qemu-s390-4.2.1-lp152.9.3.1 qemu-s390-debuginfo-4.2.1-lp152.9.3.1 qemu-testsuite-4.2.1-lp152.9.3.1 qemu-tools-4.2.1-lp152.9.3.1 qemu-tools-debuginfo-4.2.1-lp152.9.3.1 qemu-ui-curses-4.2.1-lp152.9.3.1 qemu-ui-curses-debuginfo-4.2.1-lp152.9.3.1 qemu-ui-gtk-4.2.1-lp152.9.3.1 qemu-ui-gtk-debuginfo-4.2.1-lp152.9.3.1 qemu-ui-sdl-4.2.1-lp152.9.3.1 qemu-ui-sdl-debuginfo-4.2.1-lp152.9.3.1 qemu-ui-spice-app-4.2.1-lp152.9.3.1 qemu-ui-spice-app-debuginfo-4.2.1-lp152.9.3.1 qemu-vhost-user-gpu-4.2.1-lp152.9.3.1 qemu-vhost-user-gpu-debuginfo-4.2.1-lp152.9.3.1 qemu-x86-4.2.1-lp152.9.3.1 qemu-x86-debuginfo-4.2.1-lp152.9.3.1 References: https://www.suse.com/security/cve/CVE-2020-10761.html https://www.suse.com/security/cve/CVE-2020-13361.html https://www.suse.com/security/cve/CVE-2020-13362.html https://www.suse.com/security/cve/CVE-2020-13659.html https://www.suse.com/security/cve/CVE-2020-13800.html https://bugzilla.suse.com/1172383 https://bugzilla.suse.com/1172384 https://bugzilla.suse.com/1172386 https://bugzilla.suse.com/1172495 https://bugzilla.suse.com/1172710

1 0

openSUSE-RU-2020:1109-1: moderate: Recommended update for libsolv, libzypp
by maintenance＠opensuse.org 28 Jul '20

28 Jul '20

openSUSE Recommended Update: Recommended update for libsolv, libzypp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1109-1 Rating: moderate References: #1170801 #1171224 #1172135 #1173106 #1174011 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for libsolv, libzypp fixes the following issues: libsolv was updated to version 0.7.14: - Enable zstd compression support for sle15 - Support blacklisted packages in solver_findproblemrule() (bsc#1172135) - Support rules with multiple negative literals in choice rule generation libzypp was updated to version 17.24.0: - Enable zchunk metadata download if libsolv supports it. - Older kernel-devel packages are not properly purged (bsc#1171224) - doc: enhance service plugin example. - Fix core dump with corrupted history file (bsc#1170801) - Better handling of the purge-kernels algorithm. (bsc#1173106) - Proactively send credentials if the URL specifes '?auth=basic' and a username. (bsc#1174011) - ZYPP_MEDIA_CURL_DEBUG: Strip credentials in header log. (bsc#1174011) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1109=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libsolv-debuginfo-0.7.14-lp151.2.19.1 libsolv-debugsource-0.7.14-lp151.2.19.1 libsolv-demo-0.7.14-lp151.2.19.1 libsolv-demo-debuginfo-0.7.14-lp151.2.19.1 libsolv-devel-0.7.14-lp151.2.19.1 libsolv-devel-debuginfo-0.7.14-lp151.2.19.1 libsolv-tools-0.7.14-lp151.2.19.1 libsolv-tools-debuginfo-0.7.14-lp151.2.19.1 perl-solv-0.7.14-lp151.2.19.1 perl-solv-debuginfo-0.7.14-lp151.2.19.1 python-solv-0.7.14-lp151.2.19.1 python-solv-debuginfo-0.7.14-lp151.2.19.1 python3-solv-0.7.14-lp151.2.19.1 python3-solv-debuginfo-0.7.14-lp151.2.19.1 ruby-solv-0.7.14-lp151.2.19.1 ruby-solv-debuginfo-0.7.14-lp151.2.19.1 - openSUSE Leap 15.1 (x86_64): libzypp-17.24.1-lp151.2.19.1 libzypp-debuginfo-17.24.1-lp151.2.19.1 libzypp-debugsource-17.24.1-lp151.2.19.1 libzypp-devel-17.24.1-lp151.2.19.1 libzypp-devel-doc-17.24.1-lp151.2.19.1 References: https://bugzilla.suse.com/1170801 https://bugzilla.suse.com/1171224 https://bugzilla.suse.com/1172135 https://bugzilla.suse.com/1173106 https://bugzilla.suse.com/1174011

1 0

openSUSE-SU-2020:1106-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 28 Jul '20

28 Jul '20

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1106-1 Rating: moderate References: #1115436 #1154087 #1173090 Cross-References: CVE-2020-11022 CVE-2020-11023 CVE-2020-13625 CVE-2020-14295 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: - cacti 1.2.13: * Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023) * Lack of escaping on some pages can lead to XSS exposure * Update PHPMailer to 6.1.6 (CVE-2020-13625) * SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090) * Lack of escaping on template import can lead to XSS exposure - switch from cron to systemd timers (boo#1115436): + cacti-cron.timer + cacti-cron.service - avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation - rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1106=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.13-bp151.4.12.1 cacti-spine-debuginfo-1.2.13-bp151.4.12.1 cacti-spine-debugsource-1.2.13-bp151.4.12.1 - openSUSE Backports SLE-15-SP1 (noarch): cacti-1.2.13-bp151.4.12.1 References: https://www.suse.com/security/cve/CVE-2020-11022.html https://www.suse.com/security/cve/CVE-2020-11023.html https://www.suse.com/security/cve/CVE-2020-13625.html https://www.suse.com/security/cve/CVE-2020-14295.html https://bugzilla.suse.com/1115436 https://bugzilla.suse.com/1154087 https://bugzilla.suse.com/1173090

1 0

openSUSE-RU-2020:1107-1: moderate: Recommended update for putty
by maintenance＠opensuse.org 28 Jul '20

28 Jul '20

openSUSE Recommended Update: Recommended update for putty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1107-1 Rating: moderate References: #1173442 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for putty fixes the following issues: putty was updated to release 0.74: * security fix: if an SSH server accepted an offer of a public key and then rejected the signature, PuTTY could access freed memory, if the key had come from an SSH agent. (boo#1173442) * Added a new configuration option to mitigate a minor information leak in SSH host key policy. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1107=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): putty-0.74-bp151.4.9.1 References: https://bugzilla.suse.com/1173442

1 0