October 2021 - openSUSE Security Announce

openSUSE-SU-2021:1400-1: important: Security update for flatpak
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1400-1 Rating: important References: #1191507 Cross-References: CVE-2021-41133 CVSS scores: CVE-2021-41133 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flatpak fixes the following issues: - Update to version 1.10.5: - CVE-2021-41133: Fixed a bug that could lead to sandbox bypass via recent VFS-manipulating syscalls. (bsc#1191507) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1400=1 Package List: - openSUSE Leap 15.2 (x86_64): flatpak-1.10.5-lp152.3.9.1 flatpak-debuginfo-1.10.5-lp152.3.9.1 flatpak-debugsource-1.10.5-lp152.3.9.1 flatpak-devel-1.10.5-lp152.3.9.1 flatpak-zsh-completion-1.10.5-lp152.3.9.1 libflatpak0-1.10.5-lp152.3.9.1 libflatpak0-debuginfo-1.10.5-lp152.3.9.1 system-user-flatpak-1.10.5-lp152.3.9.1 typelib-1_0-Flatpak-1_0-1.10.5-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-41133.html https://bugzilla.suse.com/1191507

1 0

openSUSE-SU-2021:1418-1: moderate: Security update for python
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1418-1 Rating: moderate References: #1189241 #1189287 Cross-References: CVE-2021-3733 CVE-2021-3737 CVSS scores: CVE-2021-3733 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3737 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: - CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241) - CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1418=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpython2_7-1_0-2.7.18-lp152.3.21.1 libpython2_7-1_0-debuginfo-2.7.18-lp152.3.21.1 python-2.7.18-lp152.3.21.1 python-base-2.7.18-lp152.3.21.1 python-base-debuginfo-2.7.18-lp152.3.21.1 python-base-debugsource-2.7.18-lp152.3.21.1 python-curses-2.7.18-lp152.3.21.1 python-curses-debuginfo-2.7.18-lp152.3.21.1 python-debuginfo-2.7.18-lp152.3.21.1 python-debugsource-2.7.18-lp152.3.21.1 python-demo-2.7.18-lp152.3.21.1 python-devel-2.7.18-lp152.3.21.1 python-gdbm-2.7.18-lp152.3.21.1 python-gdbm-debuginfo-2.7.18-lp152.3.21.1 python-idle-2.7.18-lp152.3.21.1 python-tk-2.7.18-lp152.3.21.1 python-tk-debuginfo-2.7.18-lp152.3.21.1 python-xml-2.7.18-lp152.3.21.1 python-xml-debuginfo-2.7.18-lp152.3.21.1 - openSUSE Leap 15.2 (noarch): python-doc-2.7.18-lp152.3.21.1 python-doc-pdf-2.7.18-lp152.3.21.1 - openSUSE Leap 15.2 (x86_64): libpython2_7-1_0-32bit-2.7.18-lp152.3.21.1 libpython2_7-1_0-32bit-debuginfo-2.7.18-lp152.3.21.1 python-32bit-2.7.18-lp152.3.21.1 python-32bit-debuginfo-2.7.18-lp152.3.21.1 python-base-32bit-2.7.18-lp152.3.21.1 python-base-32bit-debuginfo-2.7.18-lp152.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-3733.html https://www.suse.com/security/cve/CVE-2021-3737.html https://bugzilla.suse.com/1189241 https://bugzilla.suse.com/1189287

