September 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2020:1483-1: important: Security update for perl-DBI
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Security update for perl-DBI ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1483-1 Rating: important References: #1176409 #1176412 Cross-References: CVE-2020-14392 CVE-2020-14393 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for perl-DBI fixes the following issues: Security issues fixed: - CVE-2020-14392: Memory corruption in XS functions when Perl stack is reallocated (bsc#1176412). - CVE-2020-14393: Fixed a buffer overflow on an overlong DBD class name (bsc#1176409). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1483=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): perl-DBI-1.642-lp152.2.3.1 perl-DBI-debuginfo-1.642-lp152.2.3.1 perl-DBI-debugsource-1.642-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14392.html https://www.suse.com/security/cve/CVE-2020-14393.html https://bugzilla.suse.com/1176409 https://bugzilla.suse.com/1176412

1 0

openSUSE-RU-2020:1485-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1485-1 Rating: moderate References: #1175256 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perf provides the following fixes: - Add latest git-fixes (bsc#1175256): * perf bpf-loader: Add missing '*' for key_scan_pos * perf cs-etm: Move definition of 'traceid_list' global variable from header file * perf env: Do not return pointers to local variables * perf intel-pt: Fix PEBS sample for XMM registers * perf: Make perf able to build with latest libbfd * perf metrics: Fix parse errors in power8 metrics * perf metrics: Fix parse errors in power9 metrics * perf metrics: Fix parse errors in skylake metrics * perf parse-events: Fix an incompatible pointer * perf probe: Check address correctness by map instead of _etext * perf probe: Do not show the skipped events * perf probe: Fix to check blacklist address correctly * perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events * perf report TUI: Fix segmentation fault in perf_evsel__hists_browse() * perf scripts python: export-to-postgresql.py: Fix struct.pack() int argument * perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result * perf scripts python: exported-sql-viewer.py: Fix zero id in call graph find result * perf scripts python: exported-sql-viewer.py: Fix zero id in call tree find result * perf stat: Ensure group is defined on top of the same cpu mask * perf stat: Fix duration_time value for higher intervals * perf stat: Fix NULL pointer dereference * perf stat: Fix wrong per-thread runtime stat for interval mode * perf stat: Honour --timeout for forked workloads * perf stat: Improve runtime stat for interval mode * perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode * perf test session topology: Fix data path * perf tools: Fix reading new topology attribute "core_cpus" * perf tools: Fix record failure when mixed with ARM SPE event * perf vendor events intel: Update all the Intel JSON metrics from TMAM This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1485=1 Package List: - openSUSE Leap 15.2 (x86_64): perf-5.3.18-lp152.21.6.1 perf-debuginfo-5.3.18-lp152.21.6.1 perf-debugsource-5.3.18-lp152.21.6.1 References: https://bugzilla.suse.com/1175256

1 0

openSUSE-RU-2020:1482-1: moderate: Recommended update for zlib
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for zlib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1482-1 Rating: moderate References: #1175811 #1175830 #1175831 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for zlib fixes the following issues: - Fix compression level switching (bsc#1175811, bsc#1175830, bsc#1175831) - Enable hardware compression on s390/s390x (jsc#SLE-13776) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1482=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libminizip1-1.2.11-lp152.8.6.1 libminizip1-debuginfo-1.2.11-lp152.8.6.1 libz1-1.2.11-lp152.8.6.1 libz1-debuginfo-1.2.11-lp152.8.6.1 minizip-devel-1.2.11-lp152.8.6.1 zlib-debugsource-1.2.11-lp152.8.6.1 zlib-devel-1.2.11-lp152.8.6.1 zlib-devel-static-1.2.11-lp152.8.6.1 - openSUSE Leap 15.2 (x86_64): libminizip1-32bit-1.2.11-lp152.8.6.1 libminizip1-32bit-debuginfo-1.2.11-lp152.8.6.1 libz1-32bit-1.2.11-lp152.8.6.1 libz1-32bit-debuginfo-1.2.11-lp152.8.6.1 zlib-devel-32bit-1.2.11-lp152.8.6.1 zlib-devel-static-32bit-1.2.11-lp152.8.6.1 References: https://bugzilla.suse.com/1175811 https://bugzilla.suse.com/1175830 https://bugzilla.suse.com/1175831

