January 2021 - openSUSE Security Announce

openSUSE-SU-2021:0121-1: important: Security update for vlc
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0121-1 Rating: important References: #1133290 #1172727 #1180755 Cross-References: CVE-2020-13428 CVE-2020-26664 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: - CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727) - CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-121=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.11.1-bp151.5.12.1 libvlccore9-3.0.11.1-bp151.5.12.1 vlc-3.0.11.1-bp151.5.12.1 vlc-codec-gstreamer-3.0.11.1-bp151.5.12.1 vlc-devel-3.0.11.1-bp151.5.12.1 vlc-jack-3.0.11.1-bp151.5.12.1 vlc-noX-3.0.11.1-bp151.5.12.1 vlc-opencv-3.0.11.1-bp151.5.12.1 vlc-qt-3.0.11.1-bp151.5.12.1 vlc-vdpau-3.0.11.1-bp151.5.12.1 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.11.1-bp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2020-13428.html https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1172727 https://bugzilla.suse.com/1180755

1 0

openSUSE-SU-2021:0117-1: moderate: Security update for python-jupyter_notebook
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for python-jupyter_notebook ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0117-1 Rating: moderate References: #1180458 Cross-References: CVE-2020-26215 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-jupyter_notebook fixes the following issue: - CVE-2020-26215: Fixed an open redirect vulnerability (boo#1180458). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-117=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python-jupyter_notebook-doc-5.7.7-bp151.3.3.1 python2-jupyter_notebook-5.7.7-bp151.3.3.1 python2-jupyter_notebook-lang-5.7.7-bp151.3.3.1 python2-jupyter_notebook-latex-5.7.7-bp151.3.3.1 python3-jupyter_notebook-5.7.7-bp151.3.3.1 python3-jupyter_notebook-lang-5.7.7-bp151.3.3.1 python3-jupyter_notebook-latex-5.7.7-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-26215.html https://bugzilla.suse.com/1180458

1 0

openSUSE-SU-2021:0119-1: moderate: Security update for viewvc
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for viewvc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0119-1 Rating: moderate References: #1167974 Cross-References: CVE-2020-5283 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for viewvc fixes the following issues: - update to 1.1.28 (boo#1167974, CVE-2020-5283): * security fix: escape subdir lastmod file name (#211) * fix standalone.py first request failure (#195) * suppress stack traces (with option to show) (#140) * distinguish text/binary/image files by icons (#166, #175) * colorize alternating file content lines (#167) * link to the instance root from the ViewVC logo (#168) * display directory and root counts, too (#169) * fix double fault error in standalone.py (#157) * support timezone offsets with minutes piece (#176) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-119=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): viewvc-1.1.28-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-5283.html https://bugzilla.suse.com/1167974

1 0

openSUSE-SU-2021:0106-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 18 Jan '21

