SUSE SLED15 / SLES15 Security Update : openconnect (SUSE-SU-2020:1337-1)

This update for openconnect fixes the following issues : Security issue fixed : CVE-2020-12105: Fixed the improper handling of negative return values from X509check function calls that might have allowed MITM attacks bsc1170452. Note that Tenable Network Security has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : libbsd (SUSE-SU-2020:1298-1)

This update for libbsd fixes the following issues : CVE-2019-20367: Fixed an out-of-bounds read during a comparison for a symbol names from the string table bsc1160551. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenab...

SUSE SLED15 / SLES15 Security Update : libvpx (SUSE-SU-2020:1297-1)

This update for libvpx fixes the following issues : CVE-2020-0034: Fixed an out-of-bounds read on truncated key frames bsc1166066. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clea...

SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:1208-1)

This update for libvirt fixes the following issues : Security issues fixed : CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. CVE-2020-12430: Fixed a memory leak in qemuDomainGetStatsIOThread bsc1170765. Non-security issues fixed : Support setting credit2...

SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:1213-1)

This update for rmt-server to version 2.5.7 fixes the following issues : Fixed a local denial of service bsc1165548. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format i...

SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2020:1219-1)

This update for openldap2 fixes the following issues : CVE-2020-12243: Fixed a denial of service related to recursive filters bsc1170771. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...

SUSE SLES15 Security Update : libvirt (SUSE-SU-2020:1250-1)

This update for libvirt fixes the following issues : Security issue fixed : CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed : apparmor: avoid copying empty profile name bsc1149100. logging: ensure virtlogd rollover takes priority ove...

SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2020:1220-1)

This update for ghostscript to version 9.52 fixes the following issues : CVE-2020-12268: Fixed a heap-based buffer overflow in jbig2imagecompose bsc1170603. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2020:1199-1)

This update for php7 fixes the following issues : CVE-2020-7064: Fixed a one byte read of uninitialized memory in exifreaddata bsc1168326. CVE-2020-7066: Fixed URL truncation getheaders if the URL contains zero \0 character bsc1168352. Note that Tenable Network Security has extracted the precedin...

SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:1179-1)

This update for rmt-server to version 2.5.7 fixes the following issues : Security issues fixed : CVE-2019-18904: Fixed offline migrations bsc1160922. Fixed a local denial of service bsc1165548. Non-security issues fixed : Align supported subscription types with SCC bsc1168554. Fix migrations in...

SUSE SLED15 / SLES15 Security Update : rubygem-actionview-5_1 (SUSE-SU-2020:1178-1)

This update for rubygem-actionview-51 fixes the following issues : CVE-2020-5267: Fixed an XSS vulnerability in ActionView's JavaScript literal escape helpers bsc1167240. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1198-1)

This update for webkit2gtk3 fixes the following issues : Security issue fixed : CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to GdkFrameClock...

SUSE SLES15 Security Update : rpmlint (SUSE-SU-2020:1177-1)

This update for rpmlint fixes the following issues : whitelist certmonger bsc1169365, bsc1129452 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

SUSE SLES15 Security Update : slirp4netns (SUSE-SU-2020:1197-1)

This update for slirp4netns fixes the following issues : Security issue fixed : CVE-2020-1983: Fixed a use-after-free in ipreass bsc1170940. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLES15 Security Update : permissions (SUSE-SU-2020:1163-1)

This update for permissions fixes the following issues : Security issue fixed : CVE-2020-8013: Fixed a local privilege escalation with mrsh and wodim bsc1163922. Non-security issues fixed : Fixed regression where chkstat breaks without /proc available bsc1160764, bsc1160594 Fixed capability...

SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-1)

This update for LibVNCServer fixes the following issues : CVE-2019-15690: Fixed a heap buffer overflow bsc1160471. CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory bsc1155419. CVE-2019-20788: Fixed a integer overflow and heap-based buffer...

SUSE SLES15 Security Update : nginx (SUSE-SU-2020:1171-1)

This update for nginx fixes the following issues : nginx was updated to 1.16.1 jscECO-1401 Added TLS 1.3 support jscSLE-9295, bsc1150711 Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 jscSLE-11184, bsc1156202 Started nginx after network is online bsc1155690 CVE-2019-20372: Fixed an HTT...

CVE-2020-8018

A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux...

CVE-2020-8018 User owned /etc in SLES15-SP1-CHOST-BYOS

A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux...

CVE-2020-8018

CVE-2020-8018 affects SUSE Linux Enterprise Server 15 SP1: SLES15-SP1-CHOST-BYOS before 1.0.3 and SLES15-SP1-CAP-Deployment-BYOS before 1.0.1, where a /etc directory owned by UID 1000 enables local privilege escalation to root. This is a local vulnerability; exploitation details are not provided ...