openSUSE: 2020:0229-1 Moderate: Nextcloud Security Advisory

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour

on the file extension when checking file mimetypes (boo#1162766)

- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused

the server to send it's domain and user IDs to the Nextcloud Lookup

Server without any further data when the Lookup server is disabled

(boo#1162775)

- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group

admins to create users with IDs of system folders (boo#1162776)

- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of

previews and files when a file-drop share link is opened via the gallery

app (boo#1162781)

- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request

forgery allowed to detect local and remote services when adding a new

subscription in the calendar...