April 2021 - openSUSE Security Announce

openSUSE-SU-2021:0628-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 29 Apr '21

29 Apr '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0628-1 Rating: moderate References: #1185083 #1185084 #1185085 Cross-References: CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 CVSS scores: CVE-2021-21374 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nim fixes the following issues: num was updated to version 1.2.12: * Fixed GC crash resulting from inlining of the memory allocation procs * Fixed ��incorrect raises effect for $(NimNode)�� (#17454) From version 1.2.10: * Fixed ��JS backend doesn��t handle float->int type conversion �� (#8404) * Fixed ��The ��try except�� not work when the ��OSError: Too many open files�� error occurs!�� (#15925) * Fixed ��Nim emits #line 0 C preprocessor directives with ��debugger:native, with ICE in gcc-10�� (#15942) * Fixed ��tfuturevar fails when activated�� (#9695) * Fixed ��nre.escapeRe is not gcsafe�� (#16103) * Fixed ��Error: internal error: genRecordFieldAux�� - in the ��version-1-4�� branch�� (#16069) * Fixed ��-d:fulldebug switch does not compile with gc:arc�� (#16214) * Fixed ��osLastError may randomly raise defect and crash�� (#16359) * Fixed ��generic importc proc��s don��t work (breaking lots of vmops procs for js)�� (#16428) * Fixed ��Concept: codegen ignores parameter passing�� (#16897) * Fixed ��{.push exportc.} interacts with anonymous functions�� (#16967) * Fixed ��memory allocation during {.global.} init breaks GC�� (#17085) * Fixed "Nimble arbitrary code execution for specially crafted package metadata" + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962 p + (boo#1185083, CVE-2021-21372) * Fixed "Nimble falls back to insecure http url when fetching packages" + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp 8 + (boo#1185084, CVE-2021-21373) * Fixed "Nimble fails to validate certificates due to insecure httpClient defaults" + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhx x + (boo#1185085, CVE-2021-21374) from version 1.2.8 * Fixed ��Defer and ��gc:arc�� (#15071) * Fixed ��Issue with ��gc:arc at compile time�� (#15129) * Fixed ��Nil check on each field fails in generic function�� (#15101) * Fixed ��[strscans] scanf doesn��t match a single character with $+ if it��s the end of the string�� (#15064) * Fixed ��Crash and incorrect return values when using readPasswordFromStdin on Windows.�� (#15207) * Fixed ��Inconsistent unsigned -> signed RangeDefect usage across integer sizes�� (#15210) * Fixed ��toHex results in RangeDefect exception when used with large uint64�� (#15257) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��proc execCmdEx doesn��t work with -d:useWinAnsi�� (#14203) * Fixed ��memory corruption in tmarshall.nim�� (#9754) * Fixed ��Wrong number of variables�� (#15360) * Fixed ��defer doesnt work with block, break and await�� (#15243) * Fixed ��Sizeof of case object is incorrect. Showstopper�� (#15516) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��regression(1.0.2 => 1.0.4) VM register messed up depending on unrelated context�� (#15704) from version 1.2.6 * Fixed ��The pegs module doesn��t work with generics!�� (#14718) * Fixed ��[goto exceptions] {.noReturn.} pragma is not detected in a case expression�� (#14458) * Fixed ��[exceptions:goto] C compiler error with dynlib pragma calling a proc�� (#14240) * Fixed ��Nim source archive install: ��install.sh�� fails with error: cp: cannot stat ��bin/nim-gdb��: No such file or directory�� (#14748) * Fixed ��Stropped identifiers don��t work as field names in tuple literals�� (#14911) * Fixed ��uri.decodeUrl crashes on incorrectly formatted input�� (#14082) * Fixed ��odbcsql module has some wrong integer types�� (#9771) * Fixed ��[ARC] Compiler crash declaring a finalizer proc directly in ��new�� (#15044) * Fixed ��code with named arguments in proc of winim/com can not been compiled�� (#15056) * Fixed ��javascript backend produces javascript code with syntax error in object syntax�� (#14534) * Fixed ��[ARC] SIGSEGV when calling a closure as a tuple field in a seq�� (#15038) * Fixed ��Compiler crashes when using string as object variant selector with else branch�� (#14189) * Fixed ��Constructing a uint64 range on a 32-bit machine leads to incorrect codegen�� (#14616) Update to version 1.2.2: * See https://nim-lang.org/blog.html for details Update to version 1.0.2: * See https://nim-lang.org/blog.html for details This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-628=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): nim-1.2.12-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-21372.html https://www.suse.com/security/cve/CVE-2021-21373.html https://www.suse.com/security/cve/CVE-2021-21374.html https://bugzilla.suse.com/1185083 https://bugzilla.suse.com/1185084 https://bugzilla.suse.com/1185085