1 0

openSUSE-SU-2020:1475-1: moderate: Recommended update for otrs
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Recommended update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1475-1 Rating: moderate References: #1122560 #1137614 #1137615 #1139406 #1141430 #1141431 #1141432 #1156431 #1157001 #1160663 #1168029 #1168030 #1168031 #1168032 Cross-References: CVE-2019-10067 CVE-2019-12248 CVE-2019-12497 CVE-2019-12746 CVE-2019-13457 CVE-2019-13458 CVE-2019-16375 CVE-2019-18179 CVE-2019-18180 CVE-2019-9752 CVE-2019-9892 CVE-2020-1765 CVE-2020-1766 CVE-2020-1769 CVE-2020-1770 CVE-2020-1771 CVE-2020-1772 CVE-2020-1773 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Otrs was updated to 5.0.42, fixing lots of bugs and security issues: https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo#1168029 OSA-2020-10: * Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. - CVE-2020-1772 boo#1168029 OSA-2020-09: * Information Disclosure It’s possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. - CVE-2020-1771 boo#1168030 OSA-2020-08: * Possible XSS in Customer user address book Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. - CVE-2020-1770 boo#1168031 OSA-2020-07: * Information disclosure in support bundle files Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. - CVE-2020-1769 boo#1168032 OSA-2020-06: * Autocomplete in the form login screens In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. Update to 5.0.41 https://community.otrs.com/otrs-community-edition-5s-patch-level-41/ * bug#14912 - Installer refers to non-existing documentation - added code to upgrade OTRS from 4 to 5 READ UPGRADING.SUSE * steps 1 to 4 are done by rpm pkg * steps 5 to *END* need to be done manually cause of DB backup Update to 5.0.40 https://community.otrs.com/otrs-community-edition-5s-patch-level-40/ - CVE-2020-1766 boo#1160663 OSA-2020-02: Improper handling of uploaded inline images Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. * CVE-2020-1765, OSA-2020-01: Spoofing of From field in several screens An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade - Update 5.0.39 https://community.otrs.com/otrs-community-edition-5s-patch-level-39/ * CVE-2019-18180 boo#1157001 OSA-2019-15: Denial of service OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). * CVE-2019-18179 OSA-2019-14: Information Disclosure An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. Update to 5.0.38 https://community.otrs.com/release-notes-otrs-5s-patch-level-38/ * CVE-2019-16375, boo#1156431 OSA-2019-13: Stored XXS An attacker who is logged into OTRS as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent compose an answer to the original article. Update to 5.0.37 https://community.otrs.com/release-notes-otrs-5s-patch-level-37/ * CVE-2019-13458, boo#1141432, OSA-2019-12: Information Disclosure An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS tags in templates in order to disclose hashed user passwords. * CVE-2019-13457, boo#1141431, OSA-2019-11: Information Disclosure A customer user can use the search results to disclose information from their “company” tickets (with the same CustomerID), even when CustomerDisableCompanyTicketAccess setting is turned on. * CVE-2019-12746, boo#1141430, OSA-2019-10: Session ID Disclosure A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then potentially abused in order to impersonate the agent user. Update to 5.0.36 