March 2022 - openSUSE Security Announce

openSUSE-SU-2022:0944-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0944-1 Rating: moderate References: #1022528 #1188572 #1189528 Cross-References: CVE-2017-5601 CVE-2021-36976 CVSS scores: CVE-2017-5601 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-5601 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-36976 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-36976 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-36976: Fixed an invalid memory access that could cause data corruption (bsc#1188572). Non-security updates: - Updated references for CVE-2017-5601, which was already fixed in a previous version (bsc#1022528 bsc#1189528). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-944=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.3.1 bsdtar-debuginfo-3.4.2-150200.4.3.1 libarchive-debugsource-3.4.2-150200.4.3.1 libarchive-devel-3.4.2-150200.4.3.1 libarchive13-3.4.2-150200.4.3.1 libarchive13-debuginfo-3.4.2-150200.4.3.1 - openSUSE Leap 15.3 (x86_64): libarchive13-32bit-3.4.2-150200.4.3.1 libarchive13-32bit-debuginfo-3.4.2-150200.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-5601.html https://www.suse.com/security/cve/CVE-2021-36976.html https://bugzilla.suse.com/1022528 https://bugzilla.suse.com/1188572 https://bugzilla.suse.com/1189528

1 0

openSUSE-SU-2022:0943-1: moderate: Security update for slirp4netns
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for slirp4netns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0943-1 Rating: moderate References: #1179467 Cross-References: CVE-2020-29130 CVSS scores: CVE-2020-29130 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-29130 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slirp4netns fixes the following issues: - CVE-2020-29130: Fixed an invalid memory access while processing ARP packets (bsc#1179467). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-943=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-943=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): slirp4netns-0.4.7-3.15.1 slirp4netns-debuginfo-0.4.7-3.15.1 slirp4netns-debugsource-0.4.7-3.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): slirp4netns-0.4.7-3.15.1 slirp4netns-debuginfo-0.4.7-3.15.1 slirp4netns-debugsource-0.4.7-3.15.1 References: https://www.suse.com/security/cve/CVE-2020-29130.html https://bugzilla.suse.com/1179467

1 0

openSUSE-SU-2022:0942-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0942-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: - CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-942=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-942=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.21.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.21.1 python3-3.6.15-150300.10.21.1 python3-base-3.6.15-150300.10.21.1 python3-base-debuginfo-3.6.15-150300.10.21.1 python3-core-debugsource-3.6.15-150300.10.21.1 python3-curses-3.6.15-150300.10.21.1 python3-curses-debuginfo-3.6.15-150300.10.21.1 python3-dbm-3.6.15-150300.10.21.1 python3-dbm-debuginfo-3.6.15-150300.10.21.1 python3-debuginfo-3.6.15-150300.10.21.1 python3-debugsource-3.6.15-150300.10.21.1 python3-devel-3.6.15-150300.10.21.1 python3-devel-debuginfo-3.6.15-150300.10.21.1 python3-doc-3.6.15-150300.10.21.1 python3-doc-devhelp-3.6.15-150300.10.21.1 python3-idle-3.6.15-150300.10.21.1 python3-testsuite-3.6.15-150300.10.21.1 python3-testsuite-debuginfo-3.6.15-150300.10.21.1 python3-tk-3.6.15-150300.10.21.1 python3-tk-debuginfo-3.6.15-150300.10.21.1 python3-tools-3.6.15-150300.10.21.1 - openSUSE Leap 15.4 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.21.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.21.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.21.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.21.1 python3-3.6.15-150300.10.21.1 python3-base-3.6.15-150300.10.21.1 python3-base-debuginfo-3.6.15-150300.10.21.1 python3-core-debugsource-3.6.15-150300.10.21.1 python3-curses-3.6.15-150300.10.21.1 python3-curses-debuginfo-3.6.15-150300.10.21.1 python3-dbm-3.6.15-150300.10.21.1 python3-dbm-debuginfo-3.6.15-150300.10.21.1 python3-debuginfo-3.6.15-150300.10.21.1 python3-debugsource-3.6.15-150300.10.21.1 python3-devel-3.6.15-150300.10.21.1 python3-devel-debuginfo-3.6.15-150300.10.21.1 python3-doc-3.6.15-150300.10.21.1 python3-doc-devhelp-3.6.15-150300.10.21.1 python3-idle-3.6.15-150300.10.21.1 python3-testsuite-3.6.15-150300.10.21.1 python3-testsuite-debuginfo-3.6.15-150300.10.21.1 python3-tk-3.6.15-150300.10.21.1 python3-tk-debuginfo-3.6.15-150300.10.21.1 python3-tools-3.6.15-150300.10.21.1 - openSUSE Leap 15.3 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.21.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.21.1 References: https://www.suse.com/security/cve/CVE-2021-3572.html https://bugzilla.suse.com/1186819

