November 2021 - openSUSE Security Announce

openSUSE-SU-2021:3615-1: important: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 04 Nov '21

04 Nov '21

openSUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3615-1 Rating: important References: #1185055 #1185056 #1188564 #1188565 #1188566 #1191901 #1191903 #1191904 #1191906 #1191909 #1191910 #1191911 #1191912 #1191913 #1191914 Cross-References: CVE-2021-2161 CVE-2021-2163 CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 CVE-2021-35550 CVE-2021-35556 CVE-2021-35559 CVE-2021-35561 CVE-2021-35564 CVE-2021-35565 CVE-2021-35567 CVE-2021-35578 CVE-2021-35586 CVE-2021-35603 CVSS scores: CVE-2021-2161 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2161 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2341 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2341 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2369 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2369 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2388 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-2388 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-35550 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-35550 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-35556 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35556 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35559 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35561 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35561 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35564 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-35564 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-35565 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35565 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35567 (NVD) : 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N CVE-2021-35567 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N CVE-2021-35578 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35578 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35586 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35586 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35603 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-35603 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: Update to OpenJDK 8u312 build 07 with OpenJ9 0.29.0 virtual machine including Oracle July 2021 and October 2021 CPU changes - CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder on Windows (bsc#1185056). - CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). - CVE-2021-2341: Fixed flaw inside the FtpClient (bsc#1188564). - CVE-2021-2369: Fixed JAR file handling problem containing multiple MANIFEST.MF files (bsc#1188565). - CVE-2021-2388: Fixed flaw inside the Hotspot component performed range check elimination (bsc#1188566). - CVE-2021-35550: Fixed weak ciphers preferred over stronger ones for TLS (bsc#1191901). - CVE-2021-35556: Fixed excessive memory allocation in RTFParser (bsc#1191910). - CVE-2021-35559: Fixed excessive memory allocation in RTFReader (bsc#1191911). - CVE-2021-35561: Fixed excessive memory allocation in HashMap and HashSet (bsc#1191912). - CVE-2021-35564: Fixed certificates with end dates too far in the future can corrupt keystore (bsc#1191913). - CVE-2021-35565: Fixed loop in HttpsServer triggered during TLS session close (bsc#1191909). - CVE-2021-35567: Fixed incorrect principal selection when using Kerberos Constrained Delegation (bsc#1191903). - CVE-2021-35578: Fixed unexpected exception raised during TLS handshake (bsc#1191904). - CVE-2021-35586: Fixed excessive memory allocation in BMPImageReader (bsc#1191914). - CVE-2021-35603: Fixed non-constant comparison during TLS handshakes (bsc#1191906). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3615=1 Package List: - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.312-3.18.2 java-1_8_0-openj9-accessibility-1.8.0.312-3.18.2 java-1_8_0-openj9-debuginfo-1.8.0.312-3.18.2 java-1_8_0-openj9-debugsource-1.8.0.312-3.18.2 java-1_8_0-openj9-demo-1.8.0.312-3.18.2 java-1_8_0-openj9-demo-debuginfo-1.8.0.312-3.18.2 java-1_8_0-openj9-devel-1.8.0.312-3.18.2 java-1_8_0-openj9-headless-1.8.0.312-3.18.2 java-1_8_0-openj9-src-1.8.0.312-3.18.2 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.312-3.18.2 References: https://www.suse.com/security/cve/CVE-2021-2161.html https://www.suse.com/security/cve/CVE-2021-2163.html https://www.suse.com/security/cve/CVE-2021-2341.html https://www.suse.com/security/cve/CVE-2021-2369.html https://www.suse.com/security/cve/CVE-2021-2388.html https://www.suse.com/security/cve/CVE-2021-35550.html https://www.suse.com/security/cve/CVE-2021-35556.html https://www.suse.com/security/cve/CVE-2021-35559.html https://www.suse.com/security/cve/CVE-2021-35561.html https://www.suse.com/security/cve/CVE-2021-35564.html https://www.suse.com/security/cve/CVE-2021-35565.html https://www.suse.com/security/cve/CVE-2021-35567.html https://www.suse.com/security/cve/CVE-2021-35578.html https://www.suse.com/security/cve/CVE-2021-35586.html https://www.suse.com/security/cve/CVE-2021-35603.html https://bugzilla.suse.com/1185055 https://bugzilla.suse.com/1185056 https://bugzilla.suse.com/1188564 https://bugzilla.suse.com/1188565 https://bugzilla.suse.com/1188566 https://bugzilla.suse.com/1191901 https://bugzilla.suse.com/1191903 https://bugzilla.suse.com/1191904 https://bugzilla.suse.com/1191906 https://bugzilla.suse.com/1191909 https://bugzilla.suse.com/1191910 https://bugzilla.suse.com/1191911 https://bugzilla.suse.com/1191912 https://bugzilla.suse.com/1191913 https://bugzilla.suse.com/1191914