https://community.otrs.com/release-notes-otrs-5s-patch-level-36/ * CVE-2019-12497, boo#1137614, OSA-2019-09: Information Disclosure In the customer or external frontend, personal information of agents can be disclosed like Name and mail address in external notes. * CVE-2019-12248, boo#1137615, OSA-2019-08: Loading External Image Resources An attacker could send a malicious email to an OTRS system. If a logged in agent user quotes it, the email could cause the browser to load external image resources. Update to 5.0.35 https://community.otrs.com/release-notes-otrs-5s-patch-level-35/ * CVE-2019-10067, boo#1139406, OSA-2019-05: Reflected and Stored XSS An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. * CVE-2019-9892, boo#1139406, OSA-2019-04: XXE Processing An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files of OTRS filesystem. - update missing CVE for OSA-2018-10, OSA-2019-01 Update to 5.0.34 * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/ * CVE-2019-9752, boo#1122560, OSA-2019-01: Stored XSS An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. Update to 5.0.33 * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/ Update to 5.0.26 * https://www.otrs.com/release-notes-otrs-5s-patch-level-26 * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/ - remove obsolete * otrs-scheduler.service * otrs-scheduler.init This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1475=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1475=1 Package List: - openSUSE Leap 15.2 (noarch): otrs-6.0.29-lp152.2.3.4 otrs-doc-6.0.29-lp152.2.3.4 otrs-itsm-6.0.29-lp152.2.3.4 - openSUSE Leap 15.1 (noarch): otrs-6.0.29-lp151.2.6.2 otrs-doc-6.0.29-lp151.2.6.2 otrs-itsm-6.0.29-lp151.2.6.2 - openSUSE Backports SLE-15-SP2 (noarch): otrs-6.0.29-bp152.2.5.4 otrs-doc-6.0.29-bp152.2.5.4 otrs-itsm-6.0.29-bp152.2.5.4 - openSUSE Backports SLE-15-SP1 (noarch): otrs-6.0.29-bp151.3.6.2 otrs-doc-6.0.29-bp151.3.6.2 otrs-itsm-6.0.29-bp151.3.6.2 References: https://www.suse.com/security/cve/CVE-2019-10067.html https://www.suse.com/security/cve/CVE-2019-12248.html https://www.suse.com/security/cve/CVE-2019-12497.html https://www.suse.com/security/cve/CVE-2019-12746.html https://www.suse.com/security/cve/CVE-2019-13457.html https://www.suse.com/security/cve/CVE-2019-13458.html https://www.suse.com/security/cve/CVE-2019-16375.html https://www.suse.com/security/cve/CVE-2019-18179.html https://www.suse.com/security/cve/CVE-2019-18180.html https://www.suse.com/security/cve/CVE-2019-9752.html https://www.suse.com/security/cve/CVE-2019-9892.html https://www.suse.com/security/cve/CVE-2020-1765.html https://www.suse.com/security/cve/CVE-2020-1766.html https://www.suse.com/security/cve/CVE-2020-1769.html https://www.suse.com/security/cve/CVE-2020-1770.html https://www.suse.com/security/cve/CVE-2020-1771.html https://www.suse.com/security/cve/CVE-2020-1772.html https://www.suse.com/security/cve/CVE-2020-1773.html https://bugzilla.suse.com/1122560 https://bugzilla.suse.com/1137614 https://bugzilla.suse.com/1137615 https://bugzilla.suse.com/1139406 https://bugzilla.suse.com/1141430 https://bugzilla.suse.com/1141431 https://bugzilla.suse.com/1141432 https://bugzilla.suse.com/1156431 https://bugzilla.suse.com/1157001 https://bugzilla.suse.com/1160663 https://bugzilla.suse.com/1168029 https://bugzilla.suse.com/1168030 https://bugzilla.suse.com/1168031 https://bugzilla.suse.com/1168032