18 Jan '21

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0106-1 Rating: moderate References: #1180706 Cross-References: CVE-2020-7071 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issue: - CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-106=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.12.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.12.1 php7-7.4.6-lp152.2.12.1 php7-bcmath-7.4.6-lp152.2.12.1 php7-bcmath-debuginfo-7.4.6-lp152.2.12.1 php7-bz2-7.4.6-lp152.2.12.1 php7-bz2-debuginfo-7.4.6-lp152.2.12.1 php7-calendar-7.4.6-lp152.2.12.1 php7-calendar-debuginfo-7.4.6-lp152.2.12.1 php7-ctype-7.4.6-lp152.2.12.1 php7-ctype-debuginfo-7.4.6-lp152.2.12.1 php7-curl-7.4.6-lp152.2.12.1 php7-curl-debuginfo-7.4.6-lp152.2.12.1 php7-dba-7.4.6-lp152.2.12.1 php7-dba-debuginfo-7.4.6-lp152.2.12.1 php7-debuginfo-7.4.6-lp152.2.12.1 php7-debugsource-7.4.6-lp152.2.12.1 php7-devel-7.4.6-lp152.2.12.1 php7-dom-7.4.6-lp152.2.12.1 php7-dom-debuginfo-7.4.6-lp152.2.12.1 php7-embed-7.4.6-lp152.2.12.1 php7-embed-debuginfo-7.4.6-lp152.2.12.1 php7-enchant-7.4.6-lp152.2.12.1 php7-enchant-debuginfo-7.4.6-lp152.2.12.1 php7-exif-7.4.6-lp152.2.12.1 php7-exif-debuginfo-7.4.6-lp152.2.12.1 php7-fastcgi-7.4.6-lp152.2.12.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.12.1 php7-fileinfo-7.4.6-lp152.2.12.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.12.1 php7-firebird-7.4.6-lp152.2.12.1 php7-firebird-debuginfo-7.4.6-lp152.2.12.1 php7-fpm-7.4.6-lp152.2.12.1 php7-fpm-debuginfo-7.4.6-lp152.2.12.1 php7-ftp-7.4.6-lp152.2.12.1 php7-ftp-debuginfo-7.4.6-lp152.2.12.1 php7-gd-7.4.6-lp152.2.12.1 php7-gd-debuginfo-7.4.6-lp152.2.12.1 php7-gettext-7.4.6-lp152.2.12.1 php7-gettext-debuginfo-7.4.6-lp152.2.12.1 php7-gmp-7.4.6-lp152.2.12.1 php7-gmp-debuginfo-7.4.6-lp152.2.12.1 php7-iconv-7.4.6-lp152.2.12.1 php7-iconv-debuginfo-7.4.6-lp152.2.12.1 php7-intl-7.4.6-lp152.2.12.1 php7-intl-debuginfo-7.4.6-lp152.2.12.1 php7-json-7.4.6-lp152.2.12.1 php7-json-debuginfo-7.4.6-lp152.2.12.1 php7-ldap-7.4.6-lp152.2.12.1 php7-ldap-debuginfo-7.4.6-lp152.2.12.1 php7-mbstring-7.4.6-lp152.2.12.1 php7-mbstring-debuginfo-7.4.6-lp152.2.12.1 php7-mysql-7.4.6-lp152.2.12.1 php7-mysql-debuginfo-7.4.6-lp152.2.12.1 php7-odbc-7.4.6-lp152.2.12.1 php7-odbc-debuginfo-7.4.6-lp152.2.12.1 php7-opcache-7.4.6-lp152.2.12.1 php7-opcache-debuginfo-7.4.6-lp152.2.12.1 php7-openssl-7.4.6-lp152.2.12.1 php7-openssl-debuginfo-7.4.6-lp152.2.12.1 php7-pcntl-7.4.6-lp152.2.12.1 php7-pcntl-debuginfo-7.4.6-lp152.2.12.1 php7-pdo-7.4.6-lp152.2.12.1 php7-pdo-debuginfo-7.4.6-lp152.2.12.1 php7-pgsql-7.4.6-lp152.2.12.1 php7-pgsql-debuginfo-7.4.6-lp152.2.12.1 php7-phar-7.4.6-lp152.2.12.1 php7-phar-debuginfo-7.4.6-lp152.2.12.1 php7-posix-7.4.6-lp152.2.12.1 php7-posix-debuginfo-7.4.6-lp152.2.12.1 php7-readline-7.4.6-lp152.2.12.1 php7-readline-debuginfo-7.4.6-lp152.2.12.1 php7-shmop-7.4.6-lp152.2.12.1 php7-shmop-debuginfo-7.4.6-lp152.2.12.1 php7-snmp-7.4.6-lp152.2.12.1 php7-snmp-debuginfo-7.4.6-lp152.2.12.1 php7-soap-7.4.6-lp152.2.12.1 php7-soap-debuginfo-7.4.6-lp152.2.12.1 php7-sockets-7.4.6-lp152.2.12.1 php7-sockets-debuginfo-7.4.6-lp152.2.12.1 php7-sodium-7.4.6-lp152.2.12.1 php7-sodium-debuginfo-7.4.6-lp152.2.12.1 php7-sqlite-7.4.6-lp152.2.12.1 php7-sqlite-debuginfo-7.4.6-lp152.2.12.1 php7-sysvmsg-7.4.6-lp152.2.12.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.12.1 php7-sysvsem-7.4.6-lp152.2.12.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.12.1 php7-sysvshm-7.4.6-lp152.2.12.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.12.1 php7-test-7.4.6-lp152.2.12.1 php7-tidy-7.4.6-lp152.2.12.1 php7-tidy-debuginfo-7.4.6-lp152.2.12.1 php7-tokenizer-7.4.6-lp152.2.12.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.12.1 php7-xmlreader-7.4.6-lp152.2.12.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.12.1 php7-xmlrpc-7.4.6-lp152.2.12.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.12.1 php7-xmlwriter-7.4.6-lp152.2.12.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.12.1 php7-xsl-7.4.6-lp152.2.12.1 php7-xsl-debuginfo-7.4.6-lp152.2.12.1 php7-zip-7.4.6-lp152.2.12.1 php7-zip-debuginfo-7.4.6-lp152.2.12.1 php7-zlib-7.4.6-lp152.2.12.1 php7-zlib-debuginfo-7.4.6-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-7071.html https://bugzilla.suse.com/1180706