1 0

openSUSE-SU-2021:1424-1: moderate: Security update for civetweb
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for civetweb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1424-1 Rating: moderate References: #1191938 Cross-References: CVE-2020-27304 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for civetweb fixes the following issues: Version 1.15: * boo#1191938 / CVE-2020-27304: missing uploaded filepath validation in the default form-based file upload mechanism * New configuration for URL decoding * Sanitize filenames in handle form * Example ��embedded_c.c��: Do not overwrite files (possible security issue) * Remove obsolete examples * Remove ��experimental�� label for some features * Remove MG_LEGACY_INTERFACE that have been declared obsolete in 2017 or earlier * Modifications to build scripts, required due to changes in the test environment * Unix domain socket support fixed * Fixes for NO_SSL_DL * Fixes for some warnings / static code analysis Version 1.14: * Change SSL default setting to use TLS 1.2 as minimum (set config if you need an earlier version) * Add local_uri_raw field (not sanitized URI) to request_info * Additional API functions and a callback after closing connections * Allow mbedTLS as OpenSSL alternative (basic functionality) * Add OpenSSL 3.0 support (OpenSSL 3.0 Alpha 13) * Support UNIX/Linux domain sockets * Fuzz tests and ossfuzz integration * Compression for websockets * Restructure some source files * Improve documentation * Fix HTTP range requests * Add some functions for Lua scripts/LSP * Build system specific fixes (CMake, MinGW) * Update 3rd party components (Lua, lfs, sqlite) * Allow Lua background script to use timers, format and filter logs * Remove WinCE code * Update version number Version 1.13: * Add arguments for CGI interpreters * Support multiple CGi interpreters * Buffering HTTP response headers, including API functions mg_response_header_* in C and Lua * Additional C API functions * Fix some memory leaks * Extended use of atomic operations (e.g., for server stats) * Add fuzz tests * Set OpenSSL 1.1 API as default (from 1.0) * Add Lua 5.4 support and deprecate Lua 5.1 * Provide additional Lua API functions * Fix Lua websocket memory leak when closing the server * Remove obsolete "file in memory" implementation * Improvements and fixes in documentation * Fixes from static source code analysis * Additional unit tests * Various small bug fixes * Experimental support for some HTTP2 features (not ready for production) * Experimental support for websocket compression * Remove legacy interfaces declared obsolete since more than 3 years Version 1.12 * See https://github.com/civetweb/civetweb/releases/tag/v1.12 for detailed changelog Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1424=1 Package List: - openSUSE Leap 15.2 (x86_64): civetweb-1.15-lp152.2.3.1 civetweb-debuginfo-1.15-lp152.2.3.1 civetweb-debugsource-1.15-lp152.2.3.1 civetweb-devel-1.15-lp152.2.3.1 libcivetweb-cpp1_15_0-1.15-lp152.2.3.1 libcivetweb-cpp1_15_0-debuginfo-1.15-lp152.2.3.1 libcivetweb1_15_0-1.15-lp152.2.3.1 libcivetweb1_15_0-debuginfo-1.15-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-27304.html https://bugzilla.suse.com/1191938

1 0

openSUSE-SU-2021:1425-1: moderate: Security update for wireguard-tools
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for wireguard-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1425-1 Rating: moderate References: #1191224 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for wireguard-tools fixes the following issues: - Removed world-readable permissions from /etc/wireguard (bsc#1191224) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1425=1 Package List: - openSUSE Leap 15.2 (x86_64): wireguard-tools-1.0.20200827-lp152.2.6.1 wireguard-tools-debuginfo-1.0.20200827-lp152.2.6.1 wireguard-tools-debugsource-1.0.20200827-lp152.2.6.1 References: https://bugzilla.suse.com/1191224

1 0

openSUSE-SU-2021:1419-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1419-1 Rating: moderate References: #1189403 Cross-References: CVE-2021-28116 CVSS scores: CVE-2021-28116 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-28116 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for squid fixes the following issues: Update to version 4.17: - CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1419=1 Package List: - openSUSE Leap 15.2 (x86_64): squid-4.17-lp152.2.12.1 squid-debuginfo-4.17-lp152.2.12.1 squid-debugsource-4.17-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-28116.html https://bugzilla.suse.com/1189403

1 0

openSUSE-SU-2021:1403-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 31 Oct '21

