Thank you for subscribing to the LinuxSecurity Linux Advisory Watch newsletter! Staying on top of the latest security advisories issued by the distro(s) you use is essential in maintaining an updated, secure Linux system. Our weekly newsletter is an easy, convenient way to track distribution security advisories - helping you keep your Linux environment safe from malware and other exploits.


Important advisories issued this week include warnings from CentOS of vulnerabilities in dovecot and Mozilla Thunderbird and an update for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8. Continue reading to learn about other significant advisories issued this week. Stay healthy, safe and secure - both on and offline!

LinuxSecurity.com Feature Extras:

Open Source is Revolutionizing Careers in Cybersecurity - What You Need to Know - Technology is an integral part of our everyday lives. Widespread reliance on devices that connect us to the Internet and cloud platforms that facilitate digital communications has markedly increased since the beginning of this pandemic. As technology companies are scrambling to meet businesses and consumers evolving needs, one trend has become clearly apparent - open-source is at the forefront of modern technological innovation, revolutionizing careers available in the field of cybersecurity in the process. 

RavenDB 5.0: A Versatile Open-Source NoSQL Database with an Intense Focus on Security - RavenDB is at the forefront of data management innovation - leveraging open-source development and an intense focus on usability to offer efficient, versatile and highly secure database services to business application developers worldwide. The latest release of the open-source NoSQL document database, RavenDB 5.0, accommodates both local and hosted environments, and adds time series support and document compression to its robust feature set.

  Debian: DSA-4781-1: blueman security update (Oct 27)
 

Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation.
  Fedora 31: python2 2020-e33acdea18 (Oct 29)
 

Fix CVE-2020-26116: Reject control chars in HTTP method in httplib
  Fedora 32: tcpreplay 2020-0e036c907e (Oct 28)
 

Patch CVE-2020-24265 and CVE-2020-24266.
  Fedora 32: xen 2020-e3d619cc32 (Oct 28)
 

x86: Race condition in Xen mapping code [XSA-345] undue deferral of IOMMU TLB flushes [XSA-346] unsafe AMD IOMMU page table updates [XSA-347]
  Fedora 31: tcpreplay 2020-e45cf8ea43 (Oct 28)
 

Patch CVE-2020-24265 and CVE-2020-24266.
  Fedora 33: yubihsm-shell 2020-8afd443d46 (Oct 28)
 

New upstream release (#1889941). It turned out to be security release, so added the security bugs.
  Fedora 33: tcpreplay 2020-c50d8b980b (Oct 28)
 

Patch CVE-2020-24265 and CVE-2020-24266.
  Fedora 32: nodejs 2020-c605353480 (Oct 27)
 

Update to Node.js 12.19.0
  Fedora 33: livecd-tools 2020-b40fc174b5 (Oct 26)
 

createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed
  Fedora 33: librepo 2020-b40fc174b5 (Oct 26)
 

createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed
  Fedora 33: dnf-plugins-core 2020-b40fc174b5 (Oct 26)
 

createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed
  Fedora 33: dnf-plugins-extras 2020-b40fc174b5 (Oct 26)
 

createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed
  Fedora 33: createrepo_c 2020-b40fc174b5 (Oct 26)
 

createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed
  Fedora 32: pdns-recursor 2020-81026ddd81 (Oct 26)
 

- Update to 4.3.5 Release notes: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html Security Advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html
  Fedora 32: kde-partitionmanager 2020-da859aadde (Oct 25)
 

Update kpmcore to 4.2.0 and rebuild all dependent packages. This update also fixes a not yet disclosed CVE.
  Fedora 32: kpmcore 2020-da859aadde (Oct 25)
 

Update kpmcore to 4.2.0 and rebuild all dependent packages. This update also fixes a not yet disclosed CVE.
  Fedora 33: java-1.8.0-openjdk 2020-5708dd5b87 (Oct 25)
 

New in release OpenJDK 8u272 (2020-10-20): notes can be found at: * https://bitly.com/openjdk8u272 * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u272.txt ## New features * JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7 ##
  Fedora 33: java-11-openjdk 2020-845860fd4f (Oct 25)
 

