August 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1207-1: moderate: Security update for balsa
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for balsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1207-1 Rating: moderate References: #1174711 Cross-References: CVE-2020-16118 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for balsa fixes the following issues: - CVE-2020-16118: Fixed a NULL pointer dereference (boo#1174711). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1207=1 Package List: - openSUSE Leap 15.1 (noarch): balsa-lang-2.5.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): balsa-2.5.5-lp151.3.3.1 balsa-debuginfo-2.5.5-lp151.3.3.1 balsa-debugsource-2.5.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-16118.html https://bugzilla.suse.com/1174711

1 0

openSUSE-RU-2020:1202-1: moderate: Recommended update for libstorage-ng
by maintenance＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Recommended Update: Recommended update for libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1202-1 Rating: moderate References: #1172866 #1173610 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libstorage-ng fixes the following issues: - merge gh#openSUSE/libstorage-ng#754 - Fix for an issue when NVME client is not installing if the root partition is an NVME device. (bsc#1172866) - Delegate to initial guided proposal when no partitions are defined in the profile. (bsc#1173610) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1202=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libstorage-ng-debuginfo-4.2.76-lp152.2.3.1 libstorage-ng-debugsource-4.2.76-lp152.2.3.1 libstorage-ng-devel-4.2.76-lp152.2.3.1 libstorage-ng-integration-tests-4.2.76-lp152.2.3.1 libstorage-ng-python3-4.2.76-lp152.2.3.1 libstorage-ng-python3-debuginfo-4.2.76-lp152.2.3.1 libstorage-ng-ruby-4.2.76-lp152.2.3.1 libstorage-ng-ruby-debuginfo-4.2.76-lp152.2.3.1 libstorage-ng-utils-4.2.76-lp152.2.3.1 libstorage-ng-utils-debuginfo-4.2.76-lp152.2.3.1 libstorage-ng1-4.2.76-lp152.2.3.1 libstorage-ng1-debuginfo-4.2.76-lp152.2.3.1 yast2-storage-ng-4.2.111-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): libstorage-ng-lang-4.2.76-lp152.2.3.1 References: https://bugzilla.suse.com/1172866 https://bugzilla.suse.com/1173610

1 0

openSUSE-SU-2020:1206-1: important: Security update for chromium
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1206-1 Rating: important References: #1174497 #1175044 #1175085 Cross-References: CVE-2020-6542 CVE-2020-6543 CVE-2020-6544 CVE-2020-6545 CVE-2020-6546 CVE-2020-6547 CVE-2020-6548 CVE-2020-6549 CVE-2020-6550 CVE-2020-6551 CVE-2020-6552 CVE-2020-6553 CVE-2020-6554 CVE-2020-6555 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 (boo#1175085) * CVE-2020-6542: Use after free in ANGLE * CVE-2020-6543: Use after free in task scheduling * CVE-2020-6544: Use after free in media * CVE-2020-6545: Use after free in audio * CVE-2020-6546: Inappropriate implementation in installer * CVE-2020-6547: Incorrect security UI in media * CVE-2020-6548: Heap buffer overflow in Skia * CVE-2020-6549: Use after free in media * CVE-2020-6550: Use after free in IndexedDB * CVE-2020-6551: Use after free in WebXR * CVE-2020-6552: Use after free in Blink * CVE-2020-6553: Use after free in offline mode * CVE-2020-6554: Use after free in extensions * CVE-2020-6555: Out of bounds read in WebGL * Various fixes from internal audits, fuzzing and other initiatives - Disable wayland everywhere as it breaks headless and middle mouse copy everywhere: boo#1174497 boo#1175044 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1206=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1206=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-84.0.4147.125-lp152.2.12.2 chromedriver-debuginfo-84.0.4147.125-lp152.2.12.2 chromium-84.0.4147.125-lp152.2.12.2 chromium-debuginfo-84.0.4147.125-lp152.2.12.2 chromium-debugsource-84.0.4147.125-lp152.2.12.2 - openSUSE Leap 15.1 (x86_64): chromedriver-84.0.4147.125-lp151.2.115.1 chromedriver-debuginfo-84.0.4147.125-lp151.2.115.1 chromium-84.0.4147.125-lp151.2.115.1 chromium-debuginfo-84.0.4147.125-lp151.2.115.1 chromium-debugsource-84.0.4147.125-lp151.2.115.1 References: https://www.suse.com/security/cve/CVE-2020-6542.html https://www.suse.com/security/cve/CVE-2020-6543.html https://www.suse.com/security/cve/CVE-2020-6544.html https://www.suse.com/security/cve/CVE-2020-6545.html https://www.suse.com/security/cve/CVE-2020-6546.html https://www.suse.com/security/cve/CVE-2020-6547.html https://www.suse.com/security/cve/CVE-2020-6548.html https://www.suse.com/security/cve/CVE-2020-6549.html https://www.suse.com/security/cve/CVE-2020-6550.html https://www.suse.com/security/cve/CVE-2020-6551.html https://www.suse.com/security/cve/CVE-2020-6552.html https://www.suse.com/security/cve/CVE-2020-6553.html https://www.suse.com/security/cve/CVE-2020-6554.html https://www.suse.com/security/cve/CVE-2020-6555.html https://bugzilla.suse.com/1174497 https://bugzilla.suse.com/1175044 https://bugzilla.suse.com/1175085

1 0

openSUSE-RU-2020:1203-1: important: Recommended update for python-azure-agent
by maintenance＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Recommended Update: Recommended update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1203-1 Rating: important References: #1173866 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-azure-agent fixes the following issues: - Properly set the DHCP configuration to push the hostname to the DHCP server. (bsc#1173866) - Do not bring the interface down to push the hostname, just use 'ifup'. (bsc#1173866) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1203=1 Package List: - openSUSE Leap 15.2 (noarch): python-azure-agent-2.2.45-lp152.3.3.1 python-azure-agent-test-2.2.45-lp152.3.3.1 References: https://bugzilla.suse.com/1173866

1 0

openSUSE-RU-2020:1201-1: moderate: Recommended update for gnome-control-center
by maintenance＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Recommended Update: Recommended update for gnome-control-center ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1201-1 Rating: moderate References: #1160173 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-control-center fixes the following issues: - Fix the resolution list as it shows only the currently used resolution. (bsc#1160173 glgo#GNOME/Settings#903) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1201=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-control-center-lang-3.34.6-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): gnome-control-center-3.34.6-lp152.2.3.1 gnome-control-center-color-3.34.6-lp152.2.3.1 gnome-control-center-debuginfo-3.34.6-lp152.2.3.1 gnome-control-center-debugsource-3.34.6-lp152.2.3.1 gnome-control-center-devel-3.34.6-lp152.2.3.1 gnome-control-center-goa-3.34.6-lp152.2.3.1 gnome-control-center-user-faces-3.34.6-lp152.2.3.1 References: https://bugzilla.suse.com/1160173

1 0

openSUSE-SU-2020:1204-1: moderate: Security update for perl-XML-Twig
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for perl-XML-Twig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1204-1 Rating: moderate References: #1008644 Cross-References: CVE-2016-9180 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-XML-Twig fixes the following issues: - Security fix [bsc#1008644, CVE-2016-9180] * Setting expand_external_ents to 0 or -1 currently doesn't work as expected; To completely turn off expanding external entities use no_xxe. * Update documentation for XML::Twig to mention problems with expand_external_ents and add information about new no_xxe argument This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1204=1 Package List: - openSUSE Leap 15.2 (noarch): perl-XML-Twig-3.52-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-9180.html https://bugzilla.suse.com/1008644

1 0

openSUSE-SU-2020:1205-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1205-1 Rating: important References: #1174538 Cross-References: CVE-2020-15652 CVE-2020-15659 CVE-2020-6463 CVE-2020-6514 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Updated to Mozilla Thunderbird 68.11: * Fixed various security issues (MFSA-2020-35, bsc#1174538). * Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538). * Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538). * Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538). * Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538). * Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1205=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-68.11.0-lp152.2.7.1 MozillaThunderbird-debuginfo-68.11.0-lp152.2.7.1 MozillaThunderbird-debugsource-68.11.0-lp152.2.7.1 MozillaThunderbird-translations-common-68.11.0-lp152.2.7.1 MozillaThunderbird-translations-other-68.11.0-lp152.2.7.1 References: https://www.suse.com/security/cve/CVE-2020-15652.html https://www.suse.com/security/cve/CVE-2020-15659.html https://www.suse.com/security/cve/CVE-2020-6463.html https://www.suse.com/security/cve/CVE-2020-6514.html https://bugzilla.suse.com/1174538

1 0

openSUSE-SU-2020:1198-1: important: Security update for libX11
by opensuse-security＠opensuse.org 14 Aug '20

14 Aug '20

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1198-1 Rating: important References: #1174628 Cross-References: CVE-2020-14344 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - Fixed XIM client heap overflows (CVE-2020-14344, bsc#1174628). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1198=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libX11-6-1.6.5-lp151.4.6.1 libX11-6-debuginfo-1.6.5-lp151.4.6.1 libX11-debugsource-1.6.5-lp151.4.6.1 libX11-devel-1.6.5-lp151.4.6.1 libX11-xcb1-1.6.5-lp151.4.6.1 libX11-xcb1-debuginfo-1.6.5-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libX11-6-32bit-1.6.5-lp151.4.6.1 libX11-6-32bit-debuginfo-1.6.5-lp151.4.6.1 libX11-devel-32bit-1.6.5-lp151.4.6.1 libX11-xcb1-32bit-1.6.5-lp151.4.6.1 libX11-xcb1-32bit-debuginfo-1.6.5-lp151.4.6.1 - openSUSE Leap 15.1 (noarch): libX11-data-1.6.5-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-14344.html https://bugzilla.suse.com/1174628

1 0

openSUSE-RU-2020:1197-1: moderate: Recommended update for open-lldp
by maintenance＠opensuse.org 13 Aug '20

13 Aug '20

openSUSE Recommended Update: Recommended update for open-lldp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1197-1 Rating: moderate References: #1153520 #1170745 #1171284 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for open-lldp fixes the following issues: - Fix for a segementation fault, when agents change their MAC address (bsc#1171284) - lldapd will now transmit the permanent MAC address (the MAC address of the underlying physical device) as port id, thus allowing the switch or any management application to differentiate between those ports. (bsc#1153520) - Fix for a segmentation fault, when lldapd registers an interface and it gets shortly removed afterwards. (bsc#1170745) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1197=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): liblldp_clif1-1.0.1+63.f977e67-lp151.2.3.1 liblldp_clif1-debuginfo-1.0.1+63.f977e67-lp151.2.3.1 open-lldp-1.0.1+63.f977e67-lp151.2.3.1 open-lldp-debuginfo-1.0.1+63.f977e67-lp151.2.3.1 open-lldp-debugsource-1.0.1+63.f977e67-lp151.2.3.1 open-lldp-devel-1.0.1+63.f977e67-lp151.2.3.1 References: https://bugzilla.suse.com/1153520 https://bugzilla.suse.com/1170745 https://bugzilla.suse.com/1171284

1 0

openSUSE-SU-2020:1196-1: important: Security update for xen
by opensuse-security＠opensuse.org 13 Aug '20

13 Aug '20

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1196-1 Rating: important References: #1172356 #1174543 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for xen fixes the following issues: - bsc#1174543 - secure boot related fixes - bsc#1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1196=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): xen-debugsource-4.12.3_06-lp151.2.24.1 xen-devel-4.12.3_06-lp151.2.24.1 xen-libs-4.12.3_06-lp151.2.24.1 xen-libs-debuginfo-4.12.3_06-lp151.2.24.1 xen-tools-domU-4.12.3_06-lp151.2.24.1 xen-tools-domU-debuginfo-4.12.3_06-lp151.2.24.1 - openSUSE Leap 15.1 (x86_64): xen-4.12.3_06-lp151.2.24.1 xen-doc-html-4.12.3_06-lp151.2.24.1 xen-libs-32bit-4.12.3_06-lp151.2.24.1 xen-libs-32bit-debuginfo-4.12.3_06-lp151.2.24.1 xen-tools-4.12.3_06-lp151.2.24.1 xen-tools-debuginfo-4.12.3_06-lp151.2.24.1 References: https://bugzilla.suse.com/1172356 https://bugzilla.suse.com/1174543

1 0