31 Oct '21

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1403-1 Rating: important References: #1191104 #1191526 #1191869 Cross-References: CVE-2021-2475 CVE-2021-35538 CVE-2021-35540 CVE-2021-35542 CVE-2021-35545 CVSS scores: CVE-2021-2475 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-35538 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-35540 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-35542 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-35545 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for virtualbox fixes the following issues: Version bump to 6.1.28 (released October 19 2021 by Oracle) This is a maintenance release. The following items were fixed and/or added: - VMM: Fixed guru meditation while booting nested-guests accessing debug registers under certain conditions - UI: Bug fixes for touchpad-based scrolling - VMSVGA: Fixed VM black screen issue on first resize after restoring from saved state (bug #20067) - VMSVGA: Fixed display corruption on Linux Mint (bug #20513) - Storage: Fixed a possible write error under certain circumstances when using VHD images (bug #20512) - Network: Multiple updates in virtio-net device support - Network: Disconnecting cable in saved VM state now is handled properly by virtio-net - Network: More administrative control over network ranges, see user manual - NAT: Fixed not rejecting TFTP requests with absolute pathnames (bug #20589) - Audio: Fixed VM session aborting after PC hibernation (bug #20516) - Audio: Fixed setting the line-in volume of the HDA emulation on modern Linux guests - Audio: Fixed resuming playback of the AC'97 emulation while a snapshot has been taken - API: Added bindings support for Python 3.9 (bug #20252) - API: Fixed rare hang of VM when changing settings at runtime - Linux host: Improved kernel modules installation detection which prevents unnecessary modules rebuild - Host Services: Shared Clipboard: Prevent guest clipboard reset when clipboard sharing is disabled (bug #20487) - Host Services: Shared Clipboard over VRDP: Fixed to continue working when guest service reconnects to host (bug #20366) - Host Services: Shared Clipboard over VRDP: Fixed preventing remote RDP client to hang when guest has no clipboard data to report - Linux Host and Guest: Introduced initial support for kernels 5.14 and 5.15 - Linux Host and Guest: Introduced initial support for RHEL 8.5 kernel - Windows Guest: Introduced Windows 11 guest support, including unattended installation - Fixes CVE-2021-35538, CVE-2021-35545, CVE-2021-35540, CVE-2021-35542, and CVE-2021-2475 (boo#1191869) - Use kernel_module_directory macro for kernel modules (boo#1191526) - Finish UsrMerge for VirtualBox components (boo#1191104). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1403=1 Package List: - openSUSE Leap 15.2 (noarch): virtualbox-guest-desktop-icons-6.1.28-lp152.2.38.1 virtualbox-guest-source-6.1.28-lp152.2.38.1 virtualbox-host-source-6.1.28-lp152.2.38.1 - openSUSE Leap 15.2 (x86_64): python3-virtualbox-6.1.28-lp152.2.38.1 python3-virtualbox-debuginfo-6.1.28-lp152.2.38.1 virtualbox-6.1.28-lp152.2.38.1 virtualbox-debuginfo-6.1.28-lp152.2.38.1 virtualbox-debugsource-6.1.28-lp152.2.38.1 virtualbox-devel-6.1.28-lp152.2.38.1 virtualbox-guest-tools-6.1.28-lp152.2.38.1 virtualbox-guest-tools-debuginfo-6.1.28-lp152.2.38.1 virtualbox-guest-x11-6.1.28-lp152.2.38.1 virtualbox-guest-x11-debuginfo-6.1.28-lp152.2.38.1 virtualbox-kmp-debugsource-6.1.28-lp152.2.38.1 virtualbox-kmp-default-6.1.28_k5.3.18_lp152.95-lp152.2.38.1 virtualbox-kmp-default-debuginfo-6.1.28_k5.3.18_lp152.95-lp152.2.38.1 virtualbox-kmp-preempt-6.1.28_k5.3.18_lp152.95-lp152.2.38.1 virtualbox-kmp-preempt-debuginfo-6.1.28_k5.3.18_lp152.95-lp152.2.38.1 virtualbox-qt-6.1.28-lp152.2.38.1 virtualbox-qt-debuginfo-6.1.28-lp152.2.38.1 virtualbox-vnc-6.1.28-lp152.2.38.1 virtualbox-websrv-6.1.28-lp152.2.38.1 virtualbox-websrv-debuginfo-6.1.28-lp152.2.38.1 References: https://www.suse.com/security/cve/CVE-2021-2475.html https://www.suse.com/security/cve/CVE-2021-35538.html https://www.suse.com/security/cve/CVE-2021-35540.html https://www.suse.com/security/cve/CVE-2021-35542.html https://www.suse.com/security/cve/CVE-2021-35545.html https://bugzilla.suse.com/1191104 https://bugzilla.suse.com/1191526 https://bugzilla.suse.com/1191869

1 0

openSUSE-SU-2021:1396-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Oct '21