1 0

openSUSE-SU-2021:0107-1: moderate: Security update for openldap2
by opensuse-security＠opensuse.org 18 Jan '21

18 Jan '21

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0107-1 Rating: moderate References: #1178909 #1179503 Cross-References: CVE-2020-25709 CVE-2020-25710 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openldap2 fixes the following issues: Security issues fixed: - CVE-2020-25709: Fixed a crash caused by specially crafted network traffic (bsc#1178909). - CVE-2020-25710: Fixed a crash caused by specially crafted network traffic (bsc#1178909). Non-security issue fixed: - Retry binds in the LDAP backend when the remote LDAP server disconnected the (idle) LDAP connection. (bsc#1179503) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-107=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libldap-2_4-2-2.4.46-lp152.14.15.1 libldap-2_4-2-debuginfo-2.4.46-lp152.14.15.1 openldap2-2.4.46-lp152.14.15.1 openldap2-back-meta-2.4.46-lp152.14.15.1 openldap2-back-meta-debuginfo-2.4.46-lp152.14.15.1 openldap2-back-perl-2.4.46-lp152.14.15.1 openldap2-back-perl-debuginfo-2.4.46-lp152.14.15.1 openldap2-back-sock-2.4.46-lp152.14.15.1 openldap2-back-sock-debuginfo-2.4.46-lp152.14.15.1 openldap2-back-sql-2.4.46-lp152.14.15.1 openldap2-back-sql-debuginfo-2.4.46-lp152.14.15.1 openldap2-client-2.4.46-lp152.14.15.1 openldap2-client-debuginfo-2.4.46-lp152.14.15.1 openldap2-contrib-2.4.46-lp152.14.15.1 openldap2-contrib-debuginfo-2.4.46-lp152.14.15.1 openldap2-debuginfo-2.4.46-lp152.14.15.1 openldap2-debugsource-2.4.46-lp152.14.15.1 openldap2-devel-2.4.46-lp152.14.15.1 openldap2-devel-static-2.4.46-lp152.14.15.1 openldap2-ppolicy-check-password-1.2-lp152.14.15.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp152.14.15.1 - openSUSE Leap 15.2 (noarch): libldap-data-2.4.46-lp152.14.15.1 openldap2-doc-2.4.46-lp152.14.15.1 - openSUSE Leap 15.2 (x86_64): libldap-2_4-2-32bit-2.4.46-lp152.14.15.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp152.14.15.1 openldap2-devel-32bit-2.4.46-lp152.14.15.1 References: https://www.suse.com/security/cve/CVE-2020-25709.html https://www.suse.com/security/cve/CVE-2020-25710.html https://bugzilla.suse.com/1178909 https://bugzilla.suse.com/1179503