1 0

openSUSE-RU-2020:1477-1: moderate: Recommended update for ffnvcodec
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for ffnvcodec ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1477-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for ffnvcodec fixes the following issues: Update to 10.0.26.0: * Update headers from Video SDK 10.0 Update to version 9.1.23.1: * Add primary context management functions Update to version 9.1.23.0 * Add cuCtxGetDevice * Use pointer-to-struct typedefs for pointer-to-struct types * Update headers from Video SDK 9.1 release Update to version 9.0.18.1 * Fix CUdeviceptr definition for 64bit CPU Changes from version 9.0.18.0 * Initial release for SDK 9.0 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1477=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1477=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1477=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1477=1 Package List: - openSUSE Leap 15.2 (x86_64): ffnvcodec-devel-10.0.26.0-lp152.3.3.1 - openSUSE Leap 15.1 (x86_64): ffnvcodec-devel-10.0.26.0-lp151.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): ffnvcodec-devel-10.0.26.0-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): ffnvcodec-devel-10.0.26.0-bp151.2.3.1 References:

1 0

openSUSE-RU-2020:1476-1: moderate: Recommended update for monitoring-plugins-zypper
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for monitoring-plugins-zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1476-1 Rating: moderate References: #1103590 #1132350 #1173872 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for monitoring-plugins-zypper fixes the following issues: Update to 1.98.6 (fixes boo#1173872) - Beside other, small updates, this release includes first support for the rolling release named openSUSE Tumbleweed. Per default, a Tumbleweed installation which is older than 30 days will trigger a warning state - and an installation older than 60 days will trigger a critical state. You can fine tune this behavior with the new command line options --tw_outdated_warn and --tw_outdated_crit. Other changes: * use proper Copyright * use Perl modules: POSIX and Time::Local * die, if release-file could not be opened * get rid of get_distribution_from_os_release() function: use get_distribution() for all cases * new test_tumbleweed() and check_returncode() functions (internal) * trim quotation marks in trim() function * added some os-release files for testing Update to 1.98.5 * Adjust support status of SLE, Leap and Tumbleweed releases update to 1.98 + openSUSE 15.0 is running out of service end of November 2019 + add Tumbleweed 2020 into the game update supported_releases: - add openSUSE Leap 15.2 - drop openSUSE Leap 42.3 - add SLE 12-SP5, SLE 15-SP2 - drop SLE 12-SP3 Update AppArmor profile: - adjust paths for usrMerge (related to boo#1132350) - change {,usr/} alternations to {usr/,} which is the prefered syntax - adapt apparmor profile for bash move to /usr - add suggested changes in sudoers file (boo#1103590) - cleanup the help output of the plugin - as newer zypper versions always require root rights to refresh the repositories, add a working sudoers file right from the beginning that allows to execute the needed zypper commands Update to 1.96: + SLE-12-SP2 is deprecated + add SLE-15-SP1 and SLE-12-SP4 as supported Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1476=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1476=1 Package List: - openSUSE Leap 15.2 (noarch): monitoring-plugins-zypper-1.98.6-lp152.3.3.1 - openSUSE Leap 15.1 (noarch): monitoring-plugins-zypper-1.98.6-lp151.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-zypper-1.98.6-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-zypper-1.98.6-bp151.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): monitoring-plugins-zypper-1.98.6-5.1 References: https://bugzilla.suse.com/1103590 https://bugzilla.suse.com/1132350 https://bugzilla.suse.com/1173872

1 0

openSUSE-RU-2020:1479-1: moderate: Recommended update for kmix
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for kmix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1479-1 Rating: moderate References: #1175698 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kmix fixes the following issues: - Remove the not-working "Audio Setup" menu entry, its purpose was to open kcm_phonon which no longer exists (boo#1175698) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1479=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1479=1 Package List: - openSUSE Leap 15.2 (noarch): kmix-lang-20.04.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): kmix-20.04.2-lp152.2.3.1 kmix-debuginfo-20.04.2-lp152.2.3.1 kmix-debugsource-20.04.2-lp152.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kmix-20.04.2-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): kmix-lang-20.04.2-bp152.2.3.1 References: https://bugzilla.suse.com/1175698

