October 2021 - openSUSE Security Announce

openSUSE-SU-2021:3488-1: moderate: Security update for go1.17
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3488-1 Rating: moderate References: #1190649 #1191468 Cross-References: CVE-2021-38297 CVSS scores: CVE-2021-38297 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.17 fixes the following issues: Update to go1.17.2 - CVE-2021-38297: misc/wasm, cmd/link: do not let command line args overwrite global data (bsc#1191468) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3488=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.2-1.6.2 go1.17-doc-1.17.2-1.6.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.2-1.6.2 References: https://www.suse.com/security/cve/CVE-2021-38297.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1191468

1 0

openSUSE-SU-2021:3487-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3487-1 Rating: moderate References: #1182345 #1191468 Cross-References: CVE-2021-38297 CVSS scores: CVE-2021-38297 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.16 fixes the following issues: Update to go1.16.9 - CVE-2021-38297: misc/wasm, cmd/link: do not let command line args overwrite global data (bsc#1191468) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3487=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.9-1.29.1 go1.16-doc-1.16.9-1.29.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.9-1.29.1 References: https://www.suse.com/security/cve/CVE-2021-38297.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1191468

1 0

openSUSE-SU-2021:3485-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3485-1 Rating: moderate References: #1189403 Cross-References: CVE-2021-28116 CVSS scores: CVE-2021-28116 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-28116 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for squid fixes the following issues: Update to version 4.17: - CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol (bsc#1189403). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3485=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): squid-4.17-5.29.1 squid-debuginfo-4.17-5.29.1 squid-debugsource-4.17-5.29.1 References: https://www.suse.com/security/cve/CVE-2021-28116.html https://bugzilla.suse.com/1189403

1 0

openSUSE-SU-2021:3489-1: moderate: Security update for python
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3489-1 Rating: moderate References: #1189241 #1189287 Cross-References: CVE-2021-3733 CVE-2021-3737 CVSS scores: CVE-2021-3733 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3737 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: - CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241) - CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3489=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython2_7-1_0-2.7.18-33.1 libpython2_7-1_0-debuginfo-2.7.18-33.1 python-2.7.18-33.1 python-base-2.7.18-33.1 python-base-debuginfo-2.7.18-33.1 python-base-debugsource-2.7.18-33.1 python-curses-2.7.18-33.1 python-curses-debuginfo-2.7.18-33.1 python-debuginfo-2.7.18-33.1 python-debugsource-2.7.18-33.1 python-demo-2.7.18-33.1 python-devel-2.7.18-33.1 python-gdbm-2.7.18-33.1 python-gdbm-debuginfo-2.7.18-33.1 python-idle-2.7.18-33.1 python-tk-2.7.18-33.1 python-tk-debuginfo-2.7.18-33.1 python-xml-2.7.18-33.1 python-xml-debuginfo-2.7.18-33.1 - openSUSE Leap 15.3 (noarch): python-doc-2.7.18-33.1 python-doc-pdf-2.7.18-33.1 - openSUSE Leap 15.3 (x86_64): libpython2_7-1_0-32bit-2.7.18-33.1 libpython2_7-1_0-32bit-debuginfo-2.7.18-33.1 python-32bit-2.7.18-33.1 python-32bit-debuginfo-2.7.18-33.1 python-base-32bit-2.7.18-33.1 python-base-32bit-debuginfo-2.7.18-33.1 References: https://www.suse.com/security/cve/CVE-2021-3733.html https://www.suse.com/security/cve/CVE-2021-3737.html https://bugzilla.suse.com/1189241 https://bugzilla.suse.com/1189287

1 0

openSUSE-SU-2021:3493-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3493-1 Rating: moderate References: #1190069 Cross-References: CVE-2021-39272 CVSS scores: CVE-2021-39272 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fetchmail fixes the following issues: - CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3493=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fetchmail-6.3.26-20.17.1 fetchmail-debuginfo-6.3.26-20.17.1 fetchmail-debugsource-6.3.26-20.17.1 fetchmailconf-6.3.26-20.17.1 References: https://www.suse.com/security/cve/CVE-2021-39272.html https://bugzilla.suse.com/1190069