1 0

openSUSE-SU-2021:0101-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0101-1 Rating: moderate References: #1180706 Cross-References: CVE-2020-7071 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issue: - CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-101=1 Package List: - openSUSE Leap 15.1 (x86_64): apache2-mod_php7-7.2.5-lp151.6.39.1 apache2-mod_php7-debuginfo-7.2.5-lp151.6.39.1 php7-7.2.5-lp151.6.39.1 php7-bcmath-7.2.5-lp151.6.39.1 php7-bcmath-debuginfo-7.2.5-lp151.6.39.1 php7-bz2-7.2.5-lp151.6.39.1 php7-bz2-debuginfo-7.2.5-lp151.6.39.1 php7-calendar-7.2.5-lp151.6.39.1 php7-calendar-debuginfo-7.2.5-lp151.6.39.1 php7-ctype-7.2.5-lp151.6.39.1 php7-ctype-debuginfo-7.2.5-lp151.6.39.1 php7-curl-7.2.5-lp151.6.39.1 php7-curl-debuginfo-7.2.5-lp151.6.39.1 php7-dba-7.2.5-lp151.6.39.1 php7-dba-debuginfo-7.2.5-lp151.6.39.1 php7-debuginfo-7.2.5-lp151.6.39.1 php7-debugsource-7.2.5-lp151.6.39.1 php7-devel-7.2.5-lp151.6.39.1 php7-dom-7.2.5-lp151.6.39.1 php7-dom-debuginfo-7.2.5-lp151.6.39.1 php7-embed-7.2.5-lp151.6.39.1 php7-embed-debuginfo-7.2.5-lp151.6.39.1 php7-enchant-7.2.5-lp151.6.39.1 php7-enchant-debuginfo-7.2.5-lp151.6.39.1 php7-exif-7.2.5-lp151.6.39.1 php7-exif-debuginfo-7.2.5-lp151.6.39.1 php7-fastcgi-7.2.5-lp151.6.39.1 php7-fastcgi-debuginfo-7.2.5-lp151.6.39.1 php7-fileinfo-7.2.5-lp151.6.39.1 php7-fileinfo-debuginfo-7.2.5-lp151.6.39.1 php7-firebird-7.2.5-lp151.6.39.1 php7-firebird-debuginfo-7.2.5-lp151.6.39.1 php7-fpm-7.2.5-lp151.6.39.1 php7-fpm-debuginfo-7.2.5-lp151.6.39.1 php7-ftp-7.2.5-lp151.6.39.1 php7-ftp-debuginfo-7.2.5-lp151.6.39.1 php7-gd-7.2.5-lp151.6.39.1 php7-gd-debuginfo-7.2.5-lp151.6.39.1 php7-gettext-7.2.5-lp151.6.39.1 php7-gettext-debuginfo-7.2.5-lp151.6.39.1 php7-gmp-7.2.5-lp151.6.39.1 php7-gmp-debuginfo-7.2.5-lp151.6.39.1 php7-iconv-7.2.5-lp151.6.39.1 php7-iconv-debuginfo-7.2.5-lp151.6.39.1 php7-intl-7.2.5-lp151.6.39.1 php7-intl-debuginfo-7.2.5-lp151.6.39.1 php7-json-7.2.5-lp151.6.39.1 php7-json-debuginfo-7.2.5-lp151.6.39.1 php7-ldap-7.2.5-lp151.6.39.1 php7-ldap-debuginfo-7.2.5-lp151.6.39.1 php7-mbstring-7.2.5-lp151.6.39.1 php7-mbstring-debuginfo-7.2.5-lp151.6.39.1 php7-mysql-7.2.5-lp151.6.39.1 