New in release OpenJDK 11.0.9 (2020-10-20): notes can be found at: * https://bitly.com/openjdk1109 * https://builds.shipilev.net/backports-monitor/release-notes-11.0.9.txt ## Security fixes - JDK-8233624: Enhance JNI linkage - JDK-8236196: Improve
  Fedora 33: xen 2020-97775b4234 (Oct 25)
 

x86: Race condition in Xen mapping code [XSA-345] undue deferral of IOMMU TLB flushes [XSA-346] unsafe AMD IOMMU page table updates [XSA-347]
  Fedora 32: freetype 2020-6299161e89 (Oct 24)
 

Update to freetype 2.10.4 which fixes security flaw CVE-2020-15999.
  Fedora 32: mupdf 2020-3cea1ac8f3 (Oct 24)
 

mupdf 1.18.0 and depending packages
  Fedora 31: ant 2020-3ce0f55bc5 (Oct 24)
 

Update to version 1.10.9. Addresses CVE-2020-11979
  Fedora 33: freetype 2020-768b1690f8 (Oct 24)
 

Update to freetype 2.10.4 which fixes security flaw CVE-2020-15999.
  Fedora 31: firefox 2020-de83d27335 (Oct 23)
 

- New upstream version (82.0) - Updated SELinux relabel setup (rhbz#1731371) - Fixed seeking in OpenH264 stream (rhbz#1886722) ---- - New Firefox upstream release (82.0) - Wayland and OpenH264 fixes
  Fedora 31: suricata 2020-58dc592b7b (Oct 23)
 

New upstream bug fix and security update.
  Fedora 31: singularity 2020-098cba75fe (Oct 23)
 

Upgrade to upstream 3.6.4.
  Fedora 32: singularity 2020-0fbf0db920 (Oct 23)
 

Upgrade to upstream 3.6.4.
  Fedora 33: firefox 2020-c82e86cde0 (Oct 23)
 

- New upstream version (82.0) - Updated SELinux relabel setup (rhbz#1731371) - Fixed seeking in OpenH264 stream (rhbz#1886722) ---- - New Firefox upstream release (82.0) - Wayland and OpenH264 fixes
  Fedora 33: pdns-recursor 2020-51ca2615fe (Oct 23)
 

- Update to 4.3.5 Release notes: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html Security Advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html
  Fedora 33: kde-partitionmanager 2020-73471e6414 (Oct 23)
 

Update kpmcore to 4.2.0 and rebuild all dependent packages. This update also fixes CVE-2020-27187.
  Fedora 33: kpmcore 2020-73471e6414 (Oct 23)
 

Update kpmcore to 4.2.0 and rebuild all dependent packages. This update also fixes CVE-2020-27187.
  Fedora 33: calamares 2020-73471e6414 (Oct 23)
 

Update kpmcore to 4.2.0 and rebuild all dependent packages. This update also fixes CVE-2020-27187.
  Fedora 33: ant 2020-2640aa4e19 (Oct 23)
 

Update to version 1.10.9. Addresses CVE-2020-11979
  Fedora 33: suricata 2020-140fcc96c8 (Oct 23)
 

New upstream bug fix and security update.
  Fedora 33: singularity 2020-efff92f6c4 (Oct 23)
 

Upgrade to upstream 3.6.4.
  Fedora 33: phpMyAdmin 2020-43d8624421 (Oct 23)
 

**Version 5.0.3** (2020-10-09) - issue #15983 Require twig ^2.9 - issue Fix option to import files locally appearing as not available - issue #16048 Fix to allow NULL as a default bit value - issue #16062 Fix "htmlspecialchars() expects parameter 1 to be string, null given" on Export xml - issue #16078 Fix no charts in monitor when using a decimal separator "," - issue #16041 Fix
  Fedora 33: nextcloud 2020-050aaa14f7 (Oct 23)
 

Update to Nextcloud 19.0.3, fixes CVE-2020-8236, CVE-2020-8223, CVE-2020-8183, CVE-2020-8173
  Fedora 33: mupdf 2020-972ad7c8a8 (Oct 23)
 

mupdf 1.18.0 and depending packages
  Fedora 33: python-PyMuPDF 2020-972ad7c8a8 (Oct 23)
 

mupdf 1.18.0 and depending packages
  Fedora 33: zathura-pdf-mupdf 2020-972ad7c8a8 (Oct 23)
 

mupdf 1.18.0 and depending packages
  Fedora 33: wireshark 2020-9bda6ae1cd (Oct 23)
 

