OPENSUSE-SU-2021:1255-1 Security update for nextcloud

This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo1190291 - CVE-2021-32766 CWE-209: Generation of Error Message Containing Sensitive Information - CVE-2021-32800 CWE-306: Missing Authentication for Critical Function - CVE-2021-32801 CWE-532: Insertion of Sensitive...

OPENSUSE-SU-2021:1252-1 Security update for nextcloud

This update for nextcloud fixes the following issues: Update to 20.0.12 Fixed security issues boo1190291: - CVE-2021-32766 CWE-209: Generation of Error Message Containing Sensitive Information - CVE-2021-32800 CWE-306: Missing Authentication for Critical Function - CVE-2021-32801 CWE-532: Inserti...

OPENSUSE-SU-2021:2975-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2021-40346: Fixed request smuggling vulnerability in HTX bsc1189877...

OPENSUSE-SU-2021:2662-1 Security update for grafana

This update for grafana fixes the following issues: - CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call bsc1183803 - Update to version 7.5.7: Updated relref to 'Configuring exemplars' section 34240 34243 Added exemplar topic 34147 34226 Quota: D...

OPENSUSE-SU-2021:1134-1 Security update for python-CairoSVG, python-Pillow

This update for python-CairoSVG, python-Pillow fixes the following issues: Update to version 2.5.1. Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service REDoS. If an attacker provided a malicious SVG, it...

OPENSUSE-SU-2021:1101-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.32.3: - CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory...

OPENSUSE-SU-2021:1073-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 91.0.4472.164 boo1188373 CVE-2021-30559: Out of bounds write in ANGLE CVE-2021-30541: Use after free in V8 CVE-2021-30560: Use after free in Blink XSLT CVE-2021-30561: Type Confusion in V8 CVE-2021-30562: Use after free in WebSerial...

OPENSUSE-SU-2021:2412-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. bsc1188282...

OPENSUSE-SU-2021:1785-1 Security update for postgresql13

This update for postgresql13 fixes the following issues: - Upgrade to version 13.3: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists bsc1185925. -...

OPENSUSE-SU-2021:2157-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: - CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding bsc1187212...

OPENSUSE-SU-2021:0893-1 Security update for htmldoc

This update for htmldoc fixes the following issues: htmldoc was updated to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpe...

OPENSUSE-SU-2021:0876-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20210608 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. INTEL-SA-00465 bsc1179833 See...

OPENSUSE-SU-2021:0476-1 Security update for openssl-1_1

This update for openssl-11 fixes the security issue: CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension but includes a signaturealgorithmscert...

OPENSUSE-SU-2021:0470-1 Security update for gnutls

This update for gnutls fixes the following issues: - CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences bsc1183456. - CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential...

OPENSUSE-SU-2021:0136-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash bsc1179103. - CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel bsc1179202. - CVE-2020-25665: Fixed a heap-based buffer overflow in...

OPENSUSE-SU-2021:0082-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - New upstream LTS version 10.23.1: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

OPENSUSE-SU-2021:0041-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.141 boo1180645 - CVE-2021-21106: Use after free in autofill - CVE-2021-21107: Use after free in drag and drop - CVE-2021-21108: Use after free in media - CVE-2021-21109: Use after free in payments - CVE-2021-21110: Use aft...

OPENSUSE-SU-2020:2310-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 bsc1179122 bsc1179451: - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code...

OPENSUSE-SU-2020:2304-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: -webkit2gtk3 was updated to version 2.30.3 bsc1179122 bsc1179451: - CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution. - CVE-2021-13584: Fixed a use after free which could have led to arbitrary code...

OPENSUSE-SU-2020:2264-1 Security update for gdm

This update for gdm fixes the following issues: - CVE-2020-16125: Fixed a privilege escalation bsc1178150. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:2016-1 Security update for chromium

This update for chromium fixes the following issues: Update to 86.0.4240.198 boo1178703 - CVE-2020-16013: Inappropriate implementation in V8 - CVE-2020-16017: Use after free in site isolation Update to 86.0.4240.193 boo1178630 - CVE-2020-16016: Inappropriate implementation in base. This update wa...

OPENSUSE-SU-2020:1993-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.6.5: - Solved potential bug of SCC repository URLs changing over time. RMT now self heals by removing the previous invalid repository and creating the correct one. - Add web server settings to /etc/rmt.conf: Now it's...

OPENSUSE-SU-2020:1952-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 72.0.3815.320 - CHR-8177 Update chromium on desktop-stable-86-3815 to 86.0.4240.183 - DNA-89748 ‘Manage Extensions’ dialog is displayed with preloaded extensions - DNA-89766 Address bar does not respond to actions - Th...

OPENSUSE-SU-2020:1930-1 Security update for u-boot

This update for u-boot fixes the following issues: CVE-2019-14192 bsc1143777, CVE-2019-14193 bsc1143817, CVE-2019-14199 bsc1143824, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827, CVE-2019-14202 bsc1143828, CVE-2019-14203 bsc1143830, CVE-2019-14204 bsc1143831,...

OPENSUSE-SU-2020:1831-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 86.0.4240.183 boo1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data...

OPENSUSE-SU-2020:1703-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2020-7069: Fixed an issue when AES-CCM mode was used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV was used bsc1177351. - CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to...

OPENSUSE-SU-2020:1517-1 Security update for jasper

This update for jasper fixes the following issues: - CVE-2016-9398: Improved patch for already fixed issue bsc1010979. - CVE-2016-9399: Fix assert in calcstepsizes bsc1010980. - CVE-2017-5499: Validate component depth bit bsc1020451. - CVE-2017-5503: Check bounds in jasseq2dbindsub bsc1020456. -...

