September 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1583-1: moderate: Recommended update for budgie-screensaver
by maintenance＠opensuse.org 30 Sep '20

30 Sep '20

openSUSE Recommended Update: Recommended update for budgie-screensaver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1583-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for budgie-screensaver fixes the following issues: This update adds budgie-screensaver to the 15-SP2 packagehub. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1583=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): budgie-screensaver-20190923-bp152.2.1 - openSUSE Backports SLE-15-SP2 (noarch): budgie-screensaver-lang-20190923-bp152.2.1 References:

1 0

openSUSE-RU-2020:1582-1: moderate: Recommended update for vlc
by maintenance＠opensuse.org 30 Sep '20

30 Sep '20

openSUSE Recommended Update: Recommended update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1582-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for vlc fixes the following issues: vlc was updated to 3.0.11.1: * Fixed HLS playlist update mechanism, unable to start in some cases. * Because of broken HLS servers, adaptive no longer considers Content-Type as authoritative. * Fixed handling of WEBM WebVTT subtitles * Workaround invalid ADTS in TS from Makito encoders * Fixed Opus when using avformat demuxer * Fixed inverted explicit start/end positioning * Fix listing of media on certain Panasonic recorders discovered via UPnP Update to version 3.0.11: + Access: rtp descriptor leak on error fix. + Demux: * Fixed regression with some encrypted HLS streams. * Live HLS delay until first update fix. * HLS rendition switch regression fix. * Fix imprecise m4a seek. + Decoder: Fixed missing captions with some capture cards. + Audio filters: soxr resampling fixes. + Audio Output: Fix sound not coming back after a pause with CoreAudio (macOS/iOS). + Misc: Update Youtube script. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1582=1 Package List: - openSUSE Leap 15.2 (x86_64): libvlc5-3.0.11.1-lp152.2.6.1 libvlc5-debuginfo-3.0.11.1-lp152.2.6.1 libvlccore9-3.0.11.1-lp152.2.6.1 libvlccore9-debuginfo-3.0.11.1-lp152.2.6.1 vlc-3.0.11.1-lp152.2.6.1 vlc-codec-gstreamer-3.0.11.1-lp152.2.6.1 vlc-codec-gstreamer-debuginfo-3.0.11.1-lp152.2.6.1 vlc-debuginfo-3.0.11.1-lp152.2.6.1 vlc-debugsource-3.0.11.1-lp152.2.6.1 vlc-devel-3.0.11.1-lp152.2.6.1 vlc-jack-3.0.11.1-lp152.2.6.1 vlc-jack-debuginfo-3.0.11.1-lp152.2.6.1 vlc-noX-3.0.11.1-lp152.2.6.1 vlc-noX-debuginfo-3.0.11.1-lp152.2.6.1 vlc-opencv-3.0.11.1-lp152.2.6.1 vlc-opencv-debuginfo-3.0.11.1-lp152.2.6.1 vlc-qt-3.0.11.1-lp152.2.6.1 vlc-qt-debuginfo-3.0.11.1-lp152.2.6.1 vlc-vdpau-3.0.11.1-lp152.2.6.1 vlc-vdpau-debuginfo-3.0.11.1-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): vlc-lang-3.0.11.1-lp152.2.6.1 References:

1 0

openSUSE-RU-2020:1580-1: moderate: Recommended update for aspell-dictionaries
by maintenance＠opensuse.org 30 Sep '20

