openSUSE-SU-2020:0220-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2020:0220-1

Related

Published

2020-02-15T19:09:47Z

Modified

2020-02-15T19:09:47Z

Summary

Security update for nextcloud

Details

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.0.14-bp151.3.3.1

{
    "binaries": [
        {
            "nextcloud": "15.0.14-bp151.3.3.1"
        }
    ]
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.0.14-bp151.3.3.1

{
    "binaries": [
        {
            "nextcloud": "15.0.14-bp151.3.3.1"
        }
    ]
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.0.14-bp151.3.3.1

{
    "binaries": [
        {
            "nextcloud": "15.0.14-bp151.3.3.1"
        }
    ]
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.0.14-bp151.3.3.1

{
    "binaries": [
        {
            "nextcloud": "15.0.14-bp151.3.3.1"
        }
    ]
}