New version 3.2.7 Security fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866
  Fedora 33: brotli 2020-c76a35b209 (Oct 23)
 

Update to 1.0.9, fixes CVE-2020-8927
  Fedora 33: claws-mail 2020-1f60842034 (Oct 23)
 

Update to 3.17.7 -- https://www.claws-mail.org/news.php
  Fedora 33: python-msldap 2020-e22e9a655d (Oct 23)
 

Update to latest upstream release 0.3.15 (#1885156)
  Fedora 33: python-bleach 2020-e0f35d634c (Oct 23)
 

update to 3.2.1 (rhbz#1829635)
  Gentoo: GLSA-202010-08: Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities (Oct 27)
 

Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. [More...]
  Gentoo: GLSA-202010-07: FreeType: Arbitrary code execution (Oct 23)
 

A buffer overflow in FreeType might allow remote attacker(s) to execute arbitrary code.
  RedHat: RHSA-2020-4401:01 Important: Red Hat JBoss Enterprise Application (Oct 28)
 

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4402:01 Important: Red Hat JBoss Enterprise Application (Oct 28)
 

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4390:01 Moderate: python-django security update (Oct 28)
 

An update for python-django is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4391:01 Moderate: openstack-cinder security update (Oct 28)
 

An update for OpenStack Block Storage (cinder) is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4384:01 Moderate: Red Hat JBoss Core Services Apache HTTP (Oct 28)
 

Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact
  RedHat: RHSA-2020-4383:01 Moderate: Red Hat JBoss Core Services Apache HTTP (Oct 28)
 

Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 5 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4283:01 Moderate: openstack-cinder security update (Oct 28)
 

An update for openstack-cinder is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4381:01 Moderate: openstack-selinux security update (Oct 28)
 

An update for openstack-selinux is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4298:01 Moderate: OpenShift Container Platform 4.6.1 (Oct 27)
 

An update is now available for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
  RedHat: RHSA-2020-4297:01 Moderate: OpenShift Container Platform 4.6.1 (Oct 27)
 

An update for jenkins-2-plugins, openshift-clients, podman, runc, and skopeo is now available for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4366:01 Important: Satellite 6.8 release (Oct 27)
 

An update is now available for Red Hat Satellite 6.8 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2020-4350:01 Moderate: java-1.8.0-openjdk security and bug fix (Oct 26)
 

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4348:01 Moderate: java-1.8.0-openjdk security update (Oct 26)
 

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4352:01 Moderate: java-1.8.0-openjdk security update (Oct 26)
 

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4347:01 Moderate: java-1.8.0-openjdk security update (Oct 26)
 

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4351:01 Important: chromium-browser security update (Oct 26)
 

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4349:01 Moderate: java-1.8.0-openjdk security update (Oct 26)
 

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4344:01 Moderate: Open Liberty 20.0.0.11 Runtime security (Oct 26)
 

Open Liberty 20.0.0.11 Runtime is now available from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
  RedHat: RHSA-2020-4320:01 Low: OpenShift Container Platform 4.5.16 security (Oct 26)
 

Red Hat OpenShift Container Platform release 4.5.16 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4331:01 Important: kpatch-patch security update (Oct 26)
 

An update is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2020-4332:01 Important: kpatch-patch security update (Oct 26)
 

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4330:01 Important: firefox security update (Oct 26)
 

An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2020-4317:01 Important: firefox security update (Oct 22)
 

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2020-4316:01 Moderate: java-11-openjdk security and bug fix (Oct 22)
 

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4315:01 Important: firefox security update (Oct 22)
 

An update for firefox is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4310:01 Important: firefox security update (Oct 22)
 

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2020-4312:01 Important: rh-maven35-jackson-databind security (Oct 22)
 

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4311:01 Important: firefox security update (Oct 22)
 

An update for firefox is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2020-4307:01 Moderate: java-11-openjdk security update (Oct 22)
 

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4304:01 Moderate: Red Hat Advanced Cluster Management for (Oct 22)
 

Red Hat Advanced Cluster Management for Kubernetes 2.0.4 General Availability release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4305:01 Moderate: java-11-openjdk security and bug fix (Oct 22)
 

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4306:01 Moderate: java-11-openjdk security and bug fix (Oct 22)
 

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2020-4223:01 Important: OpenShift Container Platform 3.11.306 (Oct 22)
 