1 0

openSUSE-SU-2022:0089-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0089-1 Rating: moderate References: #1196905 #1196908 #1196952 Cross-References: CVE-2021-41239 CVE-2021-41241 CVE-2021-41741 CVSS scores: CVE-2021-41239 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-41239 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905) - CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908) - CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952) - For more changes see https://nextcloud.com/changelog/#21-0-9 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-89=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-21.0.9-37.1 nextcloud-apache-21.0.9-37.1 References: https://www.suse.com/security/cve/CVE-2021-41239.html https://www.suse.com/security/cve/CVE-2021-41241.html https://www.suse.com/security/cve/CVE-2021-41741.html https://bugzilla.suse.com/1196905 https://bugzilla.suse.com/1196908 https://bugzilla.suse.com/1196952

1 0

openSUSE-SU-2022:0940-1: important: Security update for xen
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0940-1 Rating: important References: #1027519 #1191668 #1194267 #1196915 Cross-References: CVE-2021-26401 CVE-2022-0001 CVE-2022-0002 CVSS scores: CVE-2021-26401 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-26401 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: Update Xen to version 4.14.4 (bsc#1027519) Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. Security issues fixed: - CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915). Non-security issues fixed: - Fixed issue around xl and virsh operation - virsh list not giving any output (bsc#1191668). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-940=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.4_02-150300.3.21.1 xen-debugsource-4.14.4_02-150300.3.21.1 xen-devel-4.14.4_02-150300.3.21.1 xen-doc-html-4.14.4_02-150300.3.21.1 xen-libs-4.14.4_02-150300.3.21.1 xen-libs-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-4.14.4_02-150300.3.21.1 xen-tools-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-domU-4.14.4_02-150300.3.21.1 xen-tools-domU-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.4_02-150300.3.21.1 xen-libs-32bit-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.4_02-150300.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-26401.html https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191668 https://bugzilla.suse.com/1194267 https://bugzilla.suse.com/1196915

1 0

openSUSE-SU-2022:0930-1: important: Security update for qemu
by opensuse-security＠opensuse.org 22 Mar '22

22 Mar '22

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0930-1 Rating: important References: #1178049 #1192525 #1193364 #1193545 #1194938 #1195161 #1196087 #1196737 Cross-References: CVE-2021-3930 CVE-2022-0358 CVSS scores: CVE-2021-3930 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3930 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2022-0358 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: This update for qemu fixes the following issues: - CVE-2022-0358: Fixed a potential privilege escalation via virtiofsd (bsc#1195161). - CVE-2021-3930: Fixed a potential denial of service in the emulated SCSI device (bsc#1192525). Non-security fixes: - Fixed a kernel data corruption via a long kernel boot cmdline (bsc#1196737). - Included vmxcap in the qemu-tools package (bsc#1193364). - Fixed package dependencies (bsc#1196087). - Fixed an issue were PowerPC firmwares would not be built for non-PowerPC builds (bsc#1193545). - Fixed multiple issues in I/O (bsc#1178049 bsc#1194938). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-930=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-150300.112.4 qemu-arm-5.2.0-150300.112.4 qemu-arm-debuginfo-5.2.0-150300.112.4 qemu-audio-alsa-5.2.0-150300.112.4 qemu-audio-alsa-debuginfo-5.2.0-150300.112.4 qemu-audio-pa-5.2.0-150300.112.4 qemu-audio-pa-debuginfo-5.2.0-150300.112.4 qemu-audio-spice-5.2.0-150300.112.4 qemu-audio-spice-debuginfo-5.2.0-150300.112.4 qemu-block-curl-5.2.0-150300.112.4 qemu-block-curl-debuginfo-5.2.0-150300.112.4 qemu-block-dmg-5.2.0-150300.112.4 qemu-block-dmg-debuginfo-5.2.0-150300.112.4 qemu-block-gluster-5.2.0-150300.112.4 qemu-block-gluster-debuginfo-5.2.0-150300.112.4 qemu-block-iscsi-5.2.0-150300.112.4 qemu-block-iscsi-debuginfo-5.2.0-150300.112.4 qemu-block-nfs-5.2.0-150300.112.4 qemu-block-nfs-debuginfo-5.2.0-150300.112.4 qemu-block-rbd-5.2.0-150300.112.4 qemu-block-rbd-debuginfo-5.2.0-150300.112.4 qemu-block-ssh-5.2.0-150300.112.4 qemu-block-ssh-debuginfo-5.2.0-150300.112.4 qemu-chardev-baum-5.2.0-150300.112.4 qemu-chardev-baum-debuginfo-5.2.0-150300.112.4 qemu-chardev-spice-5.2.0-150300.112.4 qemu-chardev-spice-debuginfo-5.2.0-150300.112.4 qemu-debuginfo-5.2.0-150300.112.4 qemu-debugsource-5.2.0-150300.112.4 qemu-extra-5.2.0-150300.112.4 qemu-extra-debuginfo-5.2.0-150300.112.4 qemu-guest-agent-5.2.0-150300.112.4 qemu-guest-agent-debuginfo-5.2.0-150300.112.4 qemu-hw-display-qxl-5.2.0-150300.112.4 qemu-hw-display-qxl-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-redirect-5.2.0-150300.112.4 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-smartcard-5.2.0-150300.112.4 qemu-hw-usb-smartcard-debuginfo-5.2.0-150300.112.4 qemu-ivshmem-tools-5.2.0-150300.112.4 qemu-ivshmem-tools-debuginfo-5.2.0-150300.112.4 qemu-ksm-5.2.0-150300.112.4 qemu-lang-5.2.0-150300.112.4 qemu-linux-user-5.2.0-150300.112.3 qemu-linux-user-debuginfo-5.2.0-150300.112.3 qemu-linux-user-debugsource-5.2.0-150300.112.3 qemu-ppc-5.2.0-150300.112.4 qemu-ppc-debuginfo-5.2.0-150300.112.4 qemu-s390x-5.2.0-150300.112.4 qemu-s390x-debuginfo-5.2.0-150300.112.4 qemu-testsuite-5.2.0-150300.112.7 qemu-tools-5.2.0-150300.112.4 qemu-tools-debuginfo-5.2.0-150300.112.4 qemu-ui-curses-5.2.0-150300.112.4 qemu-ui-curses-debuginfo-5.2.0-150300.112.4 qemu-ui-gtk-5.2.0-150300.112.4 qemu-ui-gtk-debuginfo-5.2.0-150300.112.4 qemu-ui-opengl-5.2.0-150300.112.4 qemu-ui-opengl-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-app-5.2.0-150300.112.4 qemu-ui-spice-app-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-core-5.2.0-150300.112.4 qemu-ui-spice-core-debuginfo-5.2.0-150300.112.4 qemu-vhost-user-gpu-5.2.0-150300.112.4 qemu-vhost-user-gpu-debuginfo-5.2.0-150300.112.4 qemu-x86-5.2.0-150300.112.4 qemu-x86-debuginfo-5.2.0-150300.112.4 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-150300.112.4 - openSUSE Leap 15.3 (noarch): qemu-SLOF-5.2.0-150300.112.4 qemu-ipxe-1.0.0+-150300.112.4 qemu-microvm-5.2.0-150300.112.4 qemu-seabios-1.14.0_0_g155821a-150300.112.4 qemu-sgabios-8-150300.112.4 qemu-skiboot-5.2.0-150300.112.4 qemu-vgabios-1.14.0_0_g155821a-150300.112.4 References: https://www.suse.com/security/cve/CVE-2021-3930.html https://www.suse.com/security/cve/CVE-2022-0358.html https://bugzilla.suse.com/1178049 https://bugzilla.suse.com/1192525 https://bugzilla.suse.com/1193364 https://bugzilla.suse.com/1193545 https://bugzilla.suse.com/1194938 https://bugzilla.suse.com/1195161 https://bugzilla.suse.com/1196087 https://bugzilla.suse.com/1196737

1 0

openSUSE-SU-2022:0923-1: important: Test update for SUSE:SLE-15-SP4:Update (security)
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Test update for SUSE:SLE-15-SP4:Update (security) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0923-1 Rating: important References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This is a security test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-923=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-923=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-security-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-security-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-SU-2022:0088-1: important: Security update for htmldoc
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0088-1 Rating: important References: #1192357 #1194303 #1194304 #1194487 #1195758 Cross-References: CVE-2021-40985 CVE-2021-43579 CVE-2021-45944 CVE-2021-45949 CVE-2022-0534 CVSS scores: CVE-2021-40985 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-40985 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-43579 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43579 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45944 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45944 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-45949 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45949 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0534 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0534 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: htmldoc was updated to fix issues: - CVE-2021-40985: Fixed buffer overflow may lead to DoS via a crafted BMP image (bsc#1192357) - CVE-2021-43579: Fixed stack-based buffer overflow in image_load_bmp() results in remote code execution if the victim converts an HTML document linking to a crafted BMP file (bsc#1194487) - CVE-2022-0534: Fixed stack out-of-bounds read in gif_get_code() when opening a malicious GIF file results in a segmentation fault (bsc#1195758) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-88=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-88=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ghostscript-9.52-161.1 ghostscript-debuginfo-9.52-161.1 ghostscript-debugsource-9.52-161.1 ghostscript-devel-9.52-161.1 ghostscript-x11-9.52-161.1 ghostscript-x11-debuginfo-9.52-161.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): htmldoc-1.8.28-9.1 References: https://www.suse.com/security/cve/CVE-2021-40985.html https://www.suse.com/security/cve/CVE-2021-43579.html https://www.suse.com/security/cve/CVE-2021-45944.html https://www.suse.com/security/cve/CVE-2021-45949.html https://www.suse.com/security/cve/CVE-2022-0534.html https://bugzilla.suse.com/1192357 https://bugzilla.suse.com/1194303 https://bugzilla.suse.com/1194304 https://bugzilla.suse.com/1194487 https://bugzilla.suse.com/1195758