php7-mysql-debuginfo-7.2.5-lp151.6.39.1 php7-odbc-7.2.5-lp151.6.39.1 php7-odbc-debuginfo-7.2.5-lp151.6.39.1 php7-opcache-7.2.5-lp151.6.39.1 php7-opcache-debuginfo-7.2.5-lp151.6.39.1 php7-openssl-7.2.5-lp151.6.39.1 php7-openssl-debuginfo-7.2.5-lp151.6.39.1 php7-pcntl-7.2.5-lp151.6.39.1 php7-pcntl-debuginfo-7.2.5-lp151.6.39.1 php7-pdo-7.2.5-lp151.6.39.1 php7-pdo-debuginfo-7.2.5-lp151.6.39.1 php7-pgsql-7.2.5-lp151.6.39.1 php7-pgsql-debuginfo-7.2.5-lp151.6.39.1 php7-phar-7.2.5-lp151.6.39.1 php7-phar-debuginfo-7.2.5-lp151.6.39.1 php7-posix-7.2.5-lp151.6.39.1 php7-posix-debuginfo-7.2.5-lp151.6.39.1 php7-readline-7.2.5-lp151.6.39.1 php7-readline-debuginfo-7.2.5-lp151.6.39.1 php7-shmop-7.2.5-lp151.6.39.1 php7-shmop-debuginfo-7.2.5-lp151.6.39.1 php7-snmp-7.2.5-lp151.6.39.1 php7-snmp-debuginfo-7.2.5-lp151.6.39.1 php7-soap-7.2.5-lp151.6.39.1 php7-soap-debuginfo-7.2.5-lp151.6.39.1 php7-sockets-7.2.5-lp151.6.39.1 php7-sockets-debuginfo-7.2.5-lp151.6.39.1 php7-sodium-7.2.5-lp151.6.39.1 php7-sodium-debuginfo-7.2.5-lp151.6.39.1 php7-sqlite-7.2.5-lp151.6.39.1 php7-sqlite-debuginfo-7.2.5-lp151.6.39.1 php7-sysvmsg-7.2.5-lp151.6.39.1 php7-sysvmsg-debuginfo-7.2.5-lp151.6.39.1 php7-sysvsem-7.2.5-lp151.6.39.1 php7-sysvsem-debuginfo-7.2.5-lp151.6.39.1 php7-sysvshm-7.2.5-lp151.6.39.1 php7-sysvshm-debuginfo-7.2.5-lp151.6.39.1 php7-test-7.2.5-lp151.6.39.1 php7-tidy-7.2.5-lp151.6.39.1 php7-tidy-debuginfo-7.2.5-lp151.6.39.1 php7-tokenizer-7.2.5-lp151.6.39.1 php7-tokenizer-debuginfo-7.2.5-lp151.6.39.1 php7-wddx-7.2.5-lp151.6.39.1 php7-wddx-debuginfo-7.2.5-lp151.6.39.1 php7-xmlreader-7.2.5-lp151.6.39.1 php7-xmlreader-debuginfo-7.2.5-lp151.6.39.1 php7-xmlrpc-7.2.5-lp151.6.39.1 php7-xmlrpc-debuginfo-7.2.5-lp151.6.39.1 php7-xmlwriter-7.2.5-lp151.6.39.1 php7-xmlwriter-debuginfo-7.2.5-lp151.6.39.1 php7-xsl-7.2.5-lp151.6.39.1 php7-xsl-debuginfo-7.2.5-lp151.6.39.1 php7-zip-7.2.5-lp151.6.39.1 php7-zip-debuginfo-7.2.5-lp151.6.39.1 php7-zlib-7.2.5-lp151.6.39.1 php7-zlib-debuginfo-7.2.5-lp151.6.39.1 - openSUSE Leap 15.1 (noarch): php7-pear-7.2.5-lp151.6.39.1 php7-pear-Archive_Tar-7.2.5-lp151.6.39.1 References: https://www.suse.com/security/cve/CVE-2020-7071.html https://bugzilla.suse.com/1180706

