July 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1092-1: Recommended update for go1.11
by maintenance＠opensuse.org 27 Jul '20

27 Jul '20

openSUSE Recommended Update: Recommended update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1092-1 Rating: low References: #1169832 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.11 fixes the following issues: - Fix for an issue when installing on Raspberry Pi causes illegal instruction due to unproper ARM arch set. (bsc#1169832) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1092=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): go1.11-1.11.13-lp152.4.3.1 go1.11-doc-1.11.13-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): go1.11-race-1.11.13-lp152.4.3.1 References: https://bugzilla.suse.com/1169832

1 0

openSUSE-RU-2020:1091-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 27 Jul '20

27 Jul '20

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1091-1 Rating: moderate References: #1172040 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apparmor fixes the following issues: - Add 'UI_Showfile' so Yast shows the profile correctly. (bsc#1172040) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1091=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_apparmor-2.13.4-lp152.2.3.1 apache2-mod_apparmor-debuginfo-2.13.4-lp152.2.3.1 apparmor-debugsource-2.13.4-lp152.2.3.1 apparmor-parser-2.13.4-lp152.2.3.1 apparmor-parser-debuginfo-2.13.4-lp152.2.3.1 libapparmor-debugsource-2.13.4-lp152.2.3.1 libapparmor-devel-2.13.4-lp152.2.3.1 libapparmor1-2.13.4-lp152.2.3.1 libapparmor1-debuginfo-2.13.4-lp152.2.3.1 pam_apparmor-2.13.4-lp152.2.3.1 pam_apparmor-debuginfo-2.13.4-lp152.2.3.1 perl-apparmor-2.13.4-lp152.2.3.1 perl-apparmor-debuginfo-2.13.4-lp152.2.3.1 python3-apparmor-2.13.4-lp152.2.3.1 python3-apparmor-debuginfo-2.13.4-lp152.2.3.1 ruby-apparmor-2.13.4-lp152.2.3.1 ruby-apparmor-debuginfo-2.13.4-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): apparmor-abstractions-2.13.4-lp152.2.3.1 apparmor-docs-2.13.4-lp152.2.3.1 apparmor-parser-lang-2.13.4-lp152.2.3.1 apparmor-profiles-2.13.4-lp152.2.3.1 apparmor-utils-2.13.4-lp152.2.3.1 apparmor-utils-lang-2.13.4-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libapparmor1-32bit-2.13.4-lp152.2.3.1 libapparmor1-32bit-debuginfo-2.13.4-lp152.2.3.1 pam_apparmor-32bit-2.13.4-lp152.2.3.1 pam_apparmor-32bit-debuginfo-2.13.4-lp152.2.3.1 References: https://bugzilla.suse.com/1172040