1 0

openSUSE-SU-2021:0621-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0621-1 Rating: important References: #1184960 Cross-References: CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVSS scores: CVE-2021-23961 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23961 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23994 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23995 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23998 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23999 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-24002 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29945 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29946 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox was updated to 78.10.0 ESR (bsc#1184960) * CVE-2021-23994: Out of bound write due to lazy initialization * CVE-2021-23995: Use-after-free in Responsive Design Mode * CVE-2021-23998: Secure Lock icon could have been spoofed * CVE-2021-23961: More internal network hosts could have been probed by a malicious webpage * CVE-2021-23999: Blob URLs may have been granted additional privileges * CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL * CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads * CVE-2021-29946: Port blocking could be bypassed This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-621=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.10.0-lp152.2.55.1 MozillaFirefox-branding-upstream-78.10.0-lp152.2.55.1 MozillaFirefox-buildsymbols-78.10.0-lp152.2.55.1 MozillaFirefox-debuginfo-78.10.0-lp152.2.55.1 MozillaFirefox-debugsource-78.10.0-lp152.2.55.1 MozillaFirefox-devel-78.10.0-lp152.2.55.1 MozillaFirefox-translations-common-78.10.0-lp152.2.55.1 MozillaFirefox-translations-other-78.10.0-lp152.2.55.1 References: https://www.suse.com/security/cve/CVE-2021-23961.html https://www.suse.com/security/cve/CVE-2021-23994.html https://www.suse.com/security/cve/CVE-2021-23995.html https://www.suse.com/security/cve/CVE-2021-23998.html https://www.suse.com/security/cve/CVE-2021-23999.html https://www.suse.com/security/cve/CVE-2021-24002.html https://www.suse.com/security/cve/CVE-2021-29945.html https://www.suse.com/security/cve/CVE-2021-29946.html https://bugzilla.suse.com/1184960

1 0

openSUSE-SU-2021:0620-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0620-1 Rating: moderate References: #1184756 Cross-References: CVE-2021-3496 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jhead fixes the following issues: - CVE-2021-3496: Fixed heap-based buffer overflow in Get16u() in exif.c (bsc#1184756) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-620=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-3496.html https://bugzilla.suse.com/1184756

1 0

openSUSE-SU-2021:0619-1: Security update for libdwarf
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for libdwarf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0619-1 Rating: low References: #1185057 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libdwarf fixes the following issues: - Hardening: Link /usr/bin/dwarfdump as PIE (bsc#1185057). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-619=1 Package List: - openSUSE Leap 15.2 (x86_64): libdwarf-debuginfo-20161124-lp152.4.3.1 libdwarf-debugsource-20161124-lp152.4.3.1 libdwarf-devel-20161124-lp152.4.3.1 libdwarf-devel-debuginfo-20161124-lp152.4.3.1 libdwarf-devel-static-20161124-lp152.4.3.1 libdwarf-doc-20161124-lp152.4.3.1 libdwarf-tools-20161124-lp152.4.3.1 libdwarf-tools-debuginfo-20161124-lp152.4.3.1 libdwarf1-20161124-lp152.4.3.1 libdwarf1-debuginfo-20161124-lp152.4.3.1 References: https://bugzilla.suse.com/1185057

1 0

openSUSE-SU-2021:0618-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 25 Apr '21