30 Sep '20

openSUSE Recommended Update: Recommended update for aspell-dictionaries ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1580-1 Rating: moderate References: #1076219 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for aspell-dictionaries fixes the following issues: aspell-dictionaries was updated rto: - de -> 20161207-7-0 - pt_BR -> 20131030-12-0 - da 1.6.36 - pt_PT 20190329 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1580=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1580=1 Package List: - openSUSE Leap 15.2 (x86_64): aspell-af-0.50.0-lp152.4.3.1 aspell-agal-0.50.0-lp152.4.3.1 aspell-am-0.03.1-lp152.4.3.1 aspell-ar-1.2.0-lp152.4.3.1 aspell-ast-0.01-lp152.4.3.1 aspell-az-0.02-lp152.4.3.1 aspell-be-0.01-lp152.4.3.1 aspell-bg-4.1-lp152.4.3.1 aspell-bn-0.01.1-lp152.4.3.1 aspell-br-0.50.2-lp152.4.3.1 aspell-ca-0.60.1.20090722-lp152.4.3.1 aspell-cs-0.60.0.20040614-lp152.4.3.1 aspell-csb-0.02.0-lp152.4.3.1 aspell-cy-0.50.3-lp152.4.3.1 aspell-da-1.6.20-lp152.4.3.1 aspell-de-20161207.7.0-lp152.4.3.1 aspell-el-0.50.3+0.08-lp152.4.3.1 aspell-eo-2.1.20000225-lp152.4.3.1 aspell-es-1.11.2-lp152.4.3.1 aspell-et-0.1.21-lp152.4.3.1 aspell-fa-0.11.0-lp152.4.3.1 aspell-fi-0.7-lp152.4.3.1 aspell-fo-0.2.16-lp152.4.3.1 aspell-fr-0.50.3-lp152.4.3.1 aspell-fy-0.12-lp152.4.3.1 aspell-ga-4.5.0-lp152.4.3.1 aspell-gd-0.7.1.1.1-lp152.4.3.1 aspell-gl-0.50a-lp152.4.3.1 aspell-grc-0.02.0-lp152.4.3.1 aspell-gu-0.03-lp152.4.3.1 aspell-gv-0.50-lp152.4.3.1 aspell-he-1.0.0-lp152.4.3.1 aspell-hi-0.02-lp152.4.3.1 aspell-hil-0.11-lp152.4.3.1 aspell-hr-0.51.0-lp152.4.3.1 aspell-hsb-0.02.0-lp152.4.3.1 aspell-hu-0.99.4.2-lp152.4.3.1 aspell-hus-0.03.1-lp152.4.3.1 aspell-hy-0.10.0-lp152.4.3.1 aspell-ia-0.50-lp152.4.3.1 aspell-id-1.2-lp152.4.3.1 aspell-is-0.51.10-lp152.4.3.1 aspell-it-2.2_20050523-lp152.4.3.1 aspell-kn-0.01.1-lp152.4.3.1 aspell-ku-0.20.1-lp152.4.3.1 aspell-ky-0.01.0-lp152.4.3.1 aspell-la-20020503-lp152.4.3.1 aspell-lt-1.2.1-lp152.4.3.1 aspell-lv-1.2.1-lp152.4.3.1 aspell-mg-20040807-lp152.4.3.1 aspell-mi-0.50-lp152.4.3.1 aspell-mk-0.50-lp152.4.3.1 aspell-ml-0.03-lp152.4.3.1 aspell-mn-0.06.2-lp152.4.3.1 aspell-mr-0.10-lp152.4.3.1 aspell-ms-0.50-lp152.4.3.1 aspell-mt-0.50-lp152.4.3.1 aspell-nb-0.50.10-lp152.4.3.1 aspell-nds-0.01-lp152.4.3.1 aspell-nl-1.00.7-lp152.4.3.1 aspell-nn-0.50.11-lp152.4.3.1 aspell-ny-0.01-lp152.4.3.1 aspell-or-0.03-lp152.4.3.1 aspell-pa-0.01-lp152.4.3.1 aspell-pl-0.60.2015.04.28-lp152.4.3.1 aspell-pt_BR-20131030.12.0-lp152.4.3.1 aspell-pt_PT-20190329-lp152.4.3.1 aspell-qu-0.02-lp152.4.3.1 aspell-ro-3.3.2-lp152.4.3.1 aspell-ru-0.99.f7.1-lp152.4.3.1 aspell-rw-0.50-lp152.4.3.1 aspell-sc-1.0-lp152.4.3.1 aspell-sk-2.01-lp152.4.3.1 aspell-sl-0.50-lp152.4.3.1 aspell-sr-0.02-lp152.4.3.1 aspell-sv-0.51.0-lp152.4.3.1 aspell-sw-1.0-lp152.4.3.1 aspell-ta-20040424-lp152.4.3.1 aspell-te-0.01.2-lp152.4.3.1 aspell-tet-0.1.1-lp152.4.3.1 aspell-tk-0.01-lp152.4.3.1 