1 0

openSUSE-SU-2020:1090-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1090-1 Rating: important References: #1169679 #1169748 #1171441 #1171443 #1171444 #1171445 #1171446 #1171447 #1171474 #1173247 #1173605 #1174200 Cross-References: CVE-2020-11017 CVE-2020-11018 CVE-2020-11019 CVE-2020-11038 CVE-2020-11039 CVE-2020-11040 CVE-2020-11041 CVE-2020-11043 CVE-2020-11085 CVE-2020-11086 CVE-2020-11087 CVE-2020-11088 CVE-2020-11089 CVE-2020-11095 CVE-2020-11096 CVE-2020-11097 CVE-2020-11098 CVE-2020-11099 CVE-2020-11521 CVE-2020-11522 CVE-2020-11523 CVE-2020-11524 CVE-2020-11525 CVE-2020-11526 CVE-2020-13396 CVE-2020-13397 CVE-2020-13398 CVE-2020-4030 CVE-2020-4031 CVE-2020-4032 CVE-2020-4033 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: This update for freerdp fixes the following issues: frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006): - CVE-2020-11017: Fixed a double free which could have denied the server's service. - CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have triggered. - CVE-2020-11019: Fixed an issue which could have led to denial of service if logger was set to "WLOG_TRACE". - CVE-2020-11038: Fixed a buffer overflow when /video redirection was used. - CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory read and write when USB redirection was enabled. - CVE-2020-11040: Fixed an out of bounds data read in clear_decompress_subcode_rlex. - CVE-2020-11041: Fixed an issue with the configuration for sound backend which could have led to server's denial of service. - CVE-2020-11043: Fixed an out of bounds read in rfx_process_message_tileset. - CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list. - CVE-2020-11086: Fixed an out of bounds read in ntlm_read_ntlm_v2_client_challenge. - CVE-2020-11087: Fixed an out of bounds read in ntlm_read_AuthenticateMessage. - CVE-2020-11088: Fixed an out of bounds read in ntlm_read_NegotiateMessage. - CVE-2020-11089: Fixed an out of bounds read in irp function family. - CVE-2020-11095: Fixed a global out of bounds read in update_recv_primary_order. - CVE-2020-11096: Fixed a global out of bounds read in update_read_cache_bitmap_v3_order. - CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get. - CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put. - CVE-2020-11099: Fixed an out of bounds Read in license_read_new_or_upgrade_license_packet. - CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443). - CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444). - CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445). - CVE-2020-11524: Fixed an out of bounds write in interleaved.c (bsc#1171446). - CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447). - CVE-2020-11526: Fixed an out of bounds read in update_recv_secondary_order (bsc#1171674). - CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage. - CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due to uninitialized value. - CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common. - CVE-2020-4030: Fixed an out of bounds read in `TrioParse`. - CVE-2020-4031: Fixed a use after free in gdi_SelectObject. - CVE-2020-4032: Fixed an integer casting in `update_recv_secondary_order`. - CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS. - Fixed an issue where freerdp failed with -fno-common (bsc#1169748). - Fixed an issue where USB redirection with FreeRDP was not working (bsc#1169679). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1090=1 Package List: - openSUSE Leap 15.1 (x86_64): freerdp-2.1.2-lp151.5.6.1 freerdp-debuginfo-2.1.2-lp151.5.6.1 freerdp-debugsource-2.1.2-lp151.5.6.1 freerdp-devel-2.1.2-lp151.5.6.1 freerdp-proxy-2.1.2-lp151.5.6.1 freerdp-proxy-debuginfo-2.1.2-lp151.5.6.1 freerdp-server-2.1.2-lp151.5.6.1 freerdp-server-debuginfo-2.1.2-lp151.5.6.1 freerdp-wayland-2.1.2-lp151.5.6.1 freerdp-wayland-debuginfo-2.1.2-lp151.5.6.1 libfreerdp2-2.1.2-lp151.5.6.1 libfreerdp2-debuginfo-2.1.2-lp151.5.6.1 libuwac0-0-2.1.2-lp151.5.6.1 libuwac0-0-debuginfo-2.1.2-lp151.5.6.1 libwinpr2-2.1.2-lp151.5.6.1 libwinpr2-debuginfo-2.1.2-lp151.5.6.1 uwac0-0-devel-2.1.2-lp151.5.6.1 winpr2-devel-2.1.2-lp151.5.6.1 References: https://www.suse.com/security/cve/CVE-2020-11017.html https://www.suse.com/security/cve/CVE-2020-11018.html https://www.suse.com/security/cve/CVE-2020-11019.html https://www.suse.com/security/cve/CVE-2020-11038.html https://www.suse.com/security/cve/CVE-2020-11039.html https://www.suse.com/security/cve/CVE-2020-11040.html https://www.suse.com/security/cve/CVE-2020-11041.html https://www.suse.com/security/cve/CVE-2020-11043.html https://www.suse.com/security/cve/CVE-2020-11085.html https://www.suse.com/security/cve/CVE-2020-11086.html https://www.suse.com/security/cve/CVE-2020-11087.html https://www.suse.com/security/cve/CVE-2020-11088.html https://www.suse.com/security/cve/CVE-2020-11089.html https://www.suse.com/security/cve/CVE-2020-11095.html https://www.suse.com/security/cve/CVE-2020-11096.html https://www.suse.com/security/cve/CVE-2020-11097.html https://www.suse.com/security/cve/CVE-2020-11098.html https://www.suse.com/security/cve/CVE-2020-11099.html https://www.suse.com/security/cve/CVE-2020-11521.html https://www.suse.com/security/cve/CVE-2020-11522.html https://www.suse.com/security/cve/CVE-2020-11523.html https://www.suse.com/security/cve/CVE-2020-11524.html https://www.suse.com/security/cve/CVE-2020-11525.html https://www.suse.com/security/cve/CVE-2020-11526.html https://www.suse.com/security/cve/CVE-2020-13396.html https://www.suse.com/security/cve/CVE-2020-13397.html https://www.suse.com/security/cve/CVE-2020-13398.html https://www.suse.com/security/cve/CVE-2020-4030.html https://www.suse.com/security/cve/CVE-2020-4031.html https://www.suse.com/security/cve/CVE-2020-4032.html https://www.suse.com/security/cve/CVE-2020-4033.html https://bugzilla.suse.com/1169679 https://bugzilla.suse.com/1169748 https://bugzilla.suse.com/1171441 https://bugzilla.suse.com/1171443 https://bugzilla.suse.com/1171444 https://bugzilla.suse.com/1171445 https://bugzilla.suse.com/1171446 https://bugzilla.suse.com/1171447 https://bugzilla.suse.com/1171474 https://bugzilla.suse.com/1173247 https://bugzilla.suse.com/1173605 https://bugzilla.suse.com/1174200

1 0

openSUSE-RU-2020:1079-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1079-1 Rating: moderate References: #1169763 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perf fixes the following issues: - Add support for new IBM S390 z15 deflate counters (bsc#1169763) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1079=1 Package List: - openSUSE Leap 15.2 (x86_64): perf-5.3.18-lp152.21.3.1 perf-debuginfo-5.3.18-lp152.21.3.1 perf-debugsource-5.3.18-lp152.21.3.1 References: https://bugzilla.suse.com/1169763