25 Apr '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0618-1 Rating: moderate References: #1185083 #1185084 #1185085 Cross-References: CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 CVSS scores: CVE-2021-21374 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nim fixes the following issues: num was updated to version 1.2.12: * Fixed GC crash resulting from inlining of the memory allocation procs * Fixed ��incorrect raises effect for $(NimNode)�� (#17454) From version 1.2.10: * Fixed ��JS backend doesn��t handle float->int type conversion �� (#8404) * Fixed ��The ��try except�� not work when the ��OSError: Too many open files�� error occurs!�� (#15925) * Fixed ��Nim emits #line 0 C preprocessor directives with ��debugger:native, with ICE in gcc-10�� (#15942) * Fixed ��tfuturevar fails when activated�� (#9695) * Fixed ��nre.escapeRe is not gcsafe�� (#16103) * Fixed ��Error: internal error: genRecordFieldAux�� - in the ��version-1-4�� branch�� (#16069) * Fixed ��-d:fulldebug switch does not compile with gc:arc�� (#16214) * Fixed ��osLastError may randomly raise defect and crash�� (#16359) * Fixed ��generic importc proc��s don��t work (breaking lots of vmops procs for js)�� (#16428) * Fixed ��Concept: codegen ignores parameter passing�� (#16897) * Fixed ��{.push exportc.} interacts with anonymous functions�� (#16967) * Fixed ��memory allocation during {.global.} init breaks GC�� (#17085) * Fixed "Nimble arbitrary code execution for specially crafted package metadata" + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962 p + (boo#1185083, CVE-2021-21372) * Fixed "Nimble falls back to insecure http url when fetching packages" + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp 8 + (boo#1185084, CVE-2021-21373) * Fixed "Nimble fails to validate certificates due to insecure httpClient defaults" + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhx x + (boo#1185085, CVE-2021-21374) from version 1.2.8 * Fixed ��Defer and ��gc:arc�� (#15071) * Fixed ��Issue with ��gc:arc at compile time�� (#15129) * Fixed ��Nil check on each field fails in generic function�� (#15101) * Fixed ��[strscans] scanf doesn��t match a single character with $+ if it��s the end of the string�� (#15064) * Fixed ��Crash and incorrect return values when using readPasswordFromStdin on Windows.�� (#15207) * Fixed ��Inconsistent unsigned -> signed RangeDefect usage across integer sizes�� (#15210) * Fixed ��toHex results in RangeDefect exception when used with large uint64�� (#15257) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��proc execCmdEx doesn��t work with -d:useWinAnsi�� (#14203) * Fixed ��memory corruption in tmarshall.nim�� (#9754) * Fixed ��Wrong number of variables�� (#15360) * Fixed ��defer doesnt work with block, break and await�� (#15243) * Fixed ��Sizeof of case object is incorrect. Showstopper�� (#15516) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��regression(1.0.2 => 1.0.4) VM register messed up depending on unrelated context�� (#15704) from version 1.2.6 * Fixed ��The pegs module doesn��t work with generics!�� (#14718) * Fixed ��[goto exceptions] {.noReturn.} pragma is not detected in a case expression�� (#14458) * Fixed ��[exceptions:goto] C compiler error with dynlib pragma calling a proc�� (#14240) * Fixed ��Nim source archive install: ��install.sh�� fails with error: cp: cannot stat ��bin/nim-gdb��: No such file or directory�� (#14748) * Fixed ��Stropped identifiers don��t work as field names in tuple literals�� (#14911) * Fixed ��uri.decodeUrl crashes on incorrectly formatted input�� (#14082) * Fixed ��odbcsql module has some wrong integer types�� (#9771) * Fixed ��[ARC] Compiler crash declaring a finalizer proc directly in ��new�� (#15044) * Fixed ��code with named arguments in proc of winim/com can not been compiled�� (#15056) * Fixed ��javascript backend produces javascript code with syntax error in object syntax�� (#14534) * Fixed ��[ARC] SIGSEGV when calling a closure as a tuple field in a seq�� (#15038) * Fixed ��Compiler crashes when using string as object variant selector with else branch�� (#14189) * Fixed ��Constructing a uint64 range on a 32-bit machine leads to incorrect codegen�� (#14616) Update to version 1.2.2: * See https://nim-lang.org/blog.html for details Update to version 1.0.2: * See https://nim-lang.org/blog.html for details Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-618=1 Package List: - openSUSE Leap 15.2 (x86_64): nim-1.2.12-lp152.2.3.1 nim-debuginfo-1.2.12-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21372.html https://www.suse.com/security/cve/CVE-2021-21373.html https://www.suse.com/security/cve/CVE-2021-21374.html https://bugzilla.suse.com/1185083 https://bugzilla.suse.com/1185084 https://bugzilla.suse.com/1185085

1 0

openSUSE-SU-2021:0607-1: moderate: Security update for ruby2.5
by opensuse-security＠opensuse.org 24 Apr '21