An update for jenkins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  SUSE: 2020:3092-1 important: samba (Oct 29)
 

An update that fixes three vulnerabilities is now available.
  SUSE: 2020:3094-1 important: pacemaker (Oct 29)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2020:3093-1 important: samba (Oct 29)
 

An update that fixes three vulnerabilities is now available.
  SUSE: 2020:3096-1 important: python-Jinja2 (Oct 29)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3091-1 important: MozillaThunderbird and mozilla-nspr (Oct 29)
 

An update that fixes 6 vulnerabilities is now available.
  SUSE: 2020:3095-1 important: libvirt (Oct 29)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:1396-3 moderate: zstd (Oct 29)
 

An update that contains security fixes and contains one feature can now be installed.
  SUSE: 2020:3090-1 graphviz (Oct 29)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3088-1 important: xen (Oct 29)
 

An update that fixes four vulnerabilities is now available.
  SUSE: 2020:3089-1 important: pacemaker (Oct 29)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2020:3086-1 important: pacemaker (Oct 29)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2020:3087-1 important: samba (Oct 29)
 

An update that fixes three vulnerabilities is now available.
  SUSE: 2020:3080-1 important: pacemaker (Oct 29)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2020:3085-1 moderate: spice-gtk (Oct 29)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3083-1 important: samba (Oct 29)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3082-1 important: samba (Oct 29)
 

An update that fixes three vulnerabilities is now available.
  SUSE: 2020:3081-1 important: samba (Oct 29)
 

An update that fixes three vulnerabilities is now available.
  SUSE: 2020:3084-1 moderate: spice (Oct 29)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3073-1 important: pacemaker (Oct 28)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2020:3071-1 moderate: spice-gtk (Oct 28)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3067-1 important: apache2 (Oct 28)
 

An update that solves two vulnerabilities and has one errata is now available.
  SUSE: 2020:3069-1 moderate: tomcat (Oct 28)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3068-1 moderate: tomcat (Oct 28)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3065-1 important: sane-backends (Oct 28)
 

An update that fixes 7 vulnerabilities, contains four features is now available.
  SUSE: 2020:3070-1 moderate: spice (Oct 28)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3060-1 moderate: binutils (Oct 28)
 

An update that solves 8 vulnerabilities, contains three features and has 5 fixes is now available.
  SUSE: 2020:3064-1 moderate: zeromq (Oct 28)
 

An update that contains security fixes can now be installed.
  SUSE: 2020:3051-1 important: xen (Oct 27)
 

An update that fixes four vulnerabilities is now available.
  SUSE: 2020:3050-1 important: xen (Oct 27)
 

An update that fixes four vulnerabilities is now available.
  SUSE: 2020:3049-1 important: xen (Oct 27)
 

An update that fixes four vulnerabilities is now available.
  SUSE: 2020:3052-1 important: xen (Oct 27)
 

An update that fixes four vulnerabilities is now available.
  SUSE: 2020:3053-1 important: MozillaFirefox (Oct 27)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3054-1 important: pacemaker (Oct 27)
 

An update that solves one vulnerability, contains three features and has three fixes is now available.
  SUSE: 2020:3045-1 moderate: virt-bootstrap (Oct 27)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3039-1 important: libvirt (Oct 27)
 

An update that solves two vulnerabilities and has three fixes is now available.
  SUSE: 2020:3038-1 important: libvirt (Oct 27)
 

An update that solves two vulnerabilities and has one errata is now available.
  SUSE: 2020:3037-1 important: libvirt (Oct 26)
 

An update that solves two vulnerabilities and has four fixes is now available.
  SUSE: 2020:3036-1 important: rmt-server (Oct 26)
 

An update that fixes 16 vulnerabilities is now available.
  SUSE: 2020:3030-1 moderate: SDL (Oct 26)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3034-1 important: bluez (Oct 26)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:14522-1 important: MozillaFirefox (Oct 26)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3021-1 important: MozillaFirefox (Oct 23)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3024-1 moderate: glibc (Oct 23)
 

An update that solves one vulnerability and has four fixes is now available.
  SUSE: 2020:3023-1 libcdio (Oct 23)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:3022-1 important: MozillaFirefox (Oct 23)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2020:3014-1 important: the Linux Kernel (Oct 23)
 

