SUSE-SU-2020:2776-1 Security update for go1.15

go1.15 released 2020-08-11 Go 1.15 is a major release of Go. go1.15.x minor releases will be provided through August 2021. https://github.com/golang/go/wiki/Go-Release-Cycle Most changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1...

SUSE-SU-2020:2686-1 Security update for rubygem-actionview-4_2

This update for rubygem-actionview-42 fixes the following issues: - CVE-2020-15169: Fix cross-site scripting in translation helpers bsc1176421...

SUSE-SU-2020:2673-1 Security update for samba

This update for samba to version 4.10.17 fixes the following issues: - Fixed net command unable to negotiate SMB2; bsc1174120; - Update to 4.10.17 - CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each; bso14378; bsc1173160. - CVE-2020-10730: NULL de-referenc...

SUSE-SU-2020:14490-1 Security update for shim

This update for shim fixes the following issues: Update to the unified shim binary from SUSE Linux Enterprise 15-SP1 bsc1168994 This update addresses the 'BootHole' security issue master CVE CVE-2020-10713, by disallowing binaries signed by the previous SUSE UEFI signing key from booting. This...

SUSE-SU-2020:2629-1 Security update for shim

This update for shim fixes the following issues: This update addresses the 'BootHole' security issue master CVE CVE-2020-10713, by disallowing binaries signed by the previous SUSE UEFI signing key from booting. This update should only be installed after updates of grub2, the Linux kernel and if...

SUSE-SU-2020:2576-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 kernel was updated to to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-14314: Fixed a potential negative array index in dosplit bsc1173798. - CVE-2020-14331: Fixed a missing check in vgacon scrollback handling bsc1174205...

SUSE-SU-2020:2552-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird was updated to 68.12 bsc1175686 - CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege - CVE-2020-15664: Attacker-induced prompt for extension...

SUSE-SU-2020:2524-1 Security update for the Linux Kernel (Live Patch 18 for SLE 15)

This update for the Linux Kernel 4.12.14-15052 fixes several issues. The following security issues were fixed: - CVE-2020-14331: Fixed a buffer over-write in vgaconscroll bsc1174247. - CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs bsc1174186. -...

SUSE-SU-2020:2487-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may have allowed an...

SUSE-SU-2020:2453-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: - Update to Java 8.0 Service Refresh 6 Fix Pack 15 bsc1175259, bsc1174157 CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639 Class Libraries: -...

SUSE-SU-2020:2408-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel bsc1174321...

SUSE-SU-2020:2346-1 Security update for graphviz

This update for graphviz fixes the following issues: - CVE-2018-10196: Fixed a null dereference in rebuildvlis bsc1093447...

SUSE-SU-2020:2238-1 Security update for perl-PlRPC

This update for perl-PlRPC fixes the following issues: - Security notice: bsc858243, CVE-2013-7284 Document security vulnerability on Storable and reply attack - Add perl-PlRPC-CVE-2013-7284.patch...

SUSE-SU-2020:2234-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf usages - bsc1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOPcopy - bsc1168140 - CVE-2020-11740, CVE-2020-11741: Multipl...

SUSE-SU-2020:2197-1 Security update for libX11

This update for libX11 fixes the following issues: - Fixed XIM client heap overflows CVE-2020-14344, bsc1174628...

SUSE-SU-2020:2156-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may have allowed an...

SUSE-SU-2020:2144-1 Security update for wireshark

This update for wireshark fixes the following issues: - Wireshark to 3.2.5: CVE-2020-15466: GVCP dissector infinite loop bsc1173606 CVE-2020-13164: NFS dissector crash bsc1171899 CVE-2020-11647: The BACapp dissector could crash bsc1169063 - Further features, bug fixes and updated protocol support...

SUSE-SU-2020:2140-1 Security update for rubygem-actionview-4_2

This update for rubygem-actionview-42 fixes the following issues: - Fixed a potential remote code execution of user-provided local names bsc1173144, CVE-2020-8163...

SUSE-SU-2020:2079-1 Security update for grub2

This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 bsc1168994 - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 - Fix for CVE-2020-15706 bsc1174463 - Fix for CVE-2020-15707 bsc1174570 - Use overflow checking primitives where the arithmetic...

SUSE-SU-2020:2065-1 Security update for samba

This update for samba fixes the following issues: - CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU bsc1173160...

SUSE-SU-2020:2032-1 Security update for freerdp

This update for freerdp fixes the following issues: frerdp was updated to version 2.1.2 bsc1171441,bsc1173247 and jscECO-2006: - CVE-2020-11017: Fixed a double free which could have denied the server's service. - CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have...

SUSE-SU-2020:1990-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.28.3 bsc1173998: + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

SUSE-SU-2020:1971-1 Security update for Salt

This update fixes the following issues: salt: - Fix for TypeError in Tornado importer bsc1174165 - Require python3-distro only for TW bsc1173072 - Various virt backports from 3000.2 - Avoid traceback on debug logging for swarm module bsc1172075 - Add publishbatch to ClearFuncs exposed methods -...

SUSE-SU-2020:1582-2 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issue: - CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution bsc1143436...

SUSE-SU-2020:1887-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation...

SUSE-SU-2020:1886-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15567: Fixed non-atomic modification of live EPT PTE bsc1173380...

SUSE-SU-2019:3033-2 Security update for djvulibre

This update for djvulibre fixes the following issues: Security issue fixed: - CVE-2019-18804: Fixed a null pointer dereference bsc1156188. Other issue addressed: - Fixed a crash when mmx was enabled bsc1154401...

