SUSE Security Update: Security update for u-boot
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3283-1
Rating:             important
References:         #1098447 #1098649 #1134157 #1134853 #1143463 
                    #1143777 #1143817 #1143818 #1143819 #1143820 
                    #1143821 #1143823 #1143824 #1143825 #1143827 
                    #1143828 #1143830 #1143831 #1162198 #1167209 
                    
Cross-References:   CVE-2019-11059 CVE-2019-11690 CVE-2019-13103
                    CVE-2019-14192 CVE-2019-14193 CVE-2019-14194
                    CVE-2019-14195 CVE-2019-14196 CVE-2019-14197
                    CVE-2019-14198 CVE-2019-14199 CVE-2019-14200
                    CVE-2019-14201 CVE-2019-14202 CVE-2019-14203
                    CVE-2019-14204 CVE-2020-10648 CVE-2020-8432
                   
Affected Products:
                    SUSE Linux Enterprise Server for SAP 15
                    SUSE Linux Enterprise Server 15-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________

   An update that solves 18 vulnerabilities and has two fixes
   is now available.

Description:

   This update for u-boot fixes the following issues:

   - Fix network boot on Raspberry Pi 3 B+ (bsc#1098649)
   - Fix GOP pixel format (bsc#1098447)
   - Fix SD writes on Raspberry Pi
   - Enable a few more armv7 boards to boot with EFI
   - Fix potentially miscompiled runtime service calls

   Fix CVE-2019-14192 (bsc#1143777), CVE-2019-14193 (bsc#1143817),
   CVE-2019-14199 (bsc#1143824), CVE-2019-14197 (bsc#1143821), CVE-2019-14200
   (bsc#1143825), CVE-2019-14201 (bsc#1143827), CVE-2019-14202 (bsc#1143828),
   CVE-2019-14203 (bsc#1143830), CVE-2019-14204 (bsc#1143831), CVE-2019-14194
   (bsc#1143818), CVE-2019-14198 (bsc#1143823), CVE-2019-14195 (bsc#1143819),
   CVE-2019-14196 (bsc#1143820), CVE-2019-13103 (bsc#1143463), CVE-2020-8432
   (bsc#1162198), CVE-2019-11059 (bsc#1134853), CVE-2019-11690 (bsc#1134157)
   and CVE-2020-10648 (bsc#1167209)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server for SAP 15:

      zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-3283=1

   - SUSE Linux Enterprise Server 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-SLES-15-2020-3283=1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3283=1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3283=1



Package List:

   - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):

      u-boot-tools-2018.03-4.6.1
      u-boot-tools-debuginfo-2018.03-4.6.1

   - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):

      u-boot-tools-2018.03-4.6.1
      u-boot-tools-debuginfo-2018.03-4.6.1

   - SUSE Linux Enterprise Server 15-LTSS (aarch64):

      u-boot-rpi3-2018.03-4.6.2

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):

      u-boot-tools-2018.03-4.6.1
      u-boot-tools-debuginfo-2018.03-4.6.1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64):

      u-boot-rpi3-2018.03-4.6.2

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):

      u-boot-tools-2018.03-4.6.1
      u-boot-tools-debuginfo-2018.03-4.6.1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64):

      u-boot-rpi3-2018.03-4.6.2


References:

   https://www.suse.com/security/cve/CVE-2019-11059.html
   https://www.suse.com/security/cve/CVE-2019-11690.html
   https://www.suse.com/security/cve/CVE-2019-13103.html
   https://www.suse.com/security/cve/CVE-2019-14192.html
   https://www.suse.com/security/cve/CVE-2019-14193.html
   https://www.suse.com/security/cve/CVE-2019-14194.html
   https://www.suse.com/security/cve/CVE-2019-14195.html
   https://www.suse.com/security/cve/CVE-2019-14196.html
   https://www.suse.com/security/cve/CVE-2019-14197.html
   https://www.suse.com/security/cve/CVE-2019-14198.html
   https://www.suse.com/security/cve/CVE-2019-14199.html
   https://www.suse.com/security/cve/CVE-2019-14200.html
   https://www.suse.com/security/cve/CVE-2019-14201.html
   https://www.suse.com/security/cve/CVE-2019-14202.html
   https://www.suse.com/security/cve/CVE-2019-14203.html
   https://www.suse.com/security/cve/CVE-2019-14204.html
   https://www.suse.com/security/cve/CVE-2020-10648.html
   https://www.suse.com/security/cve/CVE-2020-8432.html
   https://bugzilla.suse.com/1098447
   https://bugzilla.suse.com/1098649
   https://bugzilla.suse.com/1134157
   https://bugzilla.suse.com/1134853
   https://bugzilla.suse.com/1143463
   https://bugzilla.suse.com/1143777
   https://bugzilla.suse.com/1143817
   https://bugzilla.suse.com/1143818
   https://bugzilla.suse.com/1143819
   https://bugzilla.suse.com/1143820
   https://bugzilla.suse.com/1143821
   https://bugzilla.suse.com/1143823
   https://bugzilla.suse.com/1143824
   https://bugzilla.suse.com/1143825
   https://bugzilla.suse.com/1143827
   https://bugzilla.suse.com/1143828
   https://bugzilla.suse.com/1143830
   https://bugzilla.suse.com/1143831
   https://bugzilla.suse.com/1162198
   https://bugzilla.suse.com/1167209

