OPENSUSE-SU-2020:2106-1 Security update for buildah

This update for buildah fixes the following issues: buildah was updated to v1.17.0 bsc1165184: Handle cases where other tools mount/unmount containers overlay.MountReadOnly: support RO overlay mounts overlay: use fusermount for rootless umounts overlay: fix umount Switch default log level of...

OPENSUSE-SU-2020:2098-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: - Updated Intel CPU Microcode to 20201118 official release. bsc1178971 - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL...

OPENSUSE-SU-2020:2092-1 Security update for c-ares

This update for c-ares fixes the following issues: Version update to 1.17.0 CVE-2020-8277: Fixed a Denial of Service through DNS request bsc1178882 For further details see https://c-ares.haxx.se/changelog.html This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:2055-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.66 boo1178923 - Wayland support by default - CVE-2020-16018: Use after free in payments. - CVE-2020-16019: Inappropriate implementation in filesystem. - CVE-2020-16020: Inappropriate implementation in cryptohome. -...

OPENSUSE-SU-2020:2019-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - Upgrade to version 10.15: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...

OPENSUSE-SU-2020:1990-1 Security update for SDL

This update for SDL fixes the following issues: Security issue fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDLblitN.c when called from SDLSoftBlit bsc1141844. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:1906-1 Security update for the Linux Kernel

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-25704: Fixed a memory leak in perfeventparseaddrfilter bsc1178393. - CVE-2020-25668: Make FONTX ioctl use the tty pointer they were actually passed bsc1178123. -...

OPENSUSE-SU-2020:1888-1 Security update for otrs

This update for otrs fixes the following issues: - otrs was updated to 6.0.30 OSA-2020-14 boo1178434 - CVE-2020-11022, CVE-2020-11023: Vulnerability in third-party library - jquery OTRS uses jquery version 3.4.1, which is vulnerable to cross-site scripting XSS...

OPENSUSE-SU-2020:1819-1 Security update for samba

This update for samba fixes the following issues: Update to samba 4.11.14 - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records bsc1177613. - CVE-2020-14323: Unprivileged user can crash winbind bsc1173994. - CVE-2020-14318: Missing permissions check in...

OPENSUSE-SU-2020:1674-1 Security update for icingaweb2

This update for icingaweb2 fixes the following issues: - icingaweb2 was updated to 2.7.4 CVE-2020-24368: Fixed a path Traversal which could have allowed an attacker to access arbitrary files which are readable by the process running boo1175530...

OPENSUSE-SU-2020:1536-1 Security update for rubygem-actionpack-5_1

This update for rubygem-actionpack-51 fixes the following issues: - CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack. There is a strong parameters bypass vector in ActionPack. bsc1172177 This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:1523-1 Security update for jasper

This update for jasper fixes the following issues: - CVE-2016-9398: Improved patch for already fixed issue bsc1010979. - CVE-2016-9399: Fix assert in calcstepsizes bsc1010980. - CVE-2017-5499: Validate component depth bit bsc1020451. - CVE-2017-5503: Check bounds in jasseq2dbindsub bsc1020456. -...

OPENSUSE-SU-2020:1454-1 Security update for libetpan

This update for libetpan fixes the following issues: Update to 1.9.4 boo1174579, CVE-2020-15953: Bugfixes on QUOTA Varios warning fixes & build fixes Update to version 1.9.3 Added IMAP CLIENTID / SMTP CLIENTID support Use Cyrus SASL 2.1.27 Update to version 1.9.2 Support of TLS SNI LMDB for cache...

OPENSUSE-SU-2020:1423-1 Security update for python-Flask-Cors

This update for python-Flask-Cors fixes the following issues: - CVE-2020-25032: fix a relative directory traversal vulnerability bsc1175986. This update was imported from the openSUSE:Leap:15.2:Update update project...

OPENSUSE-SU-2020:1345-1 Security update for curl

This update for curl fixes the following issues: - An application that performs multiple requests with libcurl's multi API and sets the 'CURLOPTCONNECTONLY' option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl will pick and use the...

OPENSUSE-SU-2020:1188-1 Security update for wireshark

This update for wireshark fixes the following issues: - Wireshark to 3.2.5: CVE-2020-15466: GVCP dissector infinite loop bsc1173606 CVE-2020-13164: NFS dissector crash bsc1171899 CVE-2020-11647: The BACapp dissector could crash bsc1169063 - Further features, bug fixes and updated protocol support...

