July 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1010-1: important: Recommended update for yast2-installation
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1010-1 Rating: important References: #1172853 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-installation fixes the following issues: - Fixes an isuse where /etc/nvme/hostnqn nor /etc/nvme/hostid were available after system installation (bsc#1172853) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1010=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-installation-4.2.43-lp152.2.3.1 References: https://bugzilla.suse.com/1172853

1 0

openSUSE-RU-2020:1006-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1006-1 Rating: moderate References: #1170270 #1172734 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for resource-agents fixes the following issues: - Fixed a bug where the pulling of images was stuck (bsc#1170270) - Added a fix for defect file /usr/lib/ocf/resource.d/heartbeat/clvm (bsc#1172734) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1006=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ldirectord-4.4.0+git57.70549516-lp152.2.3.1 resource-agents-4.4.0+git57.70549516-lp152.2.3.1 resource-agents-debuginfo-4.4.0+git57.70549516-lp152.2.3.1 resource-agents-debugsource-4.4.0+git57.70549516-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): monitoring-plugins-metadata-4.4.0+git57.70549516-lp152.2.3.1 References: https://bugzilla.suse.com/1170270 https://bugzilla.suse.com/1172734

1 0

openSUSE-RU-2020:1008-1: moderate: Recommended update for keepassxc
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for keepassxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1008-1 Rating: moderate References: #1171438 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for keepassxc fixes the following issues: - Update to version 2.6.0: * https://keepassxc.org/blog/2020-07-07-2.6.0-released/ * https://github.com/keepassxreboot/keepassxc/releases/tag/2.6.0 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1008=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1008=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1008=1 Package List: - openSUSE Leap 15.2 (noarch): keepassxc-lang-2.6.0-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): keepassxc-2.6.0-lp152.3.3.1 keepassxc-debuginfo-2.6.0-lp152.3.3.1 keepassxc-debugsource-2.6.0-lp152.3.3.1 - openSUSE Leap 15.1 (x86_64): keepassxc-2.6.0-lp151.2.18.1 keepassxc-debuginfo-2.6.0-lp151.2.18.1 keepassxc-debugsource-2.6.0-lp151.2.18.1 - openSUSE Leap 15.1 (noarch): keepassxc-lang-2.6.0-lp151.2.18.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): keepassxc-2.6.0-bp151.3.15.1 - openSUSE Backports SLE-15-SP1 (noarch): keepassxc-lang-2.6.0-bp151.3.15.1 References: https://bugzilla.suse.com/1171438

1 0

openSUSE-SU-2020:1005-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1005-1 Rating: moderate References: #1173302 Cross-References: CVE-2020-14196 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns-recursor fixes the following issues: - CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1005=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1005=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1005=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1005=1 Package List: - openSUSE Leap 15.2 (x86_64): pdns-recursor-4.3.2-lp152.2.3.1 pdns-recursor-debuginfo-4.3.2-lp152.2.3.1 pdns-recursor-debugsource-4.3.2-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): pdns-recursor-4.1.12-lp151.3.6.1 pdns-recursor-debuginfo-4.1.12-lp151.3.6.1 pdns-recursor-debugsource-4.1.12-lp151.3.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.12-bp151.4.6.1 pdns-recursor-debuginfo-4.1.12-bp151.4.6.1 pdns-recursor-debugsource-4.1.12-bp151.4.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.17-22.1 References: https://www.suse.com/security/cve/CVE-2020-14196.html https://bugzilla.suse.com/1173302

1 0

openSUSE-SU-2020:1007-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1007-1 Rating: moderate References: #1125401 #1169740 #1171355 #1172651 #1173334 #992038 Cross-References: CVE-2018-8956 CVE-2020-11868 CVE-2020-13817 CVE-2020-15025 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for ntp fixes the following issues: ntp was updated to 4.2.8p15 - CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address frequently send to the client ntpd could have caused denial of service (bsc#1169740). - CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed mode 3 and mode 5 packets (bsc#1171355). - CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651). - CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334). - Removed an OpenSSL version warning (bsc#992038 and bsc#1125401). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1007=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ntp-4.2.8p15-lp152.3.3.1 ntp-debuginfo-4.2.8p15-lp152.3.3.1 ntp-debugsource-4.2.8p15-lp152.3.3.1 ntp-doc-4.2.8p15-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-8956.html https://www.suse.com/security/cve/CVE-2020-11868.html https://www.suse.com/security/cve/CVE-2020-13817.html https://www.suse.com/security/cve/CVE-2020-15025.html https://bugzilla.suse.com/1125401 https://bugzilla.suse.com/1169740 https://bugzilla.suse.com/1171355 https://bugzilla.suse.com/1172651 https://bugzilla.suse.com/1173334 https://bugzilla.suse.com/992038