An update that solves 14 vulnerabilities and has 78 fixes is now available.
  SUSE: 2020:3016-1 moderate: python-pip (Oct 23)
 

An update that fixes one vulnerability, contains one feature is now available.
  SUSE: 2020:3003-1 mercurial (Oct 22)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:2712-2 moderate: openldap2 (Oct 22)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:14521-1 important: xen (Oct 22)
 

An update that fixes 11 vulnerabilities is now available.
  SUSE: 2020:2997-1 important: php7 (Oct 22)
 

An update that solves two vulnerabilities and has one errata is now available.
  SUSE: 2020:2998-1 important: freetype2 (Oct 22)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:2999-1 important: the Linux Kernel (Oct 22)
 

An update that solves 15 vulnerabilities and has 84 fixes is now available.
  SUSE: 2020:2995-1 important: freetype2 (Oct 22)
 

An update that fixes one vulnerability is now available.
  SUSE: 2020:2996-1 moderate: tomcat (Oct 22)
 

An update that solves one vulnerability and has one errata is now available.
  Ubuntu 4610-1: fastd vulnerability (Oct 29)
 

fastd could be made to remotely exhaust resources if it received specially crafted packets.
  Ubuntu 4609-1: GOsa vulnerabilities (Oct 28)
 

Several security issues were fixed in gosa.
  Ubuntu 4552-3: Pam-python regression (Oct 28)
 

USN-4552-1 and USN-4552-2 introduced a regression in Pam-python
  Ubuntu 4608-1: ca-certificates update (Oct 28)
 

The CA certificates in the ca-certificates package were updated.
  Ubuntu 4607-1: OpenJDK vulnerabilities (Oct 27)
 

Several security issues were fixed in OpenJDK.
  Ubuntu 3081-2: Tomcat vulnerability (Oct 27)
 

The system could be made to run programs as an administrator.
  Ubuntu 4602-2: Perl vulnerabilities (Oct 27)
 

Several security issues were fixed in Perl.
  Ubuntu 4583-2: PHP vulnerabilities (Oct 27)
 

Several security issues were fixed in PHP.
  Ubuntu 4605-1: Blueman vulnerability (Oct 27)
 

Blueman could be made to run programs if it received specially crafted input.
  Ubuntu 4604-1: MySQL vulnerabilities (Oct 27)
 

Several security issues were fixed in MySQL.
  Ubuntu 4599-2: Firefox vulnerabilities (Oct 26)
 

Firefox could be made to crash or run programs as your login if it opened a malicious website.
  Ubuntu 4562-2: kramdown vulnerability (Oct 26)
 

kramdown could be made to crash, run programs, or leak sensitive information if it opened a specially crafted file.
  Ubuntu 4602-1: Perl vulnerabilities (Oct 26)
 

Several security issues were fixed in Perl.
  Ubuntu 4593-2: FreeType vulnerability (Oct 23)
 

FreeType could be made to crash or run programs as your login if it opened a specially crafted file.
  Ubuntu 0073-1: Linux kernel vulnerability (Oct 23)
   
  Ubuntu 4599-1: Firefox vulnerabilities (Oct 23)
 

Firefox could be made to crash or run programs as your login if it opened a malicious website.
  Ubuntu 4601-1: pip vulnerability (Oct 22)
 

pip could be made to overwrite files as the administrator.
  Ubuntu 4598-1: LibEtPan vulnerability (Oct 22)
 

LibEtPan could be made to expose sensitive information over the network.
  Ubuntu 4597-1: mod_auth_mellon vulnerabilities (Oct 22)
 

Several security issues were fixed in mod_auth_mellon.
  Debian LTS: DLA-2412-1: openjdk-8 security update (Oct 30)
 

Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, bypass of sandbox restrictions or information disclosure.
  Debian LTS: DLA-2419-1: dompurify.js security update (Oct 29)
 

Two issues have been found in dompurify.js, an XSS sanitizer for HTML, MathML and SVG. Both issues are related to mXSS issues in SVG- or MATH-elements.
  Debian LTS: DLA-2418-1: libsndfile security update (Oct 29)
 

Several issues have been found in libsndfile, a library for reading/writing audio files. All issues are basically divide by zero errors, heap read overflows or
  Debian LTS: DLA-2417-1: linux-4.19 security update (Oct 28)
 