1 0

openSUSE-SU-2021:3490-1: moderate: Security update for ncurses
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3490-1 Rating: moderate References: #1190793 Cross-References: CVE-2021-39537 CVSS scores: CVE-2021-39537 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ncurses fixes the following issues: - CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3490=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libncurses5-6.1-5.9.1 libncurses5-debuginfo-6.1-5.9.1 libncurses6-6.1-5.9.1 libncurses6-debuginfo-6.1-5.9.1 ncurses-debugsource-6.1-5.9.1 ncurses-devel-6.1-5.9.1 ncurses-devel-debuginfo-6.1-5.9.1 ncurses-utils-6.1-5.9.1 ncurses-utils-debuginfo-6.1-5.9.1 ncurses5-devel-6.1-5.9.1 tack-6.1-5.9.1 tack-debuginfo-6.1-5.9.1 terminfo-6.1-5.9.1 terminfo-base-6.1-5.9.1 terminfo-iterm-6.1-5.9.1 terminfo-screen-6.1-5.9.1 - openSUSE Leap 15.3 (x86_64): libncurses5-32bit-6.1-5.9.1 libncurses5-32bit-debuginfo-6.1-5.9.1 libncurses6-32bit-6.1-5.9.1 libncurses6-32bit-debuginfo-6.1-5.9.1 ncurses-devel-32bit-6.1-5.9.1 ncurses-devel-32bit-debuginfo-6.1-5.9.1 ncurses5-devel-32bit-6.1-5.9.1 References: https://www.suse.com/security/cve/CVE-2021-39537.html https://bugzilla.suse.com/1190793

1 0

openSUSE-SU-2021:3472-1: important: Security update for flatpak
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3472-1 Rating: important References: #1191507 Cross-References: CVE-2021-41133 CVSS scores: CVE-2021-41133 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flatpak fixes the following issues: - Update to version 1.10.5: - CVE-2021-41133: Fixed a bug that could lead to sandbox bypass via recent VFS-manipulating syscalls. (bsc#1191507) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3472=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): flatpak-1.10.5-4.9.1 flatpak-debuginfo-1.10.5-4.9.1 flatpak-debugsource-1.10.5-4.9.1 flatpak-devel-1.10.5-4.9.1 flatpak-zsh-completion-1.10.5-4.9.1 libflatpak0-1.10.5-4.9.1 libflatpak0-debuginfo-1.10.5-4.9.1 system-user-flatpak-1.10.5-4.9.1 typelib-1_0-Flatpak-1_0-1.10.5-4.9.1 References: https://www.suse.com/security/cve/CVE-2021-41133.html https://bugzilla.suse.com/1191507

1 0

openSUSE-SU-2021:3474-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3474-1 Rating: moderate References: #1178236 #1188921 Cross-References: CVE-2021-37600 CVSS scores: CVE-2021-37600 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-37600 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for util-linux fixes the following issues: - CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c. (bsc#1188921) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3474=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libblkid-devel-2.36.2-4.5.1 libblkid-devel-static-2.36.2-4.5.1 libblkid1-2.36.2-4.5.1 libblkid1-debuginfo-2.36.2-4.5.1 libfdisk-devel-2.36.2-4.5.1 libfdisk-devel-static-2.36.2-4.5.1 libfdisk1-2.36.2-4.5.1 libfdisk1-debuginfo-2.36.2-4.5.1 libmount-devel-2.36.2-4.5.1 libmount-devel-static-2.36.2-4.5.1 libmount1-2.36.2-4.5.1 libmount1-debuginfo-2.36.2-4.5.1 libsmartcols-devel-2.36.2-4.5.1 libsmartcols-devel-static-2.36.2-4.5.1 libsmartcols1-2.36.2-4.5.1 libsmartcols1-debuginfo-2.36.2-4.5.1 libuuid-devel-2.36.2-4.5.1 libuuid-devel-static-2.36.2-4.5.1 libuuid1-2.36.2-4.5.1 libuuid1-debuginfo-2.36.2-4.5.1 python3-libmount-2.36.2-4.5.1 python3-libmount-debuginfo-2.36.2-4.5.1 python3-libmount-debugsource-2.36.2-4.5.1 util-linux-2.36.2-4.5.1 util-linux-debuginfo-2.36.2-4.5.1 util-linux-debugsource-2.36.2-4.5.1 util-linux-systemd-2.36.2-4.5.1 util-linux-systemd-debuginfo-2.36.2-4.5.1 util-linux-systemd-debugsource-2.36.2-4.5.1 uuidd-2.36.2-4.5.1 uuidd-debuginfo-2.36.2-4.5.1 - openSUSE Leap 15.3 (x86_64): libblkid-devel-32bit-2.36.2-4.5.1 libblkid1-32bit-2.36.2-4.5.1 libblkid1-32bit-debuginfo-2.36.2-4.5.1 libfdisk-devel-32bit-2.36.2-4.5.1 libfdisk1-32bit-2.36.2-4.5.1 libfdisk1-32bit-debuginfo-2.36.2-4.5.1 libmount-devel-32bit-2.36.2-4.5.1 libmount1-32bit-2.36.2-4.5.1 libmount1-32bit-debuginfo-2.36.2-4.5.1 libsmartcols-devel-32bit-2.36.2-4.5.1 libsmartcols1-32bit-2.36.2-4.5.1 libsmartcols1-32bit-debuginfo-2.36.2-4.5.1 libuuid-devel-32bit-2.36.2-4.5.1 libuuid1-32bit-2.36.2-4.5.1 libuuid1-32bit-debuginfo-2.36.2-4.5.1 - openSUSE Leap 15.3 (noarch): util-linux-lang-2.36.2-4.5.1 References: https://www.suse.com/security/cve/CVE-2021-37600.html https://bugzilla.suse.com/1178236 https://bugzilla.suse.com/1188921

1 0

openSUSE-SU-2021:3476-1: important: Security update for xstream
by opensuse-security＠opensuse.org 20 Oct '21

20 Oct '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3476-1 Rating: important References: #1189798 Cross-References: CVE-2021-39139 CVE-2021-39140 CVE-2021-39141 CVE-2021-39144 CVE-2021-39145 CVE-2021-39146 CVE-2021-39147 CVE-2021-39148 CVE-2021-39149 CVE-2021-39150 CVE-2021-39151 CVE-2021-39152 CVE-2021-39153 CVE-2021-39154 CVSS scores: CVE-2021-39139 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39139 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39140 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39141 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39141 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39144 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39144 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39145 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39145 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39146 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39146 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39147 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39147 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39148 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39148 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39149 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39149 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39150 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39150 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-39151 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39151 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39152 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39152 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-39153 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39153 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39154 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-39154 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for xstream fixes the following issues: - Upgrade to 1.4.18 - CVE-2021-39139: Fixed an issue that allowed an attacker to execute arbitrary code execution by manipulating the processed input stream with type information. (bsc#1189798) - CVE-2021-39140: Fixed an issue that allowed an attacker to execute a DoS attack by manipulating the processed input stream. (bsc#1189798) - CVE-2021-39141: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39144: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39145: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39146: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39147: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39148: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39149: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39150: Fixed an issue that allowed an attacker to access protected resources hosted within the intranet or in the host itself. (bsc#1189798) - CVE-2021-39151: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39152: Fixed an issue that allowed an attacker to access protected resources hosted within the intranet or in the host itself. (bsc#1189798) - CVE-2021-39153: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) - CVE-2021-39154: Fixed an issue that allowed an attacker to achieve arbitrary code execution. (bsc#1189798) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3476=1 Package List: - openSUSE Leap 15.3 (noarch): xstream-1.4.18-3.14.1 xstream-benchmark-1.4.18-3.14.1 xstream-javadoc-1.4.18-3.14.1 xstream-parent-1.4.18-3.14.1 References: https://www.suse.com/security/cve/CVE-2021-39139.html https://www.suse.com/security/cve/CVE-2021-39140.html https://www.suse.com/security/cve/CVE-2021-39141.html https://www.suse.com/security/cve/CVE-2021-39144.html https://www.suse.com/security/cve/CVE-2021-39145.html https://www.suse.com/security/cve/CVE-2021-39146.html https://www.suse.com/security/cve/CVE-2021-39147.html https://www.suse.com/security/cve/CVE-2021-39148.html https://www.suse.com/security/cve/CVE-2021-39149.html https://www.suse.com/security/cve/CVE-2021-39150.html https://www.suse.com/security/cve/CVE-2021-39151.html https://www.suse.com/security/cve/CVE-2021-39152.html https://www.suse.com/security/cve/CVE-2021-39153.html https://www.suse.com/security/cve/CVE-2021-39154.html https://bugzilla.suse.com/1189798

1 0

openSUSE-SU-2021:3467-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 19 Oct '21

19 Oct '21

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3467-1 Rating: important References: #1191367 #1191435 SLE-20151 Cross-References: CVE-2021-41990 CVE-2021-41991 CVSS scores: CVE-2021-41990 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-41991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities, contains one feature is now available. Description: This update for strongswan fixes the following issues: A feature was added: - Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151) Security issues fixed: - CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. (bsc#1191435) - CVE-2021-41990: Fixed an integer Overflow in the gmp Plugin. (bsc#1191367) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3467=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): strongswan-5.8.2-11.21.1 strongswan-debuginfo-5.8.2-11.21.1 strongswan-debugsource-5.8.2-11.21.1 strongswan-hmac-5.8.2-11.21.1 strongswan-ipsec-5.8.2-11.21.1 strongswan-ipsec-debuginfo-5.8.2-11.21.1 strongswan-libs0-5.8.2-11.21.1 strongswan-libs0-debuginfo-5.8.2-11.21.1 strongswan-mysql-5.8.2-11.21.1 strongswan-mysql-debuginfo-5.8.2-11.21.1 strongswan-nm-5.8.2-11.21.1 strongswan-nm-debuginfo-5.8.2-11.21.1 strongswan-sqlite-5.8.2-11.21.1 strongswan-sqlite-debuginfo-5.8.2-11.21.1 - openSUSE Leap 15.3 (noarch): strongswan-doc-5.8.2-11.21.1 References: https://www.suse.com/security/cve/CVE-2021-41990.html https://www.suse.com/security/cve/CVE-2021-41991.html https://bugzilla.suse.com/1191367 https://bugzilla.suse.com/1191435

1 0