1 0

openSUSE-SU-2022:0915-1: moderate: Security update for lapack
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for lapack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0915-1 Rating: moderate References: #1193562 Cross-References: CVE-2021-4048 CVSS scores: CVE-2021-4048 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-4048 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lapack fixes the following issues: - CVE-2021-4048: Fixed an out of bounds read when user input was not validated properly (bsc#1193562). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-915=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-915=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): blas-devel-3.5.0-4.6.1 blas-devel-static-3.5.0-4.6.1 lapack-debugsource-3.5.0-4.6.1 lapack-devel-3.5.0-4.6.1 lapack-devel-static-3.5.0-4.6.1 lapacke-devel-3.5.0-4.6.1 lapacke-devel-static-3.5.0-4.6.1 libblas3-3.5.0-4.6.1 libblas3-debuginfo-3.5.0-4.6.1 liblapack3-3.5.0-4.6.1 liblapack3-debuginfo-3.5.0-4.6.1 liblapacke3-3.5.0-4.6.1 liblapacke3-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.4 (x86_64): blas-devel-32bit-3.5.0-4.6.1 lapack-devel-32bit-3.5.0-4.6.1 lapacke-devel-32bit-3.5.0-4.6.1 libblas3-32bit-3.5.0-4.6.1 libblas3-32bit-debuginfo-3.5.0-4.6.1 liblapack3-32bit-3.5.0-4.6.1 liblapack3-32bit-debuginfo-3.5.0-4.6.1 liblapacke3-32bit-3.5.0-4.6.1 liblapacke3-32bit-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.4 (noarch): blas-man-3.5.0-4.6.1 lapack-man-3.5.0-4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): blas-devel-3.5.0-4.6.1 blas-devel-static-3.5.0-4.6.1 lapack-debugsource-3.5.0-4.6.1 lapack-devel-3.5.0-4.6.1 lapack-devel-static-3.5.0-4.6.1 lapacke-devel-3.5.0-4.6.1 lapacke-devel-static-3.5.0-4.6.1 libblas3-3.5.0-4.6.1 libblas3-debuginfo-3.5.0-4.6.1 liblapack3-3.5.0-4.6.1 liblapack3-debuginfo-3.5.0-4.6.1 liblapacke3-3.5.0-4.6.1 liblapacke3-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.3 (noarch): blas-man-3.5.0-4.6.1 lapack-man-3.5.0-4.6.1 - openSUSE Leap 15.3 (x86_64): blas-devel-32bit-3.5.0-4.6.1 lapack-devel-32bit-3.5.0-4.6.1 lapacke-devel-32bit-3.5.0-4.6.1 libblas3-32bit-3.5.0-4.6.1 libblas3-32bit-debuginfo-3.5.0-4.6.1 liblapack3-32bit-3.5.0-4.6.1 liblapack3-32bit-debuginfo-3.5.0-4.6.1 liblapacke3-32bit-3.5.0-4.6.1 liblapacke3-32bit-debuginfo-3.5.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2021-4048.html https://bugzilla.suse.com/1193562

1 0

openSUSE-SU-2022:0087-1: important: Security update for icingaweb2
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0087-1 Rating: important References: #1196911 #1196913 Cross-References: CVE-2022-24714 CVE-2022-24715 CVSS scores: CVE-2022-24714 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-24715 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24715 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. * Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users (GHSA-v9mv-h52f-7g63 boo#1196911) - CVE-2022-24714: Unwanted disclosure of hosts and related data, linked to decommissioned services (GHSA-qcmg-vr56-x9wf boo#1196913) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-87=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.8.6-15.1 icingaweb2-2.8.6-15.1 icingaweb2-common-2.8.6-15.1 icingaweb2-vendor-HTMLPurifier-2.8.6-15.1 icingaweb2-vendor-JShrink-2.8.6-15.1 icingaweb2-vendor-Parsedown-2.8.6-15.1 icingaweb2-vendor-dompdf-2.8.6-15.1 icingaweb2-vendor-lessphp-2.8.6-15.1 icingaweb2-vendor-zf1-2.8.6-15.1 php-Icinga-2.8.6-15.1 References: https://www.suse.com/security/cve/CVE-2022-24714.html https://www.suse.com/security/cve/CVE-2022-24715.html https://bugzilla.suse.com/1196911 https://bugzilla.suse.com/1196913

1 0