24 Apr '21

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0607-1 Rating: moderate References: #1184644 Cross-References: CVE-2021-28965 CVSS scores: CVE-2021-28965 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ruby2.5 fixes the following issues: - Update to 2.5.9 - CVE-2021-28965: XML round-trip vulnerability in REXML (bsc#1184644) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-607=1 Package List: - openSUSE Leap 15.2 (x86_64): libruby2_5-2_5-2.5.9-lp152.2.6.1 libruby2_5-2_5-debuginfo-2.5.9-lp152.2.6.1 ruby2.5-2.5.9-lp152.2.6.1 ruby2.5-debuginfo-2.5.9-lp152.2.6.1 ruby2.5-debugsource-2.5.9-lp152.2.6.1 ruby2.5-devel-2.5.9-lp152.2.6.1 ruby2.5-devel-extra-2.5.9-lp152.2.6.1 ruby2.5-doc-2.5.9-lp152.2.6.1 ruby2.5-stdlib-2.5.9-lp152.2.6.1 ruby2.5-stdlib-debuginfo-2.5.9-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): ruby2.5-doc-ri-2.5.9-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-28965.html https://bugzilla.suse.com/1184644

1 0

openSUSE-SU-2021:0606-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0606-1 Rating: moderate References: #1184624 #1184626 #1184627 #1184628 Cross-References: CVE-2021-20309 CVE-2021-20311 CVE-2021-20312 CVE-2021-20313 CVSS scores: CVE-2021-20309 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20311 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20312 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20313 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20309: Division by zero in WaveImage() of MagickCore/visual-effects. (bsc#1184624) - CVE-2021-20311: Division by zero in sRGBTransformImage() in MagickCore/colorspace.c (bsc#1184626) - CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c (bsc#1184627) - CVE-2021-20313: Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c (bsc#1184628) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-606=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ImageMagick-7.0.7.34-lp152.12.15.1 ImageMagick-config-7-SUSE-7.0.7.34-lp152.12.15.1 ImageMagick-config-7-upstream-7.0.7.34-lp152.12.15.1 ImageMagick-debuginfo-7.0.7.34-lp152.12.15.1 ImageMagick-debugsource-7.0.7.34-lp152.12.15.1 ImageMagick-devel-7.0.7.34-lp152.12.15.1 ImageMagick-extra-7.0.7.34-lp152.12.15.1 ImageMagick-extra-debuginfo-7.0.7.34-lp152.12.15.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp152.12.15.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp152.12.15.1 libMagick++-devel-7.0.7.34-lp152.12.15.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp152.12.15.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.15.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp152.12.15.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.15.1 perl-PerlMagick-7.0.7.34-lp152.12.15.1 perl-PerlMagick-debuginfo-7.0.7.34-lp152.12.15.1 - openSUSE Leap 15.2 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp152.12.15.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp152.12.15.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp152.12.15.1 libMagick++-devel-32bit-7.0.7.34-lp152.12.15.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.15.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.15.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.15.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.15.1 - openSUSE Leap 15.2 (noarch): ImageMagick-doc-7.0.7.34-lp152.12.15.1 References: https://www.suse.com/security/cve/CVE-2021-20309.html https://www.suse.com/security/cve/CVE-2021-20311.html https://www.suse.com/security/cve/CVE-2021-20312.html https://www.suse.com/security/cve/CVE-2021-20313.html https://bugzilla.suse.com/1184624 https://bugzilla.suse.com/1184626 https://bugzilla.suse.com/1184627 https://bugzilla.suse.com/1184628

1 0

openSUSE-SU-2021:0605-1: moderate: Security update for apache-commons-io
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for apache-commons-io ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0605-1 Rating: moderate References: #1184755 Cross-References: CVE-2021-29425 CVSS scores: CVE-2021-29425 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-29425 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-commons-io fixes the following issues: - CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string (bsc#1184755) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-605=1 Package List: - openSUSE Leap 15.2 (noarch): apache-commons-io-2.6-lp152.2.3.1 apache-commons-io-javadoc-2.6-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-29425.html https://bugzilla.suse.com/1184755