aspell-tl-0.02-lp152.4.3.1 aspell-tn-1.0.1-lp152.4.3.1 aspell-tr-0.50-lp152.4.3.1 aspell-uk-1.4.0-lp152.4.3.1 aspell-uz-0.6.0-lp152.4.3.1 aspell-vi-0.01.1-lp152.4.3.1 aspell-wa-0.50-lp152.4.3.1 aspell-yi-0.01.1-lp152.4.3.1 aspell-zu-0.50-lp152.4.3.1 - openSUSE Leap 15.1 (x86_64): aspell-af-0.50.0-lp151.3.3.1 aspell-agal-0.50.0-lp151.3.3.1 aspell-am-0.03.1-lp151.3.3.1 aspell-ar-1.2.0-lp151.3.3.1 aspell-ast-0.01-lp151.3.3.1 aspell-az-0.02-lp151.3.3.1 aspell-be-0.01-lp151.3.3.1 aspell-bg-4.1-lp151.3.3.1 aspell-bn-0.01.1-lp151.3.3.1 aspell-br-0.50.2-lp151.3.3.1 aspell-ca-0.60.1.20090722-lp151.3.3.1 aspell-cs-0.60.0.20040614-lp151.3.3.1 aspell-csb-0.02.0-lp151.3.3.1 aspell-cy-0.50.3-lp151.3.3.1 aspell-da-1.6.20-lp151.3.3.1 aspell-de-20161207.7.0-lp151.3.3.1 aspell-el-0.50.3+0.08-lp151.3.3.1 aspell-eo-2.1.20000225-lp151.3.3.1 aspell-es-1.11.2-lp151.3.3.1 aspell-et-0.1.21-lp151.3.3.1 aspell-fa-0.11.0-lp151.3.3.1 aspell-fi-0.7-lp151.3.3.1 aspell-fo-0.2.16-lp151.3.3.1 aspell-fr-0.50.3-lp151.3.3.1 aspell-fy-0.12-lp151.3.3.1 aspell-ga-4.5.0-lp151.3.3.1 aspell-gd-0.7.1.1.1-lp151.3.3.1 aspell-gl-0.50a-lp151.3.3.1 aspell-grc-0.02.0-lp151.3.3.1 aspell-gu-0.03-lp151.3.3.1 aspell-gv-0.50-lp151.3.3.1 aspell-he-1.0.0-lp151.3.3.1 aspell-hi-0.02-lp151.3.3.1 aspell-hil-0.11-lp151.3.3.1 aspell-hr-0.51.0-lp151.3.3.1 aspell-hsb-0.02.0-lp151.3.3.1 aspell-hu-0.99.4.2-lp151.3.3.1 aspell-hus-0.03.1-lp151.3.3.1 aspell-hy-0.10.0-lp151.3.3.1 aspell-ia-0.50-lp151.3.3.1 aspell-id-1.2-lp151.3.3.1 aspell-is-0.51.10-lp151.3.3.1 aspell-it-2.2_20050523-lp151.3.3.1 aspell-kn-0.01.1-lp151.3.3.1 aspell-ku-0.20.1-lp151.3.3.1 aspell-ky-0.01.0-lp151.3.3.1 aspell-la-20020503-lp151.3.3.1 aspell-lt-1.2.1-lp151.3.3.1 aspell-lv-1.2.1-lp151.3.3.1 aspell-mg-20040807-lp151.3.3.1 aspell-mi-0.50-lp151.3.3.1 aspell-mk-0.50-lp151.3.3.1 aspell-ml-0.03-lp151.3.3.1 aspell-mn-0.06.2-lp151.3.3.1 aspell-mr-0.10-lp151.3.3.1 aspell-ms-0.50-lp151.3.3.1 aspell-mt-0.50-lp151.3.3.1 aspell-nb-0.50.10-lp151.3.3.1 aspell-nds-0.01-lp151.3.3.1 aspell-nl-1.00.7-lp151.3.3.1 aspell-nn-0.50.11-lp151.3.3.1 aspell-ny-0.01-lp151.3.3.1 aspell-or-0.03-lp151.3.3.1 aspell-pa-0.01-lp151.3.3.1 aspell-pl-0.60.2015.04.28-lp151.3.3.1 aspell-pt_BR-20131030.12.0-lp151.3.3.1 aspell-pt_PT-20190329-lp151.3.3.1 aspell-qu-0.02-lp151.3.3.1 aspell-ro-3.3.2-lp151.3.3.1 aspell-ru-0.99.f7.1-lp151.3.3.1 aspell-rw-0.50-lp151.3.3.1 aspell-sc-1.0-lp151.3.3.1 aspell-sk-2.01-lp151.3.3.1 aspell-sl-0.50-lp151.3.3.1 aspell-sr-0.02-lp151.3.3.1 aspell-sv-0.51.0-lp151.3.3.1 aspell-sw-1.0-lp151.3.3.1 aspell-ta-20040424-lp151.3.3.1 aspell-te-0.01.2-lp151.3.3.1 aspell-tet-0.1.1-lp151.3.3.1 aspell-tk-0.01-lp151.3.3.1 aspell-tl-0.02-lp151.3.3.1 aspell-tn-1.0.1-lp151.3.3.1 aspell-tr-0.50-lp151.3.3.1 aspell-uk-1.4.0-lp151.3.3.1 aspell-uz-0.6.0-lp151.3.3.1 aspell-vi-0.01.1-lp151.3.3.1 aspell-wa-0.50-lp151.3.3.1 aspell-yi-0.01.1-lp151.3.3.1 aspell-zu-0.50-lp151.3.3.1 References: https://bugzilla.suse.com/1076219