OPENSUSE-SU-2020:1306-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to version 85.0.4183.83 boo1175757 fixing: - CVE-2020-6558: Insufficient policy enforcement in iOS - CVE-2020-6559: Use after free in presentation API - CVE-2020-6560: Insufficient policy enforcement in autofill -...

OPENSUSE-SU-2020:1214-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 boo1175085 CVE-2020-6542: Use after free in ANGLE CVE-2020-6543: Use after free in task scheduling CVE-2020-6544: Use after free in media CVE-2020-6545: Use after free in audio CVE-2020-6546: Inappropriate...

OPENSUSE-SU-2020:1182-1 Security update for libX11

This update for libX11 fixes the following issues: - Fixed XIM client heap overflows CVE-2020-14344, bsc1174628. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2020:0939-1 Security update for chocolate-doom

This update for chocolate-doom to version 3.0.1 fixes the following issues: - CVE-2020-14983: Fixed a stack-based buffer overflow in the networking code boo1173595...

OPENSUSE-SU-2020:0676-1 Security update for autoyast2

This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands bsc1140711. Non-security issue fixed: - Fix desktop files updating some icons and groups bsc1168123. - Restored some...

OPENSUSE-SU-2020:0635-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 68.0.3618.63 - CHR-7889 Update chromium on desktop-stable-81-3618 to 81.0.4044.122 - CHR-7896 Update chromium on desktop-stable-81-3618 to 81.0.4044.129 - DNA-85287 Set standard spacing for Yandex prompt - DNA-85416 Ma...

OPENSUSE-SU-2020:0242-1 Security update for inn

This update for inn fixes the following issues: - CVE-2019-3692: Fixed a local privilage escalation from user to 'news' bsc1154302. This update was imported from the openSUSE:Leap:15.1:Update update project...

OPENSUSE-SU-2020:0003-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 68.3esr MFSA 2019-38 bsc1158328 Security issues fixed: - CVE-2019-17008: Fixed a use-after-free in worker destruction bmo1546331 - CVE-2019-13722: Fixed a stack corruption due to incorrect number of...

OPENSUSE-SU-2019:2664-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 65.0.3467.62 - CHR-7658 Update chromium on desktop-stable-78-3467 to 78.0.3904.108 - DNA-81387 Remove support for old bundle structure in signing scripts - DNA-81675 Update widevine signature localisation in signed...

OPENSUSE-SU-2019:2507-1 Security update for the Linux Kernel

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. bsc1135966 -...

OPENSUSE-SU-2019:2505-1 Security update for qemu

This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE15 - Fix use-after-free in slirp CVE-2018-20126 bsc1119991 - Fix potential DOS in lsi scsi controller emulation CVE-2019-12068 bsc1146873 - Expose taa-no 'feature',...

OPENSUSE-SU-2019:2457-1 Security update for php7

This update for php7 fixes the following issues: Security issue fixed: - CVE-2019-11043: Fixed possible remote code execution via envpathinfo underflow in fpmmain.c bsc1154999. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2019:2175-1 Security update for util-linux and shadow

This update for util-linux and shadow fixes the following issues: util-linux: - Fixed an issue where PATH settings in /etc/default/su being ignored bsc1121197 - Prevent outdated pam files bsc1082293. - Do not trim read-only volumes bsc1106214. - Integrate pamkeyinit pam module to login bsc1081947...

OPENSUSE-SU-2019:1858-1 Security update for ansible

This update for ansible fixes the following issues: Ansible was updated to version 2.8.1: Full changelog is at /usr/share/doc/packages/ansible/changelogs/ - Bugfixes - ACI - DO not encode querystring - ACI modules - Fix non-signature authentication - Add missing directory provided via...

OPENSUSE-SU-2019:1836-1 Security update for proftpd

This update for proftpd fixes the following issues: Security issues fixed: - CVE-2019-12815: Fixed arbitrary file copy in modcopy that allowed for remote code execution and information disclosure without authentication bnc1142281...

OPENSUSE-SU-2019:1403-1 Security update for xen

This update for xen fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling MFBDS -...

OPENSUSE-SU-2019:1237-1 Security update for tar

This update for tar fixes the following issues: Security issues fixed: - CVE-2019-9923: Fixed a denial of service while parsing certain archives with malformed extended headers in paxdecodeheader bsc1130496. - CVE-2018-20482: Fixed a denial of service when the '--sparse' option mishandles file...

OPENSUSE-SU-2019:1209-1 Security update for apache2

This update for apache2 fixes the following issues: CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged child processes or threads to execute arbitrary code with the privileges of the parent process. Attackers with control over CGI scripts or extension modules run by the serve...

OPENSUSE-SU-2019:1161-1 Security update for tiff

This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-19210: Fixed a NULL pointer dereference in TIFFWriteDirectorySec function bsc1115717. - CVE-2018-17000: Fixed a NULL pointer dereference in the TIFFmemcmp function bsc1108606. - CVE-2019-6128: Fixed a memory leak i...

OPENSUSE-SU-2019:1121-1 Security update for ghostscript

This update for ghostscript fixes the following issue: Security issue fixed: - CVE-2019-3838: Fixed a vulnerability which made forceput operator in DefineResource to be still accessible which could allow access to file system outside of the constraints of -dSAFER bsc1129186. This update was...

OPENSUSE-SU-2019:0307-1 Security update for openssh

This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers bsc1121816 -...

OPENSUSE-SU-2019:0174-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP bsc1123378. - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message...

OPENSUSE-SU-2018:4175-1 Security update for pdns

This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer bsc1114157. - CVE-2018-14626: Fixed packet cache pollution via crafted query bsc1114169. This update was imported from the...