SUSE: 2020:3283-1 important: u-boot

November 11, 2020
An update that solves 18 vulnerabilities and has two fixes is now available

Summary

This update for u-boot fixes the following issues: - Fix network boot on Raspberry Pi 3 B+ (bsc#1098649) - Fix GOP pixel format (bsc#1098447) - Fix SD writes on Raspberry Pi - Enable a few more armv7 boards to boot with EFI - Fix potentially miscompiled runtime service calls Fix CVE-2019-14192 (bsc#1143777), CVE-2019-14193 (bsc#1143817), CVE-2019-14199 (bsc#1143824), CVE-2019-14197 (bsc#1143821), CVE-2019-14200 (bsc#1143825), CVE-2019-14201 (bsc#1143827), CVE-2019-14202 (bsc#1143828), CVE-2019-14203 (bsc#1143830), CVE-2019-14204 (bsc#1143831), CVE-2019-14194 (bsc#1143818), CVE-2019-14198 (bsc#1143823), CVE-2019-14195 (bsc#1143819), CVE-2019-14196 (bsc#1143820), CVE-2019-13103 (bsc#1143463), CVE-2020-8432 (bsc#1162198), CVE-2019-11059 (bsc#1134853), CVE-2019-11690 (bsc#1134157) and CVE-2020-10648 (bsc#1167209) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-3283=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2020-3283=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3283=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-3283=1 Package List: - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): u-boot-tools-2018.03-4.6.1 u-boot-tools-debuginfo-2018.03-4.6.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): u-boot-tools-2018.03-4.6.1 u-boot-tools-debuginfo-2018.03-4.6.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64): u-boot-rpi3-2018.03-4.6.2 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): u-boot-tools-2018.03-4.6.1 u-boot-tools-debuginfo-2018.03-4.6.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64): u-boot-rpi3-2018.03-4.6.2 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): u-boot-tools-2018.03-4.6.1 u-boot-tools-debuginfo-2018.03-4.6.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64): u-boot-rpi3-2018.03-4.6.2

References

#1098447 #1098649 #1134157 #1134853 #1143463

#1143777 #1143817 #1143818 #1143819 #1143820

#1143821 #1143823 #1143824 #1143825 #1143827

#1143828 #1143830 #1143831 #1162198 #1167209

Cross- CVE-2019-11059 CVE-2019-11690 CVE-2019-13103

CVE-2019-14192 CVE-2019-14193 CVE-2019-14194

CVE-2019-14195 CVE-2019-14196 CVE-2019-14197

CVE-2019-14198 CVE-2019-14199 CVE-2019-14200

CVE-2019-14201 CVE-2019-14202 CVE-2019-14203

CVE-2019-14204 CVE-2020-10648 CVE-2020-8432

Affected Products:

SUSE Linux Enterprise Server for SAP 15

SUSE Linux Enterprise Server 15-LTSS

SUSE Linux Enterprise High Performance Computing 15-LTSS

SUSE Linux Enterprise High Performance Computing 15-ESPOS

https://www.suse.com/security/cve/CVE-2019-11059.html

https://www.suse.com/security/cve/CVE-2019-11690.html

https://www.suse.com/security/cve/CVE-2019-13103.html

https://www.suse.com/security/cve/CVE-2019-14192.html

https://www.suse.com/security/cve/CVE-2019-14193.html

https://www.suse.com/security/cve/CVE-2019-14194.html

https://www.suse.com/security/cve/CVE-2019-14195.html

https://www.suse.com/security/cve/CVE-2019-14196.html

https://www.suse.com/security/cve/CVE-2019-14197.html

https://www.suse.com/security/cve/CVE-2019-14198.html

https://www.suse.com/security/cve/CVE-2019-14199.html

https://www.suse.com/security/cve/CVE-2019-14200.html

https://www.suse.com/security/cve/CVE-2019-14201.html

https://www.suse.com/security/cve/CVE-2019-14202.html

https://www.suse.com/security/cve/CVE-2019-14203.html

https://www.suse.com/security/cve/CVE-2019-14204.html

https://www.suse.com/security/cve/CVE-2020-10648.html

https://www.suse.com/security/cve/CVE-2020-8432.html

https://bugzilla.suse.com/1098447

https://bugzilla.suse.com/1098649

https://bugzilla.suse.com/1134157

https://bugzilla.suse.com/1134853

https://bugzilla.suse.com/1143463

https://bugzilla.suse.com/1143777

https://bugzilla.suse.com/1143817

https://bugzilla.suse.com/1143818

https://bugzilla.suse.com/1143819

https://bugzilla.suse.com/1143820

https://bugzilla.suse.com/1143821

https://bugzilla.suse.com/1143823

https://bugzilla.suse.com/1143824

https://bugzilla.suse.com/1143825

https://bugzilla.suse.com/1143827

https://bugzilla.suse.com/1143828

https://bugzilla.suse.com/1143830

https://bugzilla.suse.com/1143831

https://bugzilla.suse.com/1162198

https://bugzilla.suse.com/1167209

Severity
Announcement ID: SUSE-SU-2020:3283-1
Rating: important

Related News

Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved