August 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1216-1: moderate: Recommended update for hawk2
by maintenance＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1216-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for hawk2 fixes the following issue: Update to version 2.1.2+git.1594886920.d00b94aa: - Update puma rubygem requirement to version 4.3.5 for disabling TLSv1.0 and TLSv1.1 (jsc#SLE-6965) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1216=1 Package List: - openSUSE Leap 15.1 (x86_64): hawk2-2.1.2+git.1594886920.d00b94aa-lp151.2.12.1 hawk2-debuginfo-2.1.2+git.1594886920.d00b94aa-lp151.2.12.1 hawk2-debugsource-2.1.2+git.1594886920.d00b94aa-lp151.2.12.1 References:

1 0

openSUSE-SU-2020:1214-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1214-1 Rating: important References: #1174497 #1175044 #1175085 Cross-References: CVE-2020-6542 CVE-2020-6543 CVE-2020-6544 CVE-2020-6545 CVE-2020-6546 CVE-2020-6547 CVE-2020-6548 CVE-2020-6549 CVE-2020-6550 CVE-2020-6551 CVE-2020-6552 CVE-2020-6553 CVE-2020-6554 CVE-2020-6555 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 (boo#1175085) * CVE-2020-6542: Use after free in ANGLE * CVE-2020-6543: Use after free in task scheduling * CVE-2020-6544: Use after free in media * CVE-2020-6545: Use after free in audio * CVE-2020-6546: Inappropriate implementation in installer * CVE-2020-6547: Incorrect security UI in media * CVE-2020-6548: Heap buffer overflow in Skia * CVE-2020-6549: Use after free in media * CVE-2020-6550: Use after free in IndexedDB * CVE-2020-6551: Use after free in WebXR * CVE-2020-6552: Use after free in Blink * CVE-2020-6553: Use after free in offline mode * CVE-2020-6554: Use after free in extensions * CVE-2020-6555: Out of bounds read in WebGL * Various fixes from internal audits, fuzzing and other initiatives - Disable wayland everywhere as it breaks headless and middle mouse copy everywhere: boo#1174497 boo#1175044 This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1214=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-84.0.4147.125-bp151.3.100.1 chromium-84.0.4147.125-bp151.3.100.1 References: https://www.suse.com/security/cve/CVE-2020-6542.html https://www.suse.com/security/cve/CVE-2020-6543.html https://www.suse.com/security/cve/CVE-2020-6544.html https://www.suse.com/security/cve/CVE-2020-6545.html https://www.suse.com/security/cve/CVE-2020-6546.html https://www.suse.com/security/cve/CVE-2020-6547.html https://www.suse.com/security/cve/CVE-2020-6548.html https://www.suse.com/security/cve/CVE-2020-6549.html https://www.suse.com/security/cve/CVE-2020-6550.html https://www.suse.com/security/cve/CVE-2020-6551.html https://www.suse.com/security/cve/CVE-2020-6552.html https://www.suse.com/security/cve/CVE-2020-6553.html https://www.suse.com/security/cve/CVE-2020-6554.html https://www.suse.com/security/cve/CVE-2020-6555.html https://bugzilla.suse.com/1174497 https://bugzilla.suse.com/1175044 https://bugzilla.suse.com/1175085

1 0

openSUSE-RU-2020:1213-1: important: Recommended update for rsyslog
by maintenance＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Recommended Update: Recommended update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1213-1 Rating: important References: #1173338 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rsyslog fixes the following issues: - Fix for logrotate to avoid unexpected exit with coredump after logrotate. (bsc#1173338) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1213=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): rsyslog-8.33.1-lp151.6.13.1 rsyslog-debuginfo-8.33.1-lp151.6.13.1 rsyslog-debugsource-8.33.1-lp151.6.13.1 rsyslog-diag-tools-8.33.1-lp151.6.13.1 rsyslog-diag-tools-debuginfo-8.33.1-lp151.6.13.1 rsyslog-doc-8.33.1-lp151.6.13.1 rsyslog-module-dbi-8.33.1-lp151.6.13.1 rsyslog-module-dbi-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-elasticsearch-8.33.1-lp151.6.13.1 rsyslog-module-elasticsearch-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-gcrypt-8.33.1-lp151.6.13.1 rsyslog-module-gcrypt-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-gssapi-8.33.1-lp151.6.13.1 rsyslog-module-gssapi-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-gtls-8.33.1-lp151.6.13.1 rsyslog-module-gtls-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-mmnormalize-8.33.1-lp151.6.13.1 rsyslog-module-mmnormalize-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-mysql-8.33.1-lp151.6.13.1 rsyslog-module-mysql-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-omamqp1-8.33.1-lp151.6.13.1 rsyslog-module-omamqp1-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-omhttpfs-8.33.1-lp151.6.13.1 rsyslog-module-omhttpfs-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-omtcl-8.33.1-lp151.6.13.1 rsyslog-module-omtcl-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-pgsql-8.33.1-lp151.6.13.1 rsyslog-module-pgsql-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-relp-8.33.1-lp151.6.13.1 rsyslog-module-relp-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-snmp-8.33.1-lp151.6.13.1 rsyslog-module-snmp-debuginfo-8.33.1-lp151.6.13.1 rsyslog-module-udpspoof-8.33.1-lp151.6.13.1 rsyslog-module-udpspoof-debuginfo-8.33.1-lp151.6.13.1 References: https://bugzilla.suse.com/1173338

1 0

openSUSE-RU-2020:1212-1: moderate: Recommended update for osc
by maintenance＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Recommended Update: Recommended update for osc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1212-1 Rating: moderate References: #1173926 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osc fixes the following issues: - Fix for performance issues by assuming utf-8 or latin-1 as default, and speed up decoding. (bsc#1173926) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1212=1 Package List: - openSUSE Leap 15.1 (noarch): osc-0.170.0-lp151.2.18.1 References: https://bugzilla.suse.com/1173926

1 0

openSUSE-RU-2020:1211-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 15 Aug '20

15 Aug '20

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1211-1 Rating: moderate References: #1172111 #1173561 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for nvme-cli fixes the following issues: - Fix for an issue when nvme 'show-regs' fails with 'seahawk2' on 'zz' server. (bsc#1173561) - Fix for nvme reconnect delay option. (bsc#1172111) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1211=1 Package List: - openSUSE Leap 15.1 (x86_64): nvme-cli-1.8.1-lp151.5.12.1 nvme-cli-debuginfo-1.8.1-lp151.5.12.1 nvme-cli-debugsource-1.8.1-lp151.5.12.1 nvme-cli-regress-script-1.8.1-lp151.5.12.1 References: https://bugzilla.suse.com/1172111 https://bugzilla.suse.com/1173561

1 0

openSUSE-SU-2020:1210-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1210-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1210=1 Package List: - openSUSE Leap 15.1 (x86_64): hylafax+-7.0.3-lp151.4.6.1 hylafax+-client-7.0.3-lp151.4.6.1 hylafax+-client-debuginfo-7.0.3-lp151.4.6.1 hylafax+-debuginfo-7.0.3-lp151.4.6.1 hylafax+-debugsource-7.0.3-lp151.4.6.1 libfaxutil7_0_3-7.0.3-lp151.4.6.1 libfaxutil7_0_3-debuginfo-7.0.3-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521

1 0

openSUSE-SU-2020:1209-1: moderate: Security update for hylafax+
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1209-1 Rating: moderate References: #1173519 #1173521 Cross-References: CVE-2020-15396 CVE-2020-15397 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for hylafax+ fixes the following issues: Hylafax was updated to upstream version 7.0.3. Security issues fixed: - CVE-2020-15396: Secure temporary directory creation for faxsetup, faxaddmodem, and probemodem (boo#1173521). - CVE-2020-15397: Sourcing of files into binaries from user writeable directories (boo#1173519). Non-security issues fixed: * add UseSSLFax feature in sendfax, sendfax.conf, hyla.conf, and JobControl (31 Jul 2020) * be more resilient in listening for the Phase C carrier (30 Jul 2020) * make sure to return to command mode if HDLC receive times out (29 Jul 2020) * make faxmail ignore boundaries on parts other than multiparts (29 Jul 2020) * don't attempt to write zero bytes of data to a TIFF (29 Jul 2020) * don't ever respond to CRP with CRP (28 Jul 2020) * reset frame counter when a sender retransmits PPS for a previously confirmed ECM block (26 Jul 2020) * scrutinize PPM before concluding that the sender missed our MCF (23 Jul 2020) * fix modem recovery after SSL Fax failure (22, 26 Jul 2020) * ignore echo of PPR, RTN, CRP (10, 13, 21 Jul 2020) * attempt to handle NSF/CSI/DIS in Class 1 sending Phase D (6 Jul 2020) * run scripts directly rather than invoking them via a shell for security hardening (3-5 Jul 2020) * add senderFumblesECM feature (3 Jul 2020) * add support for PIN/PIP/PRI-Q/PPS-PRI-Q signals, add senderConfusesPIN feature, and utilize PIN for rare conditions where it may be helpful (2, 6, 13-14 Jul 2020) * add senderConfusesRTN feature (25-26 Jun 2020) * add MissedPageHandling feature (24 Jun 2020) * use and handle CFR in Phase D to retransmit Phase C (16, 23 Jun 2020) * cope with hearing echo of RR, CTC during Class 1 sending (15-17 Jun 2020) * fix listening for retransmission of MPS/EOP/EOM if it was received corrupt on the first attempt (15 Jun 2020) * don't use CRP when receiving PPS/PPM as some senders think we are sending MCF (12 Jun 2020) * add BR_SSLFAX to show SSL Fax in notify and faxinfo output (1 Jun 2020) * have faxinfo put units on non-standard page dimensions (28 May 2020) * improve error messages for JobHost connection errors (22 May 2020) * fix perpetual blocking of jobs when a job preparation fails, attempt to fix similar blocking problems for bad jobs in batches, and add "unblock" faxconfig feature (21 May 2020) * ignore TCF if we're receiving an SSL Fax (31 Jan 2020) * fixes for build on FreeBSD 12.1 (31 Jan - 3 Feb 2020) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1209=1 Package List: - openSUSE Leap 15.2 (x86_64): hylafax+-7.0.3-lp152.3.6.1 hylafax+-client-7.0.3-lp152.3.6.1 hylafax+-client-debuginfo-7.0.3-lp152.3.6.1 hylafax+-debuginfo-7.0.3-lp152.3.6.1 hylafax+-debugsource-7.0.3-lp152.3.6.1 libfaxutil7_0_3-7.0.3-lp152.3.6.1 libfaxutil7_0_3-debuginfo-7.0.3-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-15396.html https://www.suse.com/security/cve/CVE-2020-15397.html https://bugzilla.suse.com/1173519 https://bugzilla.suse.com/1173521

1 0

openSUSE-SU-2020:1199-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1199-1 Rating: moderate References: #1169063 #1171899 #1173606 Cross-References: CVE-2020-11647 CVE-2020-13164 CVE-2020-15466 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Wireshark to 3.2.5: * CVE-2020-15466: GVCP dissector infinite loop (bsc#1173606) * CVE-2020-13164: NFS dissector crash (bsc#1171899) * CVE-2020-11647: The BACapp dissector could crash (bsc#1169063) - Further features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-3.2.5.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1199=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark13-3.2.5-lp152.2.3.1 libwireshark13-debuginfo-3.2.5-lp152.2.3.1 libwiretap10-3.2.5-lp152.2.3.1 libwiretap10-debuginfo-3.2.5-lp152.2.3.1 libwsutil11-3.2.5-lp152.2.3.1 libwsutil11-debuginfo-3.2.5-lp152.2.3.1 wireshark-3.2.5-lp152.2.3.1 wireshark-debuginfo-3.2.5-lp152.2.3.1 wireshark-debugsource-3.2.5-lp152.2.3.1 wireshark-devel-3.2.5-lp152.2.3.1 wireshark-ui-qt-3.2.5-lp152.2.3.1 wireshark-ui-qt-debuginfo-3.2.5-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-11647.html https://www.suse.com/security/cve/CVE-2020-13164.html https://www.suse.com/security/cve/CVE-2020-15466.html https://bugzilla.suse.com/1169063 https://bugzilla.suse.com/1171899 https://bugzilla.suse.com/1173606

1 0

openSUSE-SU-2020:1200-1: important: Security update for xrdp
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for xrdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1200-1 Rating: important References: #1173580 Cross-References: CVE-2020-4044 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xrdp fixes the following issues: - Update to version 0.9.13.1 + This is a security fix release that includes fixes for the following local buffer overflow vulnerability (bsc#1173580): CVE-2020-4044 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1200=1 Package List: - openSUSE Leap 15.2 (x86_64): libpainter0-0.9.13.1-lp152.3.3.1 libpainter0-debuginfo-0.9.13.1-lp152.3.3.1 librfxencode0-0.9.13.1-lp152.3.3.1 librfxencode0-debuginfo-0.9.13.1-lp152.3.3.1 xrdp-0.9.13.1-lp152.3.3.1 xrdp-debuginfo-0.9.13.1-lp152.3.3.1 xrdp-debugsource-0.9.13.1-lp152.3.3.1 xrdp-devel-0.9.13.1-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-4044.html https://bugzilla.suse.com/1173580

1 0

openSUSE-SU-2020:1208-1: moderate: Security update for firejail
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for firejail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1208-1 Rating: moderate References: #1174986 Cross-References: CVE-2020-17367 CVE-2020-17368 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for firejail fixes the following issues: - CVE-2020-17367: The end-of-options separator -- was not handled correctly (boo#1174986). - CVE-2020-17368: An attacker who has control over the command line arguments could run arbitrary commands (boo#1174986). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1208=1 Package List: - openSUSE Leap 15.2 (x86_64): firejail-0.9.62-lp152.3.3.1 firejail-debuginfo-0.9.62-lp152.3.3.1 firejail-debugsource-0.9.62-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-17367.html https://www.suse.com/security/cve/CVE-2020-17368.html https://bugzilla.suse.com/1174986

1 0