OPENSUSE-SU-2020:1169-1 Security update for grub2

This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 bsc1168994 - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 - Fix for CVE-2020-15706 bsc1174463 - Fix for CVE-2020-15707 bsc1174570 - Use overflow checking primitives where the arithmetic...

OPENSUSE-SU-2020:1162-1 Security update for libX11

This update for libX11 fixes the following issues: - Fixed XIM client heap overflows CVE-2020-14344, bsc1174628 This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:1155-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.1.0 ESR Fixed: Various stability, functionality, and security fixes bsc1174538 CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker CVE-2020-6514: WebRTC data channel...

OPENSUSE-SU-2020:1154-1 Security update of chromium

Chromium was updated to 84.0.4147.105 boo1174582: CVE-2020-6537: Type Confusion in V8 CVE-2020-6538: Inappropriate implementation in WebView CVE-2020-6532: Use after free in SCTP CVE-2020-6539: Use after free in CSS CVE-2020-6540: Heap buffer overflow in Skia CVE-2020-6541: Use after free in WebU...

OPENSUSE-SU-2020:1105-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: dracut-saltboot: - Print a list of available disk devices bsc1170824 - Install wipefs to initrd - Force install crypt modules golang-github-prometheus-prometheus: - Update change log and spec file + Modified spec file: default to golang 1.14 to avoid 'have...

OPENSUSE-SU-2020:0953-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

OPENSUSE-SU-2020:0911-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2020-8022: Fixed a local root exploit due to improper permissions bsc1172405 This update was imported from the SUSE:SLE-15-SP1:Update update project...

OPENSUSE-SU-2020:0854-1 Security update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53 - CVE-2020-12399: Fixed a timing attack on DSA signature generation bsc1171978. - CVE-2019-17006: Added length checks for cryptographic primitives bsc1159819. Release notes:...

OPENSUSE-SU-2020:0819-1 Security update for varnish

This update for varnish fixes the following issues: - CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection boo1169040 - CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS...

OPENSUSE-SU-2020:0711-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.htmlTomcat9.0.35markt CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the conten...

OPENSUSE-SU-2020:0654-1 Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues: cacti-spine and cacti were updated to 1.2.12: cacti fixes: CVE-2020-7106: Lack of escaping of color items can lead to XSS exposure boo1163749 Fix multiple graphing bugs and web UI issues Fix multiple warnings, PHP Exceptions and error...

OPENSUSE-SU-2020:0553-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. - CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. - Fixed an issue in TLS-EAP where the OCSP verification, when an...

OPENSUSE-SU-2020:0542-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

OPENSUSE-SU-2020:0510-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2020-1730: Fixed a possible denial of service when using AES-CTR bsc1168699. This update was imported from the SUSE:SLE-15-SP1:Update update project...

OPENSUSE-SU-2020:0501-1 Security update for gmp, gnutls, libnettle

This update for gmp, gnutls, libnettle fixes the following issues: Security issue fixed: - CVE-2020-11501: Fixed zero random value in DTLS client hello bsc1168345 FIPS related bugfixes: - FIPS: Install checksums for binary integrity verification which are required when running in FIPS mode...

OPENSUSE-SU-2020:0430-1 Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues: python-mysql-connector-python was updated to 8.0.19 boo1122204 - CVE-2019-2435: - WL13531: Remove xplugin namespace - WL13372: DNS SRV support - WL12738: Specify TLS ciphers to be used by a client or session - BUG30270760:...

OPENSUSE-SU-2020:0376-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: - CVE-2019-20479: Fixed an open redirect issue in URLs with slash and backslash bsc1164459. This update was imported from the SUSE:SLE-15-SP1:Update update project...

OPENSUSE-SU-2020:0301-1 Security update for openfortivpn

This update for openfortivpn to version 1.12.0 fixes the following issues: - CVE-2020-7043: Fixed a TLS Certificate CommonName NULL Byte Vulnerability boo1165301. - CVE-2020-7042: Fixed use of uninitialized memory in X509checkhost boo1165300. - CVE-2020-7041: Fixed incorrect use of X509checkhost...

OPENSUSE-SU-2020:0233-1 Security update for chromium, re2

This update for chromium, re2 fixes the following issues: - Update to 80.0.3987.87 boo1162833: CVE-2020-6381: Integer overflow in JavaScript CVE-2020-6382: Type Confusion in JavaScript CVE-2019-18197: Multiple vulnerabilities in XML CVE-2019-19926: Inappropriate implementation in SQLite...