1 0

openSUSE-SU-2021:0102-1: moderate: Security update for openldap2
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0102-1 Rating: moderate References: #1178909 #1179503 Cross-References: CVE-2020-25709 CVE-2020-25710 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openldap2 fixes the following issues: Security issues fixed: - CVE-2020-25709: Fixed a crash caused by specially crafted network traffic (bsc#1178909). - CVE-2020-25710: Fixed a crash caused by specially crafted network traffic (bsc#1178909). Non-security issue fixed: - Retry binds in the LDAP backend when the remote LDAP server disconnected the (idle) LDAP connection. (bsc#1179503) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-102=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libldap-2_4-2-2.4.46-lp151.10.24.1 libldap-2_4-2-debuginfo-2.4.46-lp151.10.24.1 openldap2-2.4.46-lp151.10.24.1 openldap2-back-meta-2.4.46-lp151.10.24.1 openldap2-back-meta-debuginfo-2.4.46-lp151.10.24.1 openldap2-back-perl-2.4.46-lp151.10.24.1 openldap2-back-perl-debuginfo-2.4.46-lp151.10.24.1 openldap2-back-sock-2.4.46-lp151.10.24.1 openldap2-back-sock-debuginfo-2.4.46-lp151.10.24.1 openldap2-back-sql-2.4.46-lp151.10.24.1 openldap2-back-sql-debuginfo-2.4.46-lp151.10.24.1 openldap2-client-2.4.46-lp151.10.24.1 openldap2-client-debuginfo-2.4.46-lp151.10.24.1 openldap2-contrib-2.4.46-lp151.10.24.1 openldap2-contrib-debuginfo-2.4.46-lp151.10.24.1 openldap2-debuginfo-2.4.46-lp151.10.24.1 openldap2-debugsource-2.4.46-lp151.10.24.1 openldap2-devel-2.4.46-lp151.10.24.1 openldap2-devel-static-2.4.46-lp151.10.24.1 openldap2-ppolicy-check-password-1.2-lp151.10.24.1 openldap2-ppolicy-check-password-debuginfo-1.2-lp151.10.24.1 - openSUSE Leap 15.1 (x86_64): libldap-2_4-2-32bit-2.4.46-lp151.10.24.1 libldap-2_4-2-32bit-debuginfo-2.4.46-lp151.10.24.1 openldap2-devel-32bit-2.4.46-lp151.10.24.1 - openSUSE Leap 15.1 (noarch): libldap-data-2.4.46-lp151.10.24.1 openldap2-doc-2.4.46-lp151.10.24.1 References: https://www.suse.com/security/cve/CVE-2020-25709.html https://www.suse.com/security/cve/CVE-2020-25710.html https://bugzilla.suse.com/1178909 https://bugzilla.suse.com/1179503

1 0

openSUSE-SU-2021:0097-1: important: Security update for tcmu-runner
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for tcmu-runner ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0097-1 Rating: important References: #1180676 Cross-References: CVE-2021-3139 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tcmu-runner fixes the following issues: - CVE-2021-3139: Fixed a LIO security issue (bsc#1180676). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-97=1 Package List: - openSUSE Leap 15.2 (x86_64): libtcmu2-1.5.2-lp152.2.3.1 libtcmu2-debuginfo-1.5.2-lp152.2.3.1 tcmu-runner-1.5.2-lp152.2.3.1 tcmu-runner-debuginfo-1.5.2-lp152.2.3.1 tcmu-runner-debugsource-1.5.2-lp152.2.3.1 tcmu-runner-handler-rbd-1.5.2-lp152.2.3.1 tcmu-runner-handler-rbd-debuginfo-1.5.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3139.html https://bugzilla.suse.com/1180676

1 0

openSUSE-SU-2021:0096-1: important: Security update for slurm_18_08
by opensuse-security＠opensuse.org 17 Jan '21

17 Jan '21

openSUSE Security Update: Security update for slurm_18_08 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0096-1 Rating: important References: #1178890 #1178891 Cross-References: CVE-2020-27745 CVE-2020-27746 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for slurm_18_08 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem (bsc#1178890). - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command (bsc#1178891). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-96=1 Package List: - openSUSE Leap 15.2 (x86_64): libpmi0-18.08.9-lp152.5.1 libpmi0-debuginfo-18.08.9-lp152.5.1 libslurm33-18.08.9-lp152.5.1 libslurm33-debuginfo-18.08.9-lp152.5.1 perl-slurm-18.08.9-lp152.5.1 perl-slurm-debuginfo-18.08.9-lp152.5.1 slurm-18.08.9-lp152.5.1 slurm-auth-none-18.08.9-lp152.5.1 slurm-auth-none-debuginfo-18.08.9-lp152.5.1 slurm-config-18.08.9-lp152.5.1 slurm-config-man-18.08.9-lp152.5.1 slurm-cray-18.08.9-lp152.5.1 slurm-cray-debuginfo-18.08.9-lp152.5.1 slurm-debuginfo-18.08.9-lp152.5.1 slurm-debugsource-18.08.9-lp152.5.1 slurm-devel-18.08.9-lp152.5.1 slurm-doc-18.08.9-lp152.5.1 slurm-hdf5-18.08.9-lp152.5.1 slurm-hdf5-debuginfo-18.08.9-lp152.5.1 slurm-lua-18.08.9-lp152.5.1 slurm-lua-debuginfo-18.08.9-lp152.5.1 slurm-munge-18.08.9-lp152.5.1 slurm-munge-debuginfo-18.08.9-lp152.5.1 slurm-node-18.08.9-lp152.5.1 slurm-node-debuginfo-18.08.9-lp152.5.1 slurm-openlava-18.08.9-lp152.5.1 slurm-pam_slurm-18.08.9-lp152.5.1 slurm-pam_slurm-debuginfo-18.08.9-lp152.5.1 slurm-plugins-18.08.9-lp152.5.1 slurm-plugins-debuginfo-18.08.9-lp152.5.1 slurm-seff-18.08.9-lp152.5.1 slurm-sjstat-18.08.9-lp152.5.1 slurm-slurmdbd-18.08.9-lp152.5.1 slurm-slurmdbd-debuginfo-18.08.9-lp152.5.1 slurm-sql-18.08.9-lp152.5.1 slurm-sql-debuginfo-18.08.9-lp152.5.1 slurm-sview-18.08.9-lp152.5.1 slurm-sview-debuginfo-18.08.9-lp152.5.1 slurm-torque-18.08.9-lp152.5.1 slurm-torque-debuginfo-18.08.9-lp152.5.1 slurm-webdoc-18.08.9-lp152.5.1 References: https://www.suse.com/security/cve/CVE-2020-27745.html https://www.suse.com/security/cve/CVE-2020-27746.html https://bugzilla.suse.com/1178890 https://bugzilla.suse.com/1178891

