SUSE SLES15 Security Update : runc (SUSE-SU-2020:0944-1)

This update for runc fixes the following issues : runc was updated to v1.0.0rc10 CVE-2019-19921: Fixed a mount race condition with shared mounts bsc1160452. Fixed an issue where podman run hangs when spawned by salt-minion process bsc1149954. Note that Tenable Network Security has extracted the...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:0929-1)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox 68.6.1esr MFSA 2020-11 bsc1168630 - CVE-2020-6819 bmo1620818 Use-after-free while running the nsDocShell destructor - CVE-2020-6820 bmo1626728 Use-after-free when handling a ReadableStream Note that Tenable Network Securi...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:0930-1)

This update for ceph fixes the following issues : CVE-2020-1759: Fixed once reuse in msgr V2 secure mode bsc1166403 CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting bsc1166484. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED15 / SLES15 Security Update : exiv2 (SUSE-SU-2020:0921-1)

This update for exiv2 fixes the following issues : exiv2 was updated to latest 0.26 branch, fixing bugs and security issues : CVE-2017-1000126: Fixed an out of bounds read in webp parser bsc1068873. CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function bsc1040973...

SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2020:0918-1)

This update for bluez fixes the following issues : CVE-2020-0556: Fixed an improper access control which could have allowed an unauthenticated user to potentially enable escalation of privilege and denial of service bsc1166751. Note that Tenable Network Security has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : icu (SUSE-SU-2020:0819-1)

This update for icu fixes the following issues : CVE-2020-10531: Fixed a potential integer overflow in UnicodeString:doAppend bsc1166844. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...

SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2020:0811-1)

This update for spamassassin fixes the following issues : Security issues fixed : CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to isregexpvalid bsc1118987. CVE-2020-1930: Fixed an issue with rule configuration .cf files which can be configured to run system command...

SUSE SLES15 Security Update : spamassassin (SUSE-SU-2020:0813-1)

This update for spamassassin fixes the following issues : Security issues fixed : CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to isregexpvalid bsc1118987. CVE-2020-1930: Fixed an issue with rule configuration .cf files which can be configured to run system command...

SUSE SLED15 / SLES15 Security Update : ldns (SUSE-SU-2020:0801-1)

This update for ldns fixes the following issues : CVE-2017-1000231: Fixed a buffer overflow during token parsing bsc1068711. CVE-2017-1000232: Fixed a double-free vulnerability in str2host.c bsc1068709. Note that Tenable Network Security has extracted the preceding description block directly from...

SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2020:0751-1)

This update for cloud-init fixes the following security issues : CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. Note that Tenable Network Security has...

SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2020:0752-1)

This update for postgresql10 fixes the following issues : PostgreSQL was updated to version 10.12. Security issue fixed : CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension bsc1163985. Note that Tenable Network Security has extracted the preceding description...

SUSE SLED15 / SLES15 Security Update : strongswan (SUSE-SU-2020:0743-1)

This update for strongswan fixes the following issues : Strongswan was updated to version 5.8.2 jscSLE-11370. Security issue fixed : CVE-2018-6459: Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation bsc1079548. Full changelogs ...

SUSE SLED15 / SLES15 Security Update : Recommended update for ruby2.5 (SUSE-SU-2020:0737-1)

This update for ruby2.5 toversion 2.5.7 fixes the following issues : ruby 2.5 was updated to version 2.5.7 CVE-2020-8130: Fixed a command injection in intree copy of rake bsc1164804. CVE-2019-16255: Fixed a code injection vulnerability of Shell and Shelltest bsc1152990. CVE-2019-16254: Fixed am...

SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2020:0722-1)

This update for nghttp2 fixes the following issues : nghttp2 was update to version 1.40.0 bsc1166481 lib: Add nghttp2checkauthority as public API lib: Fix the bug that stream is closed with wrong error code lib: Faster huffman encoding and decoding build: Avoid filename collision of static and...

SUSE SLES15 Security Update : skopeo (SUSE-SU-2020:0712-1)

This update for skopeo fixes the following issues : Update to skopeo v0.1.41 bsc1165715 : Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 Bump github.com/containers/common from 0.0.7 to 0.1.4 Remove the reference to openshift/api vendor...

SUSE SLES15 Security Update : cni, cni-plugins, conmon, fuse-overlayfs, podman (SUSE-SU-2020:0697-1)

This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues : podman was updated to 1.8.0 : CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 The...

SUSE SLES15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2020:0705-1)

This update for apache2-modauthopenidc fixes the following issues : CVE-2019-20479: Fixed an open redirect issue in URLs with slash and backslash bsc1164459. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED15 / SLES15 Security Update : wireshark (SUSE-SU-2020:0693-1)

This update for wireshark and libmaxminddb fixes the following issues : Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support bsc1156288. New features include : Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC Improve...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:0684-1)

This update for salt fixes the following issues : Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 Fix unit tests failures in testbatchasync tests Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2020:0668-1)

This update for glibc fixes the following issues : CVE-2020-10029: Fixed a potential overflow in on-stack buffer during range reduction bsc1165784. Fixed an issue where pthread were not always locked correctly bsc1164505. Document mprotect and introduce section on memory protection bsc1163184. No...