OPENSUSE-SU-2020:0204-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2019-20372: Fixed an HTTP request smuggling with certain errorpage configurations which could have allowed unauthorized web page reads bsc1160682. This update was imported from the SUSE:SLE-15-SP1:Update update project...

OPENSUSE-SU-2020:0189-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to version 80.0.3987.87 boo1162833. Security issues fixed: - CVE-2020-6381: Integer overflow in JavaScript boo1162833. - CVE-2020-6382: Type Confusion in JavaScript boo1162833. - CVE-2019-18197: Multiple vulnerabilities in...

OPENSUSE-SU-2020:0123-1 Security update for git

This update for git fixes the following issues: Security issues fixed: - CVE-2019-1349: Fixed issue on Windows, when submodules are cloned recursively, under certain circumstances Git could be fooled into using the same Git directory twice bsc1158787. - CVE-2019-19604: Fixed a recursive clone...

OPENSUSE-SU-2020:0095-1 Security update for libredwg

This update for libredwg fixes the following issues: libredwg was updated to release 0.9.3: Added the -x,--extnames option to dwglayers for r13-r14 DWGs. Fixed some leaks: SORTENTSTABLE, PROXYENTITY.ownerhandle for r13. Add DICTIONARY.itemhandles for r13 and r14. Fixed some dwglayers null pointer...

OPENSUSE-SU-2020:0086-1 Security update for python3

This update for python3 to version 3.6.10 fixes the following issues: - CVE-2017-18207: Fixed a denial of service in Waveread.readfmtchunk bsc1083507. - CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ bsc1149955. - CVE-2019-15903: Fixed a heap-based buffer over-read i...

OPENSUSE-SU-2019:2613-1 Security update for libidn2

This update for libidn2 to version 2.2.0 fixes the following issues: - CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels bsc1154884. - CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings bsc1154887. This update was import...

OPENSUSE-SU-2019:2597-1 Security update for clamav

This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458...

OPENSUSE-SU-2019:2593-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

OPENSUSE-SU-2019:2555-1 Security update for haproxy

This update for haproxy to version 2.0.5+git0.d905f49a fixes the following issues: Security issue fixed: - CVE-2019-14241: Fixed a cookie memory corruption problem. bsc1142529 The update to 2.0.5 brings lots of features and bugfixes: - new internal native HTTP representation called HTX, was alrea...

OPENSUSE-SU-2019:2505-1 Security update for qemu

This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE15 - Fix use-after-free in slirp CVE-2018-20126 bsc1119991 - Fix potential DOS in lsi scsi controller emulation CVE-2019-12068 bsc1146873 - Expose taa-no 'feature',...

OPENSUSE-SU-2019:2500-1 Security update for rsyslog

This update for rsyslog fixes the following issues: Security issues fixed: - CVE-2019-17041: Fixed a heap overflow in the parser for AIX log messages bsc1153451. - CVE-2019-17042: Fixed a heap overflow in the parser for Cisco log messages bsc1153459. Other issue addressed: - Fixed an issue where...

OPENSUSE-SU-2019:2493-1 Security update for gdb

This update for gdb fixes the following issues: Update to gdb 8.3.1: jscECO-368 Security issues fixed: - CVE-2019-1010180: Fixed a potential buffer overflow when loading ELF sections larger than the file. bsc1142772 Upgrade libipt from v2.0 to v2.0.1. - Enable librpm for version librpm.so.3...

OPENSUSE-SU-2019:2458-1 Security update for samba

This update for samba fixes the following issues: Security issues fixed: - CVE-2019-14847: User with 'get changes' permission can crash AD DC LDAP server via dirsync bsc1154598. - CVE-2019-10218: Client code can return filenames containing path separators bsc1144902. - CVE-2019-14833: Fixed Accen...

OPENSUSE-SU-2019:2442-1 Security update for samba

This update for provides the following fixes: Following security issues were fixed: - CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync bsc1154598. - CVE-2019-10218: Client code could have returned filenames containing path separators bsc1144902. ...

OPENSUSE-SU-2019:2434-1 Security update for docker-runc

This update for docker-runc fixes the following issues: - CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. bsc1152308 This update was imported from the SUSE:SLE-15:Update update project...