30 Oct '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1396-1 Rating: important References: #1191844 Cross-References: CVE-2021-37981 CVE-2021-37982 CVE-2021-37983 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989 CVE-2021-37990 CVE-2021-37991 CVE-2021-37992 CVE-2021-37993 CVE-2021-37994 CVE-2021-37995 CVE-2021-37996 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 95.0.4638.54 (boo#1191844): * CVE-2021-37981: Heap buffer overflow in Skia * CVE-2021-37982: Use after free in Incognito * CVE-2021-37983: Use after free in Dev Tools * CVE-2021-37984: Heap buffer overflow in PDFium * CVE-2021-37985: Use after free in V8 * CVE-2021-37986: Heap buffer overflow in Settings * CVE-2021-37987: Use after free in Network APIs * CVE-2021-37988: Use after free in Profiles * CVE-2021-37989: Inappropriate implementation in Blink * CVE-2021-37990: Inappropriate implementation in WebView * CVE-2021-37991: Race in V8 * CVE-2021-37992: Out of bounds read in WebAudio * CVE-2021-37993: Use after free in PDF Accessibility * CVE-2021-37996: Insufficient validation of untrusted input in Downloads * CVE-2021-37994: Inappropriate implementation in iFrame Sandbox * CVE-2021-37995: Inappropriate implementation in WebApp Installer Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1396=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-95.0.4638.54-lp152.2.135.1 chromedriver-debuginfo-95.0.4638.54-lp152.2.135.1 chromium-95.0.4638.54-lp152.2.135.1 chromium-debuginfo-95.0.4638.54-lp152.2.135.1 References: https://www.suse.com/security/cve/CVE-2021-37981.html https://www.suse.com/security/cve/CVE-2021-37982.html https://www.suse.com/security/cve/CVE-2021-37983.html https://www.suse.com/security/cve/CVE-2021-37984.html https://www.suse.com/security/cve/CVE-2021-37985.html https://www.suse.com/security/cve/CVE-2021-37986.html https://www.suse.com/security/cve/CVE-2021-37987.html https://www.suse.com/security/cve/CVE-2021-37988.html https://www.suse.com/security/cve/CVE-2021-37989.html https://www.suse.com/security/cve/CVE-2021-37990.html https://www.suse.com/security/cve/CVE-2021-37991.html https://www.suse.com/security/cve/CVE-2021-37992.html https://www.suse.com/security/cve/CVE-2021-37993.html https://www.suse.com/security/cve/CVE-2021-37994.html https://www.suse.com/security/cve/CVE-2021-37995.html https://www.suse.com/security/cve/CVE-2021-37996.html https://bugzilla.suse.com/1191844

1 0

openSUSE-SU-2021:3584-1: important: Security update for transfig
by opensuse-security＠opensuse.org 29 Oct '21

29 Oct '21

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3584-1 Rating: important References: #1189325 #1189343 #1189345 #1189346 #1190607 #1190611 #1190612 #1190615 #1190616 #1190617 #1190618 #1192019 Cross-References: CVE-2020-21529 CVE-2020-21530 CVE-2020-21531 CVE-2020-21532 CVE-2020-21533 CVE-2020-21534 CVE-2020-21535 CVE-2020-21680 CVE-2020-21681 CVE-2020-21682 CVE-2020-21683 CVE-2021-32280 CVSS scores: CVE-2020-21529 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21530 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21531 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21532 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21533 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21534 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21535 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21680 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21681 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21682 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21683 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32280 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for transfig fixes the following issues: Update to fig2dev version 3.2.8 Patchlevel 8b (Aug 2021) - bsc#1190618, CVE-2020-21529: stack buffer overflow in the bezier_spline function in genepic.c. - bsc#1190615, CVE-2020-21530: segmentation fault in the read_objects function in read.c. - bsc#1190617, CVE-2020-21531: global buffer overflow in the conv_pattern_index function in gencgm.c. - bsc#1190616, CVE-2020-21532: global buffer overflow in the setfigfont function in genepic.c. - bsc#1190612, CVE-2020-21533: stack buffer overflow in the read_textobject function in read.c. - bsc#1190611, CVE-2020-21534: global buffer overflow in the get_line function in read.c. - bsc#1190607, CVE-2020-21535: segmentation fault in the gencgm_start function in gencgm.c. - bsc#1192019, CVE-2021-32280: NULL pointer dereference in compute_closed_spline() in trans_spline.c Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3584=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): transfig-3.2.8b-4.15.1 transfig-debuginfo-3.2.8b-4.15.1 transfig-debugsource-3.2.8b-4.15.1 References: https://www.suse.com/security/cve/CVE-2020-21529.html https://www.suse.com/security/cve/CVE-2020-21530.html https://www.suse.com/security/cve/CVE-2020-21531.html https://www.suse.com/security/cve/CVE-2020-21532.html https://www.suse.com/security/cve/CVE-2020-21533.html https://www.suse.com/security/cve/CVE-2020-21534.html https://www.suse.com/security/cve/CVE-2020-21535.html https://www.suse.com/security/cve/CVE-2020-21680.html https://www.suse.com/security/cve/CVE-2020-21681.html https://www.suse.com/security/cve/CVE-2020-21682.html https://www.suse.com/security/cve/CVE-2020-21683.html https://www.suse.com/security/cve/CVE-2021-32280.html https://bugzilla.suse.com/1189325 https://bugzilla.suse.com/1189343 https://bugzilla.suse.com/1189345 https://bugzilla.suse.com/1189346 https://bugzilla.suse.com/1190607 https://bugzilla.suse.com/1190611 https://bugzilla.suse.com/1190612 https://bugzilla.suse.com/1190615 https://bugzilla.suse.com/1190616 https://bugzilla.suse.com/1190617 https://bugzilla.suse.com/1190618 https://bugzilla.suse.com/1192019