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.
  Debian LTS: DLA-2415-1: freetype security update (Oct 25)
 

Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code.
  Debian LTS: DLA-2414-1: fastd security update (Oct 25)
 

In fastd, a fast and secure tunnelling daemon, a receive buffer handling problem was discovered which allows a denial of service (memory exhaustion) when receiving packets with an invalid type code.
  Debian LTS: DLA-2413-1: phpmyadmin security update (Oct 25)
 

Several vulnerabilities were found in package phpmyadmin. CVE-2019-19617
  SciLinux: SLSA-2020-4350-1 Moderate: java-1.8.0-openjdk on SL7.x x86_64 (Oct 27)
 

OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781) * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995) (CVE-2020-14782) * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792) * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 82 [More...]
  openSUSE: 2020:1769-1: important: singularity (Oct 29)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1770-1: important: singularity (Oct 29)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1772-1: important: lout (Oct 29)
 

An update that fixes two vulnerabilities is now available.
  openSUSE: 2020:1771-1: important: lout (Oct 29)
 

An update that fixes two vulnerabilities is now available.
  openSUSE: 2020:1767-1: important: php7 (Oct 29)
 

An update that solves two vulnerabilities and has one errata is now available.
  openSUSE: 2020:1765-1: moderate: pagure (Oct 29)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1766-1: moderate: tensorflow2 (Oct 29)
 

An update that fixes 16 vulnerabilities is now available.
  openSUSE: 2020:1754-1: moderate: kleopatra (Oct 28)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1752-1: moderate: Recommended mailman (Oct 27)
 

An update that fixes three vulnerabilities is now available.
  openSUSE: 2020:1748-1: important: MozillaFirefox (Oct 26)
 

An update that fixes two vulnerabilities is now available.
  openSUSE: 2020:1744-1: important: freetype2 (Oct 26)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1743-1: moderate: gnutls (Oct 26)
 

An update that solves one vulnerability and has two fixes is now available.
  openSUSE: 2020:1737-1: important: chromium (Oct 25)
 

An update that fixes 5 vulnerabilities is now available.
  openSUSE: 2020:1736-1: important: atftp (Oct 25)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1732-1: important: MozillaFirefox (Oct 25)
 

An update that fixes two vulnerabilities is now available.
  openSUSE: 2020:1734-1: important: freetype2 (Oct 25)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1731-1: important: chromium (Oct 25)
 

An update that fixes 5 vulnerabilities is now available.
  openSUSE: 2020:1724-1: moderate: gnutls (Oct 24)
 

An update that solves one vulnerability and has two fixes is now available.
  openSUSE: 2020:1723-1: moderate: kleopatra (Oct 24)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1719-1: hunspell (Oct 24)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1718-1: important: chromium (Oct 24)
 

An update that fixes 5 vulnerabilities is now available.
  openSUSE: 2020:1717-1: hunspell (Oct 23)
 

An update that fixes one vulnerability is now available.
  openSUSE: 2020:1713-1: important: opera (Oct 23)
 

An update that fixes 13 vulnerabilities is now available.
  openSUSE: 2020:1715-1: critical: chromium (Oct 23)
 

An update that fixes 27 vulnerabilities is now available.
  openSUSE: 2020:1707-1: moderate: Recommended mailman (Oct 22)
 

An update that fixes three vulnerabilities is now available.
  openSUSE: 2020:1705-1: critical: chromium (Oct 22)
 

An update that fixes 27 vulnerabilities is now available.
  Mageia 2020-0397: tomcat security update (Oct 29)
 

If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected
  Mageia 2020-0396: thunderbird security update (Oct 24)
 

Memory safety bugs fixed in Thunderbird 78.4. (CVE-2020-15683) Use-after-free in usersctp. (CVE-2020-15969) References:
  Mageia 2020-0395: nss and firefox security update (Oct 24)
 

Mozilla developers and community members Jason Kratzer, Simon Giesecke, Philipp, and Christian Holler reported memory safety bugs present in Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15683).
  Mageia 2020-0394: claws-mail security update (Oct 24)
 

Shielded template's |program{} and |attach_program{} so that the command-line that is executed does not allow sequencing such as with && || ;, preventing possible execution of nasty, or at least unexpected, commands. (No CVE).
  Mageia 2020-0393: pdns-recursor security update (Oct 24)
 

An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate),