July 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1050-1: moderate: Security update for cni-plugins
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for cni-plugins ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1050-1 Rating: moderate References: #1172410 Cross-References: CVE-2020-10749 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cni-plugins fixes the following issues: cni-plugins updated to version 0.8.6 - CVE-2020-10749: Fixed a potential Man-in-the-Middle attacks in IPv4 clusters by spoofing IPv6 router advertisements (bsc#1172410). Release notes: https://github.com/containernetworking/plugins/releases/tag/v0.8.6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1050=1 Package List: - openSUSE Leap 15.2 (x86_64): cni-plugins-0.8.6-lp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-10749.html https://bugzilla.suse.com/1172410

1 0

openSUSE-SU-2020:1051-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1051-1 Rating: important References: #1173389 Cross-References: CVE-2020-11996 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tomcat fixes the following issues: Tomcat was updated to 9.0.36 See changelog at - CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1051=1 Package List: - openSUSE Leap 15.1 (noarch): tomcat-9.0.36-lp151.3.24.1 tomcat-admin-webapps-9.0.36-lp151.3.24.1 tomcat-docs-webapp-9.0.36-lp151.3.24.1 tomcat-el-3_0-api-9.0.36-lp151.3.24.1 tomcat-embed-9.0.36-lp151.3.24.1 tomcat-javadoc-9.0.36-lp151.3.24.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.24.1 tomcat-jsvc-9.0.36-lp151.3.24.1 tomcat-lib-9.0.36-lp151.3.24.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.24.1 tomcat-webapps-9.0.36-lp151.3.24.1 References: https://www.suse.com/security/cve/CVE-2020-11996.html https://bugzilla.suse.com/1173389

1 0

openSUSE-SU-2020:1049-1: moderate: Security update for cni-plugins
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for cni-plugins ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1049-1 Rating: moderate References: #1172410 Cross-References: CVE-2020-10749 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cni-plugins fixes the following issues: cni-plugins updated to version 0.8.6 - CVE-2020-10749: Fixed a potential Man-in-the-Middle attacks in IPv4 clusters by spoofing IPv6 router advertisements (bsc#1172410). Release notes: https://github.com/containernetworking/plugins/releases/tag/v0.8.6 This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1049=1 Package List: - openSUSE Leap 15.1 (x86_64): cni-plugins-0.8.6-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-10749.html https://bugzilla.suse.com/1172410

1 0

openSUSE-RU-2020:1047-1: moderate: Recommended update for wine-mono
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for wine-mono ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1047-1 Rating: moderate References: #1172622 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wine-mono fixes the following issues: This update downgrades wine-mono to work with 15.2 wine version. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2020-1047=1 Package List: - openSUSE Leap 15.2:NonFree (noarch): wine-mono-4.9.4-lp152.3.1 References: https://bugzilla.suse.com/1172622

1 0

openSUSE-RU-2020:1046-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1046-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.6.13: * Bugfixes: + Fixed cut-off text in about dialog. + Fixed increasing play count when stop after track is enabled. + Fixed showing/hiding playing widget when playback is started while window is hidden. + Fixed "Show in file browser" to also work on local songs that are not in the collection. + Fixed "Show in file browser" to work with PCManFM file manager. + Fixed audio analyzer to work with S24LE and F32LE audio formats. + Fixed playlist background image not loading. + Fixed a memory leak when switching between playlists. + Removed use of HTML in systemtray tooltip on KDE, since KDE no longer renders HTML in the systemtray. * Enhancements: + Replaced use of C style casts. + Adapted use of C++11 override. + Improved CMake build files. + Added new on startup options to show maximized or minimized. + Builtin TagLib code is updated and improved. + Made most icon sizes configurable in the settings, and increased default sizes for icons. + Improved fancy tabbar to use font sizes from the theme instead of fixed sizes. + Moving the currently playing song to the top when the playlist is manually shuffled. + Added "a taste of Strawbs" background image. + Fixed unit test for testing playlist model. + Added new unit tests for tagreader. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1046=1 Package List: - openSUSE Leap 15.2 (x86_64): strawberry-0.6.13-lp152.2.6.1 strawberry-debuginfo-0.6.13-lp152.2.6.1 strawberry-debugsource-0.6.13-lp152.2.6.1 References:

1 0

openSUSE-RU-2020:1045-1: moderate: Recommended update for HepMC2
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for HepMC2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1045-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for HepMC2 fixes the following issues: HepMC2 was updated to version 2.06.11: * HepMC/HepMCDefs.h: Add a HEPMC_HAS_ORDERED_WEIGHTS #define. * HepMC/WeightContainer.h: Add weights() and weight_names() public methods. * src/WeightContainer.cc: Fix print() to use canonical weight ordering. * src/GenEventStreamIO.cc: Fix the I/O streaming to preserve the weight ordering. * Fixed the tests. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1045=1 Package List: - openSUSE Leap 15.2 (x86_64): HepMC2-devel-2.06.11-lp152.4.3.1 libHepMC4-2.06.11-lp152.4.3.1 libHepMC4-debuginfo-2.06.11-lp152.4.3.1 References:

1 0

openSUSE-SU-2020:1043-1: moderate: Security update for xmlgraphics-batik
by opensuse-security＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Security Update: Security update for xmlgraphics-batik ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1043-1 Rating: moderate References: #1172961 Cross-References: CVE-2019-17566 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmlgraphics-batik fixes the following issues: - CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961). This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1043=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): xmlgraphics-batik-1.9-bp151.2.3.1 xmlgraphics-batik-demo-1.9-bp151.2.3.1 xmlgraphics-batik-rasterizer-1.9-bp151.2.3.1 xmlgraphics-batik-slideshow-1.9-bp151.2.3.1 xmlgraphics-batik-squiggle-1.9-bp151.2.3.1 xmlgraphics-batik-svgpp-1.9-bp151.2.3.1 xmlgraphics-batik-ttf2svg-1.9-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-17566.html https://bugzilla.suse.com/1172961

1 0

openSUSE-RU-2020:1044-1: moderate: Recommended update for HepMC
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for HepMC ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1044-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for HepMC fixes the following issues: HepMC was updated to version 3.2.2: * Fixed treatment of the weights in case of different number of weights and weight names. * Fixed WriterAsciiHepMC2 option for separate flows. * Improved treatment of python installation. * Split the sources of python bindings into smaller files to optimize compilation. * Improved cmake configuration for special cases, e.g. old cmake, no ROOT, some compilers, etc. Added more error handling. * Fixed compilation of the search module with Clang. * Added an example for search module. * Fixed the HepMC2 output for events without weights. * Fixed the signal vertex ID for HepMC2 output. * Added an interface for HepMC2 (in-memory-conversion). * Added functions to search module: search for relatives (particle or vertex)->(particle or vertex) in different combinations. * The previous point bumps .so version of the libHepMC3search to 4. * Improved the configuration of Pythia8 for tests (minimal version requirement). * Fixed compatibility of ROOT trees written with HePMC3.0 and removed the typedefs in the dictionaries. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1044=1 Package List: - openSUSE Leap 15.2 (x86_64): HepMC-debuginfo-3.2.2-lp152.2.3.1 HepMC-debugsource-3.2.2-lp152.2.3.1 HepMC-devel-3.2.2-lp152.2.3.1 HepMC-doc-3.2.2-lp152.2.3.1 libHepMC3-1-3.2.2-lp152.2.3.1 libHepMC3-1-debuginfo-3.2.2-lp152.2.3.1 python3-HepMC-3.2.2-lp152.2.3.1 python3-HepMC-debuginfo-3.2.2-lp152.2.3.1 References:

1 0

openSUSE-RU-2020:1038-1: moderate: Recommended update for open-vm-tools
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1038-1 Rating: moderate References: #1171003 #1171764 #1171765 #1172693 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for open-vm-tools fixes the following issues: - Update 11.1.0 (build 16036546) (bsc#1171764, jsc#ECO-2164) This version provides a new 'Service Discovery' plugin. (bsc#1171765) The plugin connects with the vRealize Operations Manager product. For more information and details on configuring this plugin, refer to Configuring Service Discovery. In this release, a new tools.conf switch is added to enable and disable the guest customization in the guest virtual machine. By default, the guest customization is enabled. For more details, refer KB 78903. - vm-support is now automatically placed in the /usr/bin directory. - Added version number to Requires: libxmlsec1-openssl1 to help with vgauth version checking. - Provide a better PAM configuration and authentication. (bsc#1171003, bsc#1172693) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1038=1 Package List: - openSUSE Leap 15.1 (x86_64): libvmtools-devel-11.1.0-lp151.2.15.1 libvmtools0-11.1.0-lp151.2.15.1 libvmtools0-debuginfo-11.1.0-lp151.2.15.1 open-vm-tools-11.1.0-lp151.2.15.1 open-vm-tools-debuginfo-11.1.0-lp151.2.15.1 open-vm-tools-debugsource-11.1.0-lp151.2.15.1 open-vm-tools-desktop-11.1.0-lp151.2.15.1 open-vm-tools-desktop-debuginfo-11.1.0-lp151.2.15.1 open-vm-tools-sdmp-11.1.0-lp151.2.15.1 open-vm-tools-sdmp-debuginfo-11.1.0-lp151.2.15.1 References: https://bugzilla.suse.com/1171003 https://bugzilla.suse.com/1171764 https://bugzilla.suse.com/1171765 https://bugzilla.suse.com/1172693

1 0

openSUSE-RU-2020:1041-1: Recommended update for python-Sphinx
by maintenance＠opensuse.org 23 Jul '20

23 Jul '20

openSUSE Recommended Update: Recommended update for python-Sphinx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1041-1 Rating: low References: #1172721 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-Sphinx fixes the following issues: - Disable test 'test_correct_year' as the range is no longer matched. (bsc#1172721) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1041=1 Package List: - openSUSE Leap 15.1 (noarch): python-Sphinx-doc-html-1.7.6-lp151.2.6.1 python-Sphinx-doc-man-common-1.7.6-lp151.2.6.1 python2-Sphinx-1.7.6-lp151.2.6.1 python2-Sphinx-doc-1.7.6-lp151.2.6.1 python2-Sphinx-doc-man-1.7.6-lp151.2.6.1 python2-Sphinx-latex-1.7.6-lp151.2.6.1 python3-Sphinx-1.7.6-lp151.2.6.1 python3-Sphinx-doc-1.7.6-lp151.2.6.1 python3-Sphinx-doc-man-1.7.6-lp151.2.6.1 python3-Sphinx-latex-1.7.6-lp151.2.6.1 References: https://bugzilla.suse.com/1172721

1 0