1 0

openSUSE-SU-2021:0089-1: important: Security update for open-iscsi
by opensuse-security＠opensuse.org 16 Jan '21

16 Jan '21

openSUSE Security Update: Security update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0089-1 Rating: important References: #1179440 #1179908 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for open-iscsi fixes the following issues: - Updated to upstream version 2.1.3 as 2.1.3-suse, for bsc#1179908, including: * uip: check for TCP urgent pointer past end of frame * uip: check for u8 overflow when processing TCP options * uip: check for header length underflow during checksum calculation * fwparam_ppc: Fix memory leak in fwparam_ppc.c * iscsiuio: Remove unused macro IFNAMSIZ defined in iscsid_ipc.c * fwparam_ppc: Fix illegal memory access in fwparam_ppc.c * sysfs: Verify parameter of sysfs_device_get() * fwparam_ppc: Fix NULL pointer dereference in find_devtree() * open-iscsi: Clean user_param list when process exit * iscsi_net_util: Fix NULL pointer dereference in find_vlan_dev() * open-iscsi: Fix NULL pointer dereference in mgmt_ipc_read_req() * open-iscsi: Fix invalid pointer deference in find_initiator() * iscsiuio: Fix invalid parameter when call fstat() * iscsi-iname: Verify open() return value before calling read() * iscsi_sysfs: Fix NULL pointer deference in iscsi_sysfs_read_iface - Updatged to latest upstream, including: * iscsiadm: Optimize the the verification of mode paramters * iscsid: Poll timeout value to 1 minute for iscsid * iscsiadm: fix host stats mode coredump * iscsid: fix logging level when starting and shutting down daemon * Updated iscsiadm man page. * Fix memory leak in sysfs_get_str * libopeniscsiusr: Compare with max int instead of max long - Systemd unit files should not depend on network.target (bsc#1179440). - Updated to latest upstream, including async login ability: * Implement login "no_wait" for iscsiadm NODE mode * iscsiadm buffer overflow regression when discovering many targets at once * iscsid: Check Invalid Session id for stop connection * Add ability to attempt target logins asynchronously - %service_del_postun_without_restart is now available on SLE More accurately it's been introduced in SLE12-SP2+ and SLE15+ This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-89=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): iscsiuio-0.7.8.6-lp152.18.6.1 iscsiuio-debuginfo-0.7.8.6-lp152.18.6.1 libopeniscsiusr0_2_0-2.1.3-lp152.18.6.1 libopeniscsiusr0_2_0-debuginfo-2.1.3-lp152.18.6.1 open-iscsi-2.1.3-lp152.18.6.1 open-iscsi-debuginfo-2.1.3-lp152.18.6.1 open-iscsi-debugsource-2.1.3-lp152.18.6.1 open-iscsi-devel-2.1.3-lp152.18.6.1 References: https://bugzilla.suse.com/1179440 https://bugzilla.suse.com/1179908

1 0