September 2020 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2020:1411-1: moderate: Recommended update for xrdp
by maintenance＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Recommended Update: Recommended update for xrdp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1411-1 Rating: moderate References: #1171415 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xrdp fixes the following issue: - Fallback session to icewm when a selected desktop environment is not found (bsc#1171415) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1411=1 Package List: - openSUSE Leap 15.2 (x86_64): libpainter0-0.9.13.1-lp152.3.6.1 libpainter0-debuginfo-0.9.13.1-lp152.3.6.1 librfxencode0-0.9.13.1-lp152.3.6.1 librfxencode0-debuginfo-0.9.13.1-lp152.3.6.1 xrdp-0.9.13.1-lp152.3.6.1 xrdp-debuginfo-0.9.13.1-lp152.3.6.1 xrdp-debugsource-0.9.13.1-lp152.3.6.1 xrdp-devel-0.9.13.1-lp152.3.6.1 References: https://bugzilla.suse.com/1171415

1 0

openSUSE-RU-2020:1406-1: moderate: Recommended update for yast2-bootloader, yast2-installation
by maintenance＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Recommended Update: Recommended update for yast2-bootloader, yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1406-1 Rating: moderate References: #1168036 #1174964 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-bootloader, yast2-installation provides the following fixes: Changes in yast2-bootloader: - Add rd.zdev to allowed kernel options on s390. (bsc#1168036) Changes in yast2-installation: - Handle device autoconfig setting in summary screen. (bsc#1168036) - Save random pool to /var/lib/systemd/random-seed. (bsc#1174964) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1406=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-bootloader-4.2.26-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): yast2-installation-4.2.45-lp152.2.6.1 References: https://bugzilla.suse.com/1168036 https://bugzilla.suse.com/1174964

1 0

openSUSE-RU-2020:1410-1: moderate: Recommended update for python3-azuremetadata
by maintenance＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Recommended Update: Recommended update for python3-azuremetadata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1410-1 Rating: moderate References: #1175609 #1175610 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python3-azuremetadata contains the following fix: - Fix provides directive (bsc#1175609, bsc#1175610) + The provides directive must set a version or update does not work as expected This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1410=1 Package List: - openSUSE Leap 15.2 (noarch): python3-azuremetadata-5.1.2-lp152.2.6.1 References: https://bugzilla.suse.com/1175609 https://bugzilla.suse.com/1175610

1 0

openSUSE-RU-2020:1408-1: moderate: Recommended update for python-importlib_resources
by maintenance＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Recommended Update: Recommended update for python-importlib_resources ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1408-1 Rating: moderate References: #1175707 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-importlib_resources fixes the following issue: - Add missing runtime dependencies. (bsc#1175707) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1408=1 Package List: - openSUSE Leap 15.2 (noarch): python2-importlib_resources-1.1.0-lp152.2.8.1 python3-importlib_resources-1.1.0-lp152.2.8.1 References: https://bugzilla.suse.com/1175707

1 0

openSUSE-RU-2020:1409-1: moderate: Recommended update for tomcat
by maintenance＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1409-1 Rating: moderate References: #1092163 #1172562 #1173103 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for tomcat fixes the following issues: - Fixed the package alternatives for tomcat-servlet-4_0-api to use /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar - We kept /usr/share/java/tomcat-servlet.jar as a symlink for compatibility reasons (bsc#1092163) - Removed write permissions on several files and directories for the tomcat group (bsc#1172562) - Changed the tomcat.pid location from /var/run to /run (bsc#1173103) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1409=1 Package List: - openSUSE Leap 15.2 (noarch): tomcat-9.0.36-lp152.2.7.1 tomcat-admin-webapps-9.0.36-lp152.2.7.1 tomcat-docs-webapp-9.0.36-lp152.2.7.1 tomcat-el-3_0-api-9.0.36-lp152.2.7.1 tomcat-embed-9.0.36-lp152.2.7.1 tomcat-javadoc-9.0.36-lp152.2.7.1 tomcat-jsp-2_3-api-9.0.36-lp152.2.7.1 tomcat-jsvc-9.0.36-lp152.2.7.1 tomcat-lib-9.0.36-lp152.2.7.1 tomcat-servlet-4_0-api-9.0.36-lp152.2.7.1 tomcat-webapps-9.0.36-lp152.2.7.1 References: https://bugzilla.suse.com/1092163 https://bugzilla.suse.com/1172562 https://bugzilla.suse.com/1173103

1 0

openSUSE-SU-2020:1407-1: important: Security update for go1.14
by opensuse-security＠opensuse.org 11 Sep '20

11 Sep '20

openSUSE Security Update: Security update for go1.14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1407-1 Rating: important References: #1164903 #1169832 #1170826 #1172868 #1174153 #1174191 #1174977 Cross-References: CVE-2020-14039 CVE-2020-15586 CVE-2020-16845 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for go1.14 fixes the following issues: - go1.14 was updated to version 1.14.7 - CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977). - go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191 * go#39991 runtime: missing deferreturn on linux/ppc64le * go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent * go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes * go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15 * go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally * go#39636 reflect: DeepEqual can return true for values that are not equal * go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues * go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64 * go#39308 testing: streaming output loses parallel subtest associations * go#39288 cmd/vet: update for new number formats * go#39101 database/sql: context cancellation allows statements to execute after rollback * go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes * go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586 * go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only) - Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1407=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.14-1.14.7-lp152.2.3.1 go1.14-doc-1.14.7-lp152.2.3.1 go1.14-race-1.14.7-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14039.html https://www.suse.com/security/cve/CVE-2020-15586.html https://www.suse.com/security/cve/CVE-2020-16845.html https://bugzilla.suse.com/1164903 https://bugzilla.suse.com/1169832 https://bugzilla.suse.com/1170826 https://bugzilla.suse.com/1172868 https://bugzilla.suse.com/1174153 https://bugzilla.suse.com/1174191 https://bugzilla.suse.com/1174977