1 0

openSUSE-SU-2020:1005-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1005-1 Rating: moderate References: #1173302 Cross-References: CVE-2020-14196 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns-recursor fixes the following issues: - CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1005=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.17-22.1 References: https://www.suse.com/security/cve/CVE-2020-14196.html https://bugzilla.suse.com/1173302

1 0

openSUSE-RU-2020:1009-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1009-1 Rating: moderate References: #1172807 #1172816 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - 35network-legacy: Fix dual stack setups. (bsc#1172807) - 95iscsi: fix missing space when compiling cmdline args. (bsc#1172816) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1009=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dracut-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-debuginfo-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-debugsource-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-extra-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-fips-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-ima-049.1+suse.146.g6f5195cf-lp152.2.3.1 dracut-tools-049.1+suse.146.g6f5195cf-lp152.2.3.1 References: https://bugzilla.suse.com/1172807 https://bugzilla.suse.com/1172816

1 0

openSUSE-RU-2020:1004-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1004-1 Rating: moderate References: #1173608 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxd fixes the following issues: Update to LXD 4.3. The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-3-has-been-released/8303 + Block custom storage volumes + VM: Initial work for graphical console * VM: Rework of PCIe layout + VM: GPU passthrough * Direct console attach on lxc start and lxc restart * Isolated CPUs reporting in resources API Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1004=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1004=1 Package List: - openSUSE Leap 15.2 (x86_64): lxd-4.3-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): lxd-bash-completion-4.3-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): lxd-4.3-lp151.42.1 - openSUSE Leap 15.1 (noarch): lxd-bash-completion-4.3-lp151.42.1 References: https://bugzilla.suse.com/1173608

1 0

openSUSE-SU-2020:1003-1: moderate: Security update for cairo
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for cairo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1003-1 Rating: moderate References: #1049092 Cross-References: CVE-2017-9814 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cairo fixes the following issues: - Fix a memory corruption in pango. - Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add more FreeeType font color conversions to support COLR/CPAL. - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix memory leaks found by Coverity. - Fix assertion failure in the freetype backend. (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (bsc#1049092) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1003=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cairo-debugsource-1.16.0-lp151.5.3.1 cairo-devel-1.16.0-lp151.5.3.1 cairo-tools-1.16.0-lp151.5.3.1 cairo-tools-debuginfo-1.16.0-lp151.5.3.1 libcairo-gobject2-1.16.0-lp151.5.3.1 libcairo-gobject2-debuginfo-1.16.0-lp151.5.3.1 libcairo-script-interpreter2-1.16.0-lp151.5.3.1 libcairo-script-interpreter2-debuginfo-1.16.0-lp151.5.3.1 libcairo2-1.16.0-lp151.5.3.1 libcairo2-debuginfo-1.16.0-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): cairo-devel-32bit-1.16.0-lp151.5.3.1 libcairo-gobject2-32bit-1.16.0-lp151.5.3.1 libcairo-gobject2-32bit-debuginfo-1.16.0-lp151.5.3.1 libcairo-script-interpreter2-32bit-1.16.0-lp151.5.3.1 libcairo-script-interpreter2-32bit-debuginfo-1.16.0-lp151.5.3.1 libcairo2-32bit-1.16.0-lp151.5.3.1 libcairo2-32bit-debuginfo-1.16.0-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-9814.html https://bugzilla.suse.com/1049092

1 0

openSUSE-SU-2020:1002-1: important: Security update for python-ipaddress
by opensuse-security＠opensuse.org 19 Jul '20

19 Jul '20

openSUSE Security Update: Security update for python-ipaddress ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1002-1 Rating: important References: #1173274 Cross-References: CVE-2020-14422 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-ipaddress fixes the following issues: - Add CVE-2020-14422-ipaddress-hash-collision.patch fixing CVE-2020-14422 (bsc#1173274, bpo#41004), where hash collisions in IPv4Interface and IPv6Interface could lead to DOS. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1002=1 Package List: - openSUSE Leap 15.2 (noarch): python-ipaddress-1.0.18-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-14422.html https://bugzilla.suse.com/1173274

1 0