1 0

openSUSE-SU-2021:3557-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 27 Oct '21

27 Oct '21

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3557-1 Rating: moderate References: #1190265 Cross-References: CVE-2021-21996 CVSS scores: CVE-2021-21996 (SUSE): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for salt fixes the following issues: - CVE-2021-21996: Exclude the full path of a download URL to prevent injection of malicious code. (bsc#1190265) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3557=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python3-salt-3002.2-50.1.15.1 salt-3002.2-50.1.15.1 salt-api-3002.2-50.1.15.1 salt-cloud-3002.2-50.1.15.1 salt-doc-3002.2-50.1.15.1 salt-master-3002.2-50.1.15.1 salt-minion-3002.2-50.1.15.1 salt-proxy-3002.2-50.1.15.1 salt-ssh-3002.2-50.1.15.1 salt-standalone-formulas-configuration-3002.2-50.1.15.1 salt-syndic-3002.2-50.1.15.1 salt-transactional-update-3002.2-50.1.15.1 - openSUSE Leap 15.3 (noarch): salt-bash-completion-3002.2-50.1.15.1 salt-fish-completion-3002.2-50.1.15.1 salt-zsh-completion-3002.2-50.1.15.1 References: https://www.suse.com/security/cve/CVE-2021-21996.html https://bugzilla.suse.com/1190265

1 0

openSUSE-SU-2021:3529-1: moderate: Security update for pcre
by opensuse-security＠opensuse.org 27 Oct '21

27 Oct '21

openSUSE Security Update: Security update for pcre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3529-1 Rating: moderate References: #1172973 #1172974 Cross-References: CVE-2019-20838 CVE-2020-14155 CVSS scores: CVE-2019-20838 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-20838 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-14155 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-14155 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pcre fixes the following issues: Update pcre to version 8.45: - CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974). - CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3529=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpcre1-8.45-20.10.1 libpcre1-debuginfo-8.45-20.10.1 libpcre16-0-8.45-20.10.1 libpcre16-0-debuginfo-8.45-20.10.1 libpcrecpp0-8.45-20.10.1 libpcrecpp0-debuginfo-8.45-20.10.1 libpcreposix0-8.45-20.10.1 libpcreposix0-debuginfo-8.45-20.10.1 pcre-debugsource-8.45-20.10.1 pcre-devel-8.45-20.10.1 pcre-devel-static-8.45-20.10.1 pcre-tools-8.45-20.10.1 pcre-tools-debuginfo-8.45-20.10.1 - openSUSE Leap 15.3 (noarch): pcre-doc-8.45-20.10.1 - openSUSE Leap 15.3 (x86_64): libpcre1-32bit-8.45-20.10.1 libpcre1-32bit-debuginfo-8.45-20.10.1 libpcre16-0-32bit-8.45-20.10.1 libpcre16-0-32bit-debuginfo-8.45-20.10.1 libpcrecpp0-32bit-8.45-20.10.1 libpcrecpp0-32bit-debuginfo-8.45-20.10.1 libpcreposix0-32bit-8.45-20.10.1 libpcreposix0-32bit-debuginfo-8.45-20.10.1 References: https://www.suse.com/security/cve/CVE-2019-20838.html https://www.suse.com/security/cve/CVE-2020-14155.html https://bugzilla.suse.com/1172973 https://bugzilla.suse.com/1172974

1 0