1 0

openSUSE-RU-2020:1083-1: Recommended update for go1.9
by maintenance＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Recommended Update: Recommended update for go1.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1083-1 Rating: low References: #1169832 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.9 fixes the following issues: - Fix for an issue when installing on Raspberry Pi causes illegal instruction due to unproper ARM arch set. (bsc#1169832) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1083=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): go1.9-1.9.7-lp152.4.3.1 go1.9-doc-1.9.7-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): go1.9-race-1.9.7-lp152.4.3.1 References: https://bugzilla.suse.com/1169832

1 0

openSUSE-SU-2020:1089-1: moderate: Security update for perl-YAML-LibYAML
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for perl-YAML-LibYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1089-1 Rating: moderate References: #1173703 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for perl-YAML-LibYAML fixes the following issues: perl-YAML-LibYAML was updated to 0.69: [bsc#1173703] * Security fix: Add $LoadBlessed option to turn on/off loading objects: Default is set to true. Note that, the behavior is unchanged. * Clarify documentation about exported functions * Dump() was modifying original data, adding a PV to numbers * Support standard tags !!str, !!map and !!seq instead of dying. * Support JSON::PP::Boolean and boolean.pm via $YAML::XS::Boolean. * Fix regex roundtrip. Fix loading of many regexes. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1089=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): perl-YAML-LibYAML-0.69-lp151.3.3.1 perl-YAML-LibYAML-debuginfo-0.69-lp151.3.3.1 perl-YAML-LibYAML-debugsource-0.69-lp151.3.3.1 References: https://bugzilla.suse.com/1173703

1 0

openSUSE-SU-2020:1086-1: moderate: Security update for knot
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for knot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1086-1 Rating: moderate References: #1047841 Cross-References: CVE-2017-11104 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for knot fixes the following issues: - CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1086=1 Package List: - openSUSE Leap 15.2 (x86_64): knot-1.6.8-lp152.5.3.1 knot-debuginfo-1.6.8-lp152.5.3.1 knot-debugsource-1.6.8-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2017-11104.html https://bugzilla.suse.com/1047841

1 0

openSUSE-RU-2020:1081-1: Recommended update for go1.10
by maintenance＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Recommended Update: Recommended update for go1.10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1081-1 Rating: low References: #1169832 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.10 fixes the following issues: - Fix for an issue when installing on Raspberry Pi causes illegal instruction due to unproper ARM arch set. (bsc#1169832) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1081=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): go1.10-1.10.8-lp152.5.3.1 go1.10-doc-1.10.8-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): go1.10-race-1.10.8-lp152.5.3.1 References: https://bugzilla.suse.com/1169832

1 0

openSUSE-RU-2020:1082-1: moderate: Recommended update for flatpak
by maintenance＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Recommended Update: Recommended update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1082-1 Rating: moderate References: #1169619 #1170416 #1172316 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for flatpak fixes the following issues: - Fix for missing directories by creating a 'skeleton flatpak' repository using 'flatpak remotes' instead of creating the directory manually. (bsc#1172316, bsc#1169619, bsc#1170416) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1082=1 Package List: - openSUSE Leap 15.2 (x86_64): flatpak-1.6.3-lp152.3.3.1 flatpak-debuginfo-1.6.3-lp152.3.3.1 flatpak-debugsource-1.6.3-lp152.3.3.1 flatpak-devel-1.6.3-lp152.3.3.1 flatpak-zsh-completion-1.6.3-lp152.3.3.1 libflatpak0-1.6.3-lp152.3.3.1 libflatpak0-debuginfo-1.6.3-lp152.3.3.1 system-user-flatpak-1.6.3-lp152.3.3.1 typelib-1_0-Flatpak-1_0-1.6.3-lp152.3.3.1 References: https://bugzilla.suse.com/1169619 https://bugzilla.suse.com/1170416 https://bugzilla.suse.com/1172316

1 0

openSUSE-SU-2020:1087-1: important: Security update for go1.13
by opensuse-security＠opensuse.org 26 Jul '20

26 Jul '20

openSUSE Security Update: Security update for go1.13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1087-1 Rating: important References: #1149259 #1169832 #1172868 #1174153 #1174191 Cross-References: CVE-2020-14039 CVE-2020-15586 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for go1.13 fixes the following issues: - go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages Refs bsc#1149259 go1.13 release tracking * go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent * go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes * go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15 * go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally * go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64 * go#39538 net: TestDialParallel is flaky on windows-amd64-longtest * go#39287 cmd/vet: update for new number formats * go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586 * go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only) * go#38932 runtime: preemption in startTemplateThread may cause infinite hang * go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use - Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1087=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.13-1.13.14-lp151.5.1 go1.13-doc-1.13.14-lp151.5.1 go1.13-race-1.13.14-lp151.5.1 References: https://www.suse.com/security/cve/CVE-2020-14039.html https://www.suse.com/security/cve/CVE-2020-15586.html https://bugzilla.suse.com/1149259 https://bugzilla.suse.com/1169832 https://bugzilla.suse.com/1172868 https://bugzilla.suse.com/1174153 https://bugzilla.suse.com/1174191

1 0