1 0

openSUSE-RU-2020:1480-1: moderate: Recommended update for editorconfig-core-c
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for editorconfig-core-c ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1480-1 Rating: moderate References: #1175824 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for editorconfig-core-c fixes the following issues: - Fixed crash when parsing certain files (boo#1175824): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1480=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1480=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1480=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1480=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): editorconfig-0.12.3-lp152.2.3.1 editorconfig-core-c-debugsource-0.12.3-lp152.2.3.1 editorconfig-debuginfo-0.12.3-lp152.2.3.1 libeditorconfig-devel-0.12.3-lp152.2.3.1 libeditorconfig0-0.12.3-lp152.2.3.1 libeditorconfig0-debuginfo-0.12.3-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libeditorconfig-devel-32bit-0.12.3-lp152.2.3.1 libeditorconfig0-32bit-0.12.3-lp152.2.3.1 libeditorconfig0-32bit-debuginfo-0.12.3-lp152.2.3.1 - openSUSE Leap 15.1 (i586 x86_64): editorconfig-0.12.1-lp151.4.3.1 editorconfig-core-c-debugsource-0.12.1-lp151.4.3.1 editorconfig-debuginfo-0.12.1-lp151.4.3.1 libeditorconfig-devel-0.12.1-lp151.4.3.1 libeditorconfig0-0.12.1-lp151.4.3.1 libeditorconfig0-debuginfo-0.12.1-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libeditorconfig-devel-32bit-0.12.1-lp151.4.3.1 libeditorconfig0-32bit-0.12.1-lp151.4.3.1 libeditorconfig0-32bit-debuginfo-0.12.1-lp151.4.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): editorconfig-0.12.3-bp152.2.3.1 editorconfig-core-c-debugsource-0.12.3-bp152.2.3.1 editorconfig-debuginfo-0.12.3-bp152.2.3.1 libeditorconfig-devel-0.12.3-bp152.2.3.1 libeditorconfig0-0.12.3-bp152.2.3.1 libeditorconfig0-debuginfo-0.12.3-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libeditorconfig-devel-64bit-0.12.3-bp152.2.3.1 libeditorconfig0-64bit-0.12.3-bp152.2.3.1 libeditorconfig0-64bit-debuginfo-0.12.3-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): editorconfig-0.12.1-bp151.4.3.1 libeditorconfig-devel-0.12.1-bp151.4.3.1 libeditorconfig0-0.12.1-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libeditorconfig-devel-64bit-0.12.1-bp151.4.3.1 libeditorconfig0-64bit-0.12.1-bp151.4.3.1 References: https://bugzilla.suse.com/1175824

1 0

openSUSE-RU-2020:1476-1: moderate: Recommended update for monitoring-plugins-zypper
by maintenance＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Recommended Update: Recommended update for monitoring-plugins-zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1476-1 Rating: moderate References: #1103590 #1132350 #1173872 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for monitoring-plugins-zypper fixes the following issues: Update to 1.98.6 (fixes boo#1173872) - Beside other, small updates, this release includes first support for the rolling release named openSUSE Tumbleweed. Per default, a Tumbleweed installation which is older than 30 days will trigger a warning state - and an installation older than 60 days will trigger a critical state. You can fine tune this behavior with the new command line options --tw_outdated_warn and --tw_outdated_crit. Other changes: * use proper Copyright * use Perl modules: POSIX and Time::Local * die, if release-file could not be opened * get rid of get_distribution_from_os_release() function: use get_distribution() for all cases * new test_tumbleweed() and check_returncode() functions (internal) * trim quotation marks in trim() function * added some os-release files for testing Update to 1.98.5 * Adjust support status of SLE, Leap and Tumbleweed releases update to 1.98 + openSUSE 15.0 is running out of service end of November 2019 + add Tumbleweed 2020 into the game update supported_releases: - add openSUSE Leap 15.2 - drop openSUSE Leap 42.3 - add SLE 12-SP5, SLE 15-SP2 - drop SLE 12-SP3 Update AppArmor profile: - adjust paths for usrMerge (related to boo#1132350) - change {,usr/} alternations to {usr/,} which is the prefered syntax - adapt apparmor profile for bash move to /usr - add suggested changes in sudoers file (boo#1103590) - cleanup the help output of the plugin - as newer zypper versions always require root rights to refresh the repositories, add a working sudoers file right from the beginning that allows to execute the needed zypper commands Update to 1.96: + SLE-12-SP2 is deprecated + add SLE-15-SP1 and SLE-12-SP4 as supported Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1476=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1476=1 Package List: - openSUSE Leap 15.2 (noarch): monitoring-plugins-zypper-1.98.6-lp152.3.3.1 - openSUSE Leap 15.1 (noarch): monitoring-plugins-zypper-1.98.6-lp151.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-zypper-1.98.6-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-zypper-1.98.6-bp151.3.3.1 References: https://bugzilla.suse.com/1103590 https://bugzilla.suse.com/1132350 https://bugzilla.suse.com/1173872

1 0

openSUSE-SU-2020:1478-1: important: Security update for fossil
by opensuse-security＠opensuse.org 20 Sep '20

20 Sep '20

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: #1047218 #1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for fossil fixes the following issues: - fossil 2.12.1: * CVE-2020-24614: Remote authenticated users with check-in or administrative privileges could have executed arbitrary code [boo#1175760] * Security fix in the "fossil git export" command. New "safety-net" features were added to prevent similar problems in the future. * Enhancements to the graph display for cases when there are many cherry-pick merges into a single check-in. Example * Enhance the fossil open command with the new --workdir option and the ability to accept a URL as the repository name, causing the remote repository to be cloned automatically. Do not allow "fossil open" to open in a non-empty working directory unless the --keep option or the new --force option is used. * Enhance the markdown formatter to more closely follow the CommonMark specification with regard to text highlighting. Underscores in the middle of identifiers (ex: fossil_printf()) no longer need to be escaped. * The markdown-to-html translator can prevent unsafe HTML (for example: <script>) on user-contributed pages like forum and tickets and wiki. The admin can adjust this behavior using the safe-html setting on the Admin/Wiki page. The default is to disallow unsafe HTML everywhere. * Added the "collapse" and "expand" capability for long forum posts. * The "fossil remote" command now has options for specifying multiple persistent remotes with symbolic names. Currently only one remote can be used at a time, but that might change in the future. * Add the "Remember me?" checkbox on the login page. Use a session cookie for the login if it is not checked. * Added the experimental "fossil hook" command for managing "hook scripts" that run before checkin or after a push. * Enhance the fossil revert command so that it is able to revert all files beneath a directory. * Add the fossil bisect skip command. * Add the fossil backup command. * Enhance fossil bisect ui so that it shows all unchecked check-ins in between the innermost "good" and "bad" check-ins. * Added the --reset flag to the "fossil add", "fossil rm", and "fossil addremove" commands. * Added the "--min N" and "--logfile FILENAME" flags to the backoffice command, as well as other enhancements to make the backoffice command a viable replacement for automatic backoffice. Other incremental backoffice improvements. * Added the /fileedit page, which allows editing of text files online. Requires explicit activation by a setup user. * Translate built-in help text into HTML for display on web pages. * On the /timeline webpage, the combination of query parameters "p=CHECKIN" and "bt=ANCESTOR" draws all ancestors of CHECKIN going back to ANCESTOR. * Update the built-in SQLite so that the "fossil sql" command supports new output modes ".mode box" and ".mode json". * Add the "obscure()" SQL function to the "fossil sql" command. * Added virtual tables "helptext" and "builtin" to the "fossil sql" command, providing access to the dispatch table including all help text, and the builtin data files, respectively. * Delta compression is now applied to forum edits. * The wiki editor has been modernized and is now Ajax-based. - Package the fossil.1 manual page. - fossil 2.11.1: * Make the "fossil git export" command more restrictive about characters that it allows in the tag names - Add fossil-2.11-reproducible.patch to override build date (boo#1047218) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1478=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1478=1 Package List: - openSUSE Leap 15.2 (x86_64): fossil-2.12.1-lp152.2.3.1 fossil-debuginfo-2.12.1-lp152.2.3.1 fossil-debugsource-2.12.1-lp152.2.3.1 - openSUSE Leap 15.1 (x86_64): fossil-2.12.1-lp151.3.6.1 fossil-debuginfo-2.12.1-lp151.3.6.1 fossil-debugsource-2.12.1-lp151.3.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.12.1-bp152.2.3.1 fossil-debuginfo-2.12.1-bp152.2.3.1 fossil-debugsource-2.12.1-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): fossil-2.12.1-bp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-24614.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1175760

1 0