1 0

openSUSE-SU-2021:0600-1: important: Security update for qemu
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0600-1 Rating: important References: #1172385 #1173612 #1176673 #1176682 #1176684 #1178174 #1178400 #1178934 #1179466 #1179467 #1179468 #1179686 #1181108 #1182425 #1182577 #1182968 #1184064 Cross-References: CVE-2020-12829 CVE-2020-15469 CVE-2020-25084 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-27616 CVE-2020-27617 CVE-2020-27821 CVE-2020-28916 CVE-2020-29129 CVE-2020-29130 CVE-2020-29443 CVE-2021-20257 CVE-2021-3416 CVSS scores: CVE-2020-12829 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-12829 (SUSE): 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-15469 (NVD) : 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L CVE-2020-15469 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-25084 (NVD) : 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2020-25084 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVE-2020-25624 (NVD) : 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVE-2020-25624 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVE-2020-25625 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-25625 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2020-25723 (NVD) : 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2020-25723 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2020-27616 (SUSE): 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2020-27617 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-27617 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-27821 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-27821 (SUSE): 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L CVE-2020-28916 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-28916 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-29129 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-29129 (SUSE): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVE-2020-29130 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-29130 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-29443 (NVD) : 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L CVE-2020-29443 (SUSE): 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L CVE-2021-20257 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3416 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2021-3416 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 15 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: - CVE-2020-12829: Fix OOB access in sm501 device emulation (bsc#1172385) - CVE-2020-25723: Fix use-after-free in usb xhci packet handling (bsc#1178934) - CVE-2020-25084: Fix use-after-free in usb ehci packet handling (bsc#1176673) - CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci emulation (bsc#1176684) - CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation (bsc#1176682) - CVE-2020-27617: Fix guest triggerable assert in shared network handling code (bsc#1178174) - CVE-2020-28916: Fix infinite loop (DoS) in e1000e device emulation (bsc#1179468) - CVE-2020-29443: Fix OOB access in atapi emulation (bsc#1181108) - CVE-2020-27821: Fix heap overflow in MSIx emulation (bsc#1179686) - CVE-2020-15469: Fix null pointer deref. (DoS) in mmio ops (bsc#1173612) - CVE-2021-20257: Fix infinite loop (DoS) in e1000 device emulation (bsc#1182577) - CVE-2021-3416: Fix OOB access (stack overflow) in rtl8139 NIC emulation (bsc#1182968) - CVE-2021-3416: Fix OOB access (stack overflow) in other NIC emulations (bsc#1182968) - CVE-2020-27616: Fix OOB access in ati-vga emulation (bsc#1178400) - CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet processing (bsc#1179466, CVE-2020-29130, bsc#1179467) - Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425) - Add split-provides through forsplits/13 to cover updates of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents (bsc#1184064) - Added a few more usability improvements for our git packaging workflow This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-600=1 Package List: - openSUSE Leap 15.2 (noarch): qemu-ipxe-1.0.0+-lp152.9.12.1 qemu-microvm-4.2.1-lp152.9.12.1 qemu-seabios-1.12.1+-lp152.9.12.1 qemu-sgabios-8-lp152.9.12.1 qemu-vgabios-1.12.1+-lp152.9.12.1 - openSUSE Leap 15.2 (x86_64): qemu-4.2.1-lp152.9.12.1 qemu-arm-4.2.1-lp152.9.12.1 qemu-arm-debuginfo-4.2.1-lp152.9.12.1 qemu-audio-alsa-4.2.1-lp152.9.12.1 qemu-audio-alsa-debuginfo-4.2.1-lp152.9.12.1 qemu-audio-pa-4.2.1-lp152.9.12.1 qemu-audio-pa-debuginfo-4.2.1-lp152.9.12.1 qemu-audio-sdl-4.2.1-lp152.9.12.1 qemu-audio-sdl-debuginfo-4.2.1-lp152.9.12.1 qemu-block-curl-4.2.1-lp152.9.12.1 qemu-block-curl-debuginfo-4.2.1-lp152.9.12.1 qemu-block-dmg-4.2.1-lp152.9.12.1 qemu-block-dmg-debuginfo-4.2.1-lp152.9.12.1 qemu-block-gluster-4.2.1-lp152.9.12.1 qemu-block-gluster-debuginfo-4.2.1-lp152.9.12.1 qemu-block-iscsi-4.2.1-lp152.9.12.1 qemu-block-iscsi-debuginfo-4.2.1-lp152.9.12.1 qemu-block-nfs-4.2.1-lp152.9.12.1 qemu-block-nfs-debuginfo-4.2.1-lp152.9.12.1 qemu-block-rbd-4.2.1-lp152.9.12.1 qemu-block-rbd-debuginfo-4.2.1-lp152.9.12.1 qemu-block-ssh-4.2.1-lp152.9.12.1 qemu-block-ssh-debuginfo-4.2.1-lp152.9.12.1 qemu-debuginfo-4.2.1-lp152.9.12.1 qemu-debugsource-4.2.1-lp152.9.12.1 qemu-extra-4.2.1-lp152.9.12.1 qemu-extra-debuginfo-4.2.1-lp152.9.12.1 qemu-guest-agent-4.2.1-lp152.9.12.1 qemu-guest-agent-debuginfo-4.2.1-lp152.9.12.1 qemu-ksm-4.2.1-lp152.9.12.1 qemu-kvm-4.2.1-lp152.9.12.1 qemu-lang-4.2.1-lp152.9.12.1 qemu-linux-user-4.2.1-lp152.9.12.1 qemu-linux-user-debuginfo-4.2.1-lp152.9.12.1 qemu-linux-user-debugsource-4.2.1-lp152.9.12.1 qemu-ppc-4.2.1-lp152.9.12.1 qemu-ppc-debuginfo-4.2.1-lp152.9.12.1 qemu-s390-4.2.1-lp152.9.12.1 qemu-s390-debuginfo-4.2.1-lp152.9.12.1 qemu-testsuite-4.2.1-lp152.9.12.1 qemu-tools-4.2.1-lp152.9.12.1 qemu-tools-debuginfo-4.2.1-lp152.9.12.1 qemu-ui-curses-4.2.1-lp152.9.12.1 qemu-ui-curses-debuginfo-4.2.1-lp152.9.12.1 qemu-ui-gtk-4.2.1-lp152.9.12.1 qemu-ui-gtk-debuginfo-4.2.1-lp152.9.12.1 qemu-ui-sdl-4.2.1-lp152.9.12.1 qemu-ui-sdl-debuginfo-4.2.1-lp152.9.12.1 qemu-ui-spice-app-4.2.1-lp152.9.12.1 qemu-ui-spice-app-debuginfo-4.2.1-lp152.9.12.1 qemu-vhost-user-gpu-4.2.1-lp152.9.12.1 qemu-vhost-user-gpu-debuginfo-4.2.1-lp152.9.12.1 qemu-x86-4.2.1-lp152.9.12.1 qemu-x86-debuginfo-4.2.1-lp152.9.12.1 References: https://www.suse.com/security/cve/CVE-2020-12829.html https://www.suse.com/security/cve/CVE-2020-15469.html https://www.suse.com/security/cve/CVE-2020-25084.html https://www.suse.com/security/cve/CVE-2020-25624.html https://www.suse.com/security/cve/CVE-2020-25625.html https://www.suse.com/security/cve/CVE-2020-25723.html https://www.suse.com/security/cve/CVE-2020-27616.html https://www.suse.com/security/cve/CVE-2020-27617.html https://www.suse.com/security/cve/CVE-2020-27821.html https://www.suse.com/security/cve/CVE-2020-28916.html https://www.suse.com/security/cve/CVE-2020-29129.html https://www.suse.com/security/cve/CVE-2020-29130.html https://www.suse.com/security/cve/CVE-2020-29443.html https://www.suse.com/security/cve/CVE-2021-20257.html https://www.suse.com/security/cve/CVE-2021-3416.html https://bugzilla.suse.com/1172385 https://bugzilla.suse.com/1173612 https://bugzilla.suse.com/1176673 https://bugzilla.suse.com/1176682 https://bugzilla.suse.com/1176684 https://bugzilla.suse.com/1178174 https://bugzilla.suse.com/1178400 https://bugzilla.suse.com/1178934 https://bugzilla.suse.com/1179466 https://bugzilla.suse.com/1179467 https://bugzilla.suse.com/1179468 https://bugzilla.suse.com/1179686 https://bugzilla.suse.com/1181108 https://bugzilla.suse.com/1182425 https://bugzilla.suse.com/1182577 https://bugzilla.suse.com/1182968 https://bugzilla.suse.com/1184064

1 0

openSUSE-SU-2021:0601-1: important: Security update for nodejs-underscore
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for nodejs-underscore ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0601-1 Rating: important References: #1184800 Cross-References: CVE-2021-23358 CVSS scores: CVE-2021-23358 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs-underscore fixes the following issues: Update version to 1.13.1 * Fix security issue (boo#1184800, CVE-2021-23358) * Fix bugs * Many new features Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-601=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs-underscore-1.13.1-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-23358.html https://bugzilla.suse.com/1184800

1 0