1 0

openSUSE-RU-2020:1581-1: moderate: Recommended update for budgie-desktop-branding
by maintenance＠opensuse.org 30 Sep '20

30 Sep '20

openSUSE Recommended Update: Recommended update for budgie-desktop-branding ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1581-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for budgie-desktop-branding fixes the following issues: This ships budgie-desktop-branding to Backports 15-SP2. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1581=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): budgie-desktop-branding-SLE-20200915.1-bp152.2.1 References:

1 0

openSUSE-SU-2020:1579-1: moderate: Security update for cifs-utils
by opensuse-security＠opensuse.org 30 Sep '20

30 Sep '20

openSUSE Security Update: Security update for cifs-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1579-1 Rating: moderate References: #1152930 #1174477 Cross-References: CVE-2020-14342 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for cifs-utils fixes the following issues: - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477). - Fixed an invalid free in mount.cifs; (bsc#1152930). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1579=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cifs-utils-6.9-lp151.4.7.1 cifs-utils-debuginfo-6.9-lp151.4.7.1 cifs-utils-debugsource-6.9-lp151.4.7.1 cifs-utils-devel-6.9-lp151.4.7.1 pam_cifscreds-6.9-lp151.4.7.1 pam_cifscreds-debuginfo-6.9-lp151.4.7.1 References: https://www.suse.com/security/cve/CVE-2020-14342.html https://bugzilla.suse.com/1152930 https://bugzilla.suse.com/1174477

1 0

openSUSE-SU-2020:1578-1: moderate: Security update for brotli
by opensuse-security＠opensuse.org 29 Sep '20

29 Sep '20

openSUSE Security Update: Security update for brotli ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1578-1 Rating: moderate References: #1175825 Cross-References: CVE-2020-8927 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for brotli fixes the following issues: brotli was updated to 1.0.9: * CVE-2020-8927: Fix integer overflow when input chunk is longer than 2GiB [boo#1175825] * `brotli -v` now reports raw / compressed size * decoder: minor speed / memory usage improvements * encoder: fix rare access to uninitialized data in ring-buffer Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1578=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): brotli-1.0.9-lp152.2.3.1 brotli-debuginfo-1.0.9-lp152.2.3.1 brotli-debugsource-1.0.9-lp152.2.3.1 libbrotli-devel-1.0.9-lp152.2.3.1 libbrotlicommon1-1.0.9-lp152.2.3.1 libbrotlicommon1-debuginfo-1.0.9-lp152.2.3.1 libbrotlidec1-1.0.9-lp152.2.3.1 libbrotlidec1-debuginfo-1.0.9-lp152.2.3.1 libbrotlienc1-1.0.9-lp152.2.3.1 libbrotlienc1-debuginfo-1.0.9-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libbrotlicommon1-32bit-1.0.9-lp152.2.3.1 libbrotlicommon1-32bit-debuginfo-1.0.9-lp152.2.3.1 libbrotlidec1-32bit-1.0.9-lp152.2.3.1 libbrotlidec1-32bit-debuginfo-1.0.9-lp152.2.3.1 libbrotlienc1-32bit-1.0.9-lp152.2.3.1 libbrotlienc1-32bit-debuginfo-1.0.9-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-8927.html https://bugzilla.suse.com/1175825