SUSE-SU-2020:1686-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version jdk8u252 fixes the following issues: - CVE-2020-2754: Forward references to Nashorn bsc1169511 - CVE-2020-2755: Improve Nashorn matching bsc1169511 - CVE-2020-2756: Better mapping of serial ENUMs bsc1169511 - CVE-2020-2757: Less Blocking Array Queues...

SUSE-SU-2020:1684-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: java-180-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 bsc1172277,bsc1169511,bsc1160968 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2754:...

SUSE-SU-2020:14391-1 Security update for java-1_7_0-ibm

This update for java-170-ibm fixes the following issues: java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 bsc1172277 and bsc1169511 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2756: Improved...

SUSE-SU-2020:1526-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code bsc1166240. - CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation bsc1146873. - CVE-2020-1983: Fixed a use-after-free in the ipreas...

SUSE-SU-2020:1498-1 Security update for tomcat

This update for tomcat fixes the following issues: CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a...

SUSE-SU-2020:1497-1 Security update for tomcat

This update for tomcat fixes the following issues: CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered a...

SUSE-SU-2020:1452-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19740 fixes several issues. The following security issues were fixed: - CVE-2020-12653: Fixed a buffer overflow in mwifiexcmdappendvsietlv which could have allowed local users to gain privileges or cause a denial of service bsc1171254. - CVE-2020-12654:...

SUSE-SU-2020:14375-1 Security update for tomcat6

This update for tomcat6 fixes the following issues: CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the contents and name of a file on a server configured to use the PersistenceManager, then the attacker could have triggered ...

SUSE-SU-2020:1364-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.35. See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.htmlTomcat9.0.35markt CVE-2020-9484 bsc1171928 Apache Tomcat Remote Code Execution via session persistence If an attacker was able to control the conten...

SUSE-RU-2020:1342-1 Recommended update for python3

This update for python3 fixes the following issues: - Changed the name of idle3 icons to idle3.png to avoid collision with Python 2 version bsc1165894...

SUSE-SU-2020:1190-1 Security update for ardana-ansible, ardana-barbican, ardana-cluster, ardana-db, ardana-designate, ardana-input-model, ardana-logging, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, memcached, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-ironic, openstack-ironic-image, openstack-manila, openstack-neutron, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, python-cinderclient, python-glanceclient, python-ironic-lib, python-ironicclient, python-keystonemiddleware, python-manila-tempest-plugin, python-novaclient, python-octaviaclient, python-openstackclient, python-os-brick, python-oslo.config, python-oslo.rootwrap, python-oslo.utils, python-swiftclient, python-watcherclient, release-notes-suse-openstack-cloud, rubygem-crowbar-client, rubygem-puma, zookeeper

This update for ardana-ansible, ardana-barbican, ardana-cluster, ardana-db, ardana-designate, ardana-input-model, ardana-logging, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, memcached,...

SUSE-SU-2020:1144-1 Security update for munge

This update for munge to 0.5.14 fixes the following issues: Security issue fixed: - CVE-2019-3691: Fixed a local privilege escalation during update bsc1155075 Non-security issue fixed: - Add Provides for 'munge-libs' to package libmunge bsc1160075...

SUSE-SU-2020:1087-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a...

SUSE-SU-2020:0991-1 Security update for git

This update for git fixes the following issues: - CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host bsc1168930...

SUSE-SU-2020:0891-1 Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19734 fixes one issue. The following security issue was fixed: - CVE-2020-1749: Fixed an issue in the networking protocols in encrypted IPsec tunnel bsc1165631...

SUSE-SU-2020:0854-1 Security update for python3

This update for python3 fixes the following issue: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen. Now an InvalidURL exception is raised bsc1155094. - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492...

SUSE-SU-2020:0843-1 Security update for memcached

This update for memcached fixes the following issues: Security issue fixed: - CVE-2019-11596: Fixed a NULL pointer dereference in processlrucommand bsc1133817. - CVE-2019-15026: Fixed a stack-based buffer over-read bsc1149110...

SUSE-SU-2020:0836-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-8647: Fixed a use-after-free in the vcdoresize function in drivers/tty/vt/vt.c bsc1162929. - CVE-2020-8649: Fixed a use-after-free in the...

SUSE-SU-2020:0762-1 Security Beta update for Salt

This update fixes the following issues: salt: - Requiring python3-distro only for openSUSE/SLE = 15 - Use full option name instead of undocumented abbreviation for zypper - Python-distro is only needed for Python 3.7. Removing it for Python 2 - Fixed a local privilege escalation to root bsc115746...

SUSE-SU-2020:0699-1 Security update for ovmf

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. - CVE-2019-14559: Fixe...

SUSE-SU-2020:0661-1 Security update for squid

This update for squid fixes the following issues: - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway bsc1162689. - CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326. - CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in...

SUSE-SU-2020:0642-1 Security update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-db, ardana-horizon, ardana-input-model, ardana-monasca, ardana-mq, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-designate, openstack-heat, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-ironic-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-octavia-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-monasca-agent, openstack-neutron, openstack-neutron-fwaas, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-sahara, openstack-swift, python-amqp, python-ironic-lib, python-keystoneauth1, python-keystoneclient, python-keystonemiddleware, python-ovs, supportutils-plugin-suse-openstack-cloud, rubygem-crowbar-client, rubygem-puma, venv-openstack-horizon

This update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-db, ardana-horizon, ardana-input-model, ardana-monasca, ardana-mq, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, openstack-barbica...

SUSE-SU-2020:0594-1 Security update for gd

This update for gd fixes the following issues: Security issue fixed: - CVE-2018-14553: Fixed a null pointer dereference in gdImageClone bsc1165471. - CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm bsc1140120...