1 0

openSUSE-SU-2020:1405-1: important: Security update for go1.14
by opensuse-security＠opensuse.org 10 Sep '20

10 Sep '20

openSUSE Security Update: Security update for go1.14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1405-1 Rating: important References: #1164903 #1169832 #1170826 #1172868 #1174153 #1174191 #1174977 Cross-References: CVE-2020-14039 CVE-2020-15586 CVE-2020-16845 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for go1.14 fixes the following issues: - go1.14 was updated to version 1.14.7 - CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977). - go1.14.6 (released 2020-07-16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. Refs bsc#1164903 go1.14 release tracking Refs bsc#1174153 bsc#1174191 * go#39991 runtime: missing deferreturn on linux/ppc64le * go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent * go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes * go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15 * go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally * go#39636 reflect: DeepEqual can return true for values that are not equal * go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va lues * go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie s to use an older version of dlv which only supports linux/amd64 * go#39308 testing: streaming output loses parallel subtest associations * go#39288 cmd/vet: update for new number formats * go#39101 database/sql: context cancellation allows statements to execute after rollback * go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes * go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586 * go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only) - Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is not present bsc#1172868 gh#golang/go#35305 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1405=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.14-1.14.7-lp151.13.1 go1.14-doc-1.14.7-lp151.13.1 go1.14-race-1.14.7-lp151.13.1 References: https://www.suse.com/security/cve/CVE-2020-14039.html https://www.suse.com/security/cve/CVE-2020-15586.html https://www.suse.com/security/cve/CVE-2020-16845.html https://bugzilla.suse.com/1164903 https://bugzilla.suse.com/1169832 https://bugzilla.suse.com/1170826 https://bugzilla.suse.com/1172868 https://bugzilla.suse.com/1174153 https://bugzilla.suse.com/1174191 https://bugzilla.suse.com/1174977

1 0

openSUSE-RU-2020:1404-1: moderate: Recommended update for python-importlib_resources
by maintenance＠opensuse.org 10 Sep '20

10 Sep '20

openSUSE Recommended Update: Recommended update for python-importlib_resources ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1404-1 Rating: moderate References: #1175707 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-importlib_resources fixes the following issue: - Add missing runtime dependencies. (bsc#1175707) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1404=1 Package List: - openSUSE Leap 15.1 (noarch): python2-importlib_resources-1.1.0-lp151.8.1 python3-importlib_resources-1.1.0-lp151.8.1 References: https://bugzilla.suse.com/1175707

1 0

openSUSE-RU-2020:1403-1: moderate: Recommended update for choqok
by maintenance＠opensuse.org 10 Sep '20

10 Sep '20

openSUSE Recommended Update: Recommended update for choqok ______________________________________________________________________________ Announcement ID: openSUSE-RU-2020:1403-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for choqok fixes the following issues: Add upstream patches to fix problems that still were present in the 1.7.0 release: * Fixed retrieving Twitter conversations (kde#417193) * Link to the original post for retweets * twitter Dont overwrite contents of retweets (kde#370260) Update to 1.7.0: * Port to QtNetworkAuth and drop qoauth dependency * Plugin compability break: MicroBlog::profileUrl returns a QUrl instead * Plugin compability break: MicroBlog::postUrl returns a QUrl instead * Allow to disable accounts * Honour the default font (kde#372291) * Make the sign footer consistent between all microplugins * Unread post count in the application title sums all unread posts' accounts * Twitter: update char limit to 280 * Twitter: support extended tweets (kde#370260) * Twitter: fix list browsing (kde#382392) * Twitter: fix followers list * Twitter: show client source even for private messages * Twitter: show user' real name when no description is set * GNU Social: do not rely over qvitter to get the post url * GNU Social: hide linkback statuses * GNU Social: show user' real name when no description is set * Pump.io: escape the description * Pump.io: show user' real name when no description is set * Drop yFrog support from ImagePreview plugin Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1403=1 Package List: - openSUSE Leap 15.1 (x86_64): choqok-1.7.0-lp151.3.3.1 choqok-debuginfo-1.7.0-lp151.3.3.1 choqok-debugsource-1.7.0-lp151.3.3.1 choqok-devel-1.7.0-lp151.3.3.1 References:

1 0

openSUSE-OU-2020:1401-1: Optional update for meson
by maintenance＠opensuse.org 10 Sep '20

10 Sep '20

openSUSE Optional Update: Optional update for meson ______________________________________________________________________________ Announcement ID: openSUSE-OU-2020:1401-1 Rating: low References: #1173025 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for meson doesn't fix any user visible issues, but fixes internal test cases only (bsc#1173025) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1401=1 Package List: - openSUSE Leap 15.2 (x86_64): meson-test-0.54.2-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): meson-0.54.2-lp152.2.3.1 meson-vim-0.54.2-lp152.2.3.1 References: https://bugzilla.suse.com/1173025

1 0