1 0

openSUSE-RU-2020:1577-1: moderate: Recommended update for torbrowser-launcher
by maintenance＠opensuse.org 29 Sep '20

29 Sep '20

openSUSE Recommended Update: Recommended update for torbrowser-launcher ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1577-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for torbrowser-launcher fixes the following issues: - Add new key from upstream tor-browser as source and overwrite bundled key in tarball with this (gh#micahflee/torbrowser-launcher#481). - Fixed version checking with torbrowser 10.0+; patch taken from upstream PR (not yet merged) [gh#micahflee/torbrowser-launcher#499]. - Add further fixes to torbrowser-launcher-apparmor-fixes.patch to enable bundled libstdc++ to be mapped; fixes taken from pending upstream PR (gh#micahflee/torbrowser-launcher#503). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1577=1 Package List: - openSUSE Leap 15.2 (noarch): torbrowser-apparmor-profile-0.3.2-lp152.4.3.1 torbrowser-launcher-0.3.2-lp152.4.3.1 torbrowser-launcher-lang-0.3.2-lp152.4.3.1 References:

1 0

openSUSE-RU-2020:1576-1: moderate: Recommended update for python-pytest-xdist
by maintenance＠opensuse.org 29 Sep '20

29 Sep '20

openSUSE Recommended Update: Recommended update for python-pytest-xdist ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1576-1 Rating: moderate References: #1171561 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pytest-xdist fixes the following issue: - Export PYTHONDONTWRITEBYTECODE=1 to avoid PYTEST.pyc cache creation. (bsc#1171561) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1576=1 Package List: - openSUSE Leap 15.2 (noarch): python2-pytest-xdist-1.27.0-lp152.3.6.1 python3-pytest-xdist-1.27.0-lp152.3.6.1 References: https://bugzilla.suse.com/1171561

1 0

openSUSE-SU-2020:1575-1: important: Security update for rubygem-actionpack-5_1
by opensuse-security＠opensuse.org 29 Sep '20

29 Sep '20

openSUSE Security Update: Security update for rubygem-actionpack-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1575-1 Rating: important References: #1172177 Cross-References: CVE-2020-8164 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionpack-5_1 fixes the following issues: - CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack. There is a strong parameters bypass vector in ActionPack. (bsc#1172177) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1575=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-actionpack-5_1-5.1.4-bp151.2.3.1 ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-8164.html https://bugzilla.suse.com/1172177

1 0

openSUSE-SU-2020:1574-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 29 Sep '20

29 Sep '20

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1574-1 Rating: important References: #1167976 #1173986 #1174420 #1176756 Cross-References: CVE-2020-15673 CVE-2020-15676 CVE-2020-15677 CVE-2020-15678 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: -Firefox was updated to 78.3.0 ESR (bsc#1176756, MFSA 2020-43) - CVE-2020-15677: Download origin spoofing via redirect - CVE-2020-15676: Fixed an XSS when pasting attacker-controlled data into a contenteditable element - CVE-2020-15678: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario - CVE-2020-15673: Fixed memory safety bugs - Enhance fix for wayland-detection (bsc#1174420) - Attempt to fix langpack-parallelization by introducing separate obj-dirs for each lang (bsc#1173986, bsc#1167976) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1574=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.3.0-lp152.2.21.1 MozillaFirefox-branding-upstream-78.3.0-lp152.2.21.1 MozillaFirefox-buildsymbols-78.3.0-lp152.2.21.1 MozillaFirefox-debuginfo-78.3.0-lp152.2.21.1 MozillaFirefox-debugsource-78.3.0-lp152.2.21.1 MozillaFirefox-devel-78.3.0-lp152.2.21.1 MozillaFirefox-translations-common-78.3.0-lp152.2.21.1 MozillaFirefox-translations-other-78.3.0-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2020-15673.html https://www.suse.com/security/cve/CVE-2020-15676.html https://www.suse.com/security/cve/CVE-2020-15677.html https://www.suse.com/security/cve/CVE-2020-15678.html https://bugzilla.suse.com/1167976 https://bugzilla.suse.com/1173986 https://bugzilla.suse.com/1174420 https://bugzilla.suse.com/1176756

1 0