1 0

openSUSE-SU-2021:3614-1: important: Security update for qemu
by opensuse-security＠opensuse.org 04 Nov '21

04 Nov '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3614-1 Rating: important References: #1180432 #1180433 #1180434 #1180435 #1182651 #1186012 #1189145 #1189702 #1189938 Cross-References: CVE-2020-35503 CVE-2020-35504 CVE-2020-35505 CVE-2020-35506 CVE-2021-20255 CVE-2021-3527 CVE-2021-3682 CVE-2021-3713 CVE-2021-3748 CVSS scores: CVE-2020-35503 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35503 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35504 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35504 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35506 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-35506 (SUSE): 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H CVE-2021-20255 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-20255 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3527 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3527 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2021-3682 (SUSE): 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L CVE-2021-3713 (SUSE): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-3748 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713) - Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748) - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682) - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506) - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503) - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255) - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527) Non-security issues fixed: - Use max host physical address if -cpu max is used (bsc#1188299) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3614=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): qemu-audio-oss-debuginfo-3.1.1.1-80.40.1 References: https://www.suse.com/security/cve/CVE-2020-35503.html https://www.suse.com/security/cve/CVE-2020-35504.html https://www.suse.com/security/cve/CVE-2020-35505.html https://www.suse.com/security/cve/CVE-2020-35506.html https://www.suse.com/security/cve/CVE-2021-20255.html https://www.suse.com/security/cve/CVE-2021-3527.html https://www.suse.com/security/cve/CVE-2021-3682.html https://www.suse.com/security/cve/CVE-2021-3713.html https://www.suse.com/security/cve/CVE-2021-3748.html https://bugzilla.suse.com/1180432 https://bugzilla.suse.com/1180433 https://bugzilla.suse.com/1180434 https://bugzilla.suse.com/1180435 https://bugzilla.suse.com/1182651 https://bugzilla.suse.com/1186012 https://bugzilla.suse.com/1189145 https://bugzilla.suse.com/1189702 https://bugzilla.suse.com/1189938

1 0

openSUSE-SU-2021:3616-1: moderate: Security update for binutils
by opensuse-security＠opensuse.org 04 Nov '21

04 Nov '21

openSUSE Security Update: Security update for binutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3616-1 Rating: moderate References: #1179898 #1179899 #1179900 #1179901 #1179902 #1179903 #1180451 #1180454 #1180461 #1181452 #1182252 #1183511 #1184620 #1184794 PM-2767 SLE-18637 SLE-19618 SLE-21561 Cross-References: CVE-2020-16590 CVE-2020-16591 CVE-2020-16592 CVE-2020-16593 CVE-2020-16598 CVE-2020-16599 CVE-2020-35448 CVE-2020-35493 CVE-2020-35496 CVE-2020-35507 CVE-2021-20197 CVE-2021-20284 CVE-2021-3487 CVSS scores: CVE-2020-16590 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16590 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-16591 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16591 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16592 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16592 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16593 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16593 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16598 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16598 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16599 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-16599 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-35448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2020-35448 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2020-35493 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35493 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35496 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35496 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35507 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35507 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20197 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-20197 (SUSE): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-20284 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20284 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3487 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3487 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 13 vulnerabilities, contains four features and has one errata is now available. Description: This update for binutils fixes the following issues: Update to binutils 2.37: * The GNU Binutils sources now requires a C99 compiler and library to build. * Support for Realm Management Extension (RME) for AArch64 has been added. * A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations. * A new linker option '-z start-stop-gc' has been added to disable special treatment of __start_*/__stop_* references when --gc-sections. * A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options. * The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16. * A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else. * A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools. * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols. * Readelf and objdump can now display and use the contents of .debug_sup sections. * Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option. The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed. If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file *will* be displayed. This is because in most cases the debug section will only be present in one of the files. If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will *not* be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files. * Nm has a new command line option: '--quiet'. This suppresses "no symbols" diagnostic. Update to binutils 2.36: New features in the Assembler: - General: * When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name. * Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active. * Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically. - X86/x86_64: * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions. * Support non-absolute segment values for lcall and ljmp. * Add {disp16} pseudo prefix to x86 assembler. * Configure with --enable-x86-used-note by default for Linux/x86. - ARM/AArch64: * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1, Cortex-R82, Neoverse V1, and Neoverse N2 cores. * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call Stack Recorder Extension) and BRBE (Branch Record Buffer Extension) system registers. * Add support for Armv8-R and Armv8.7-A ISA extensions. * Add support for DSB memory nXS barrier, WFET and WFIT instruction for Armv8.7. * Add support for +csre feature for -march. Add CSR PDEC instruction for CSRE feature in AArch64. * Add support for +flagm feature for -march in Armv8.4 AArch64. * Add support for +ls64 feature for -march in Armv8.7 AArch64. Add atomic 64-byte load/store instructions for this feature. * Add support for +pauth (Pointer Authentication) feature for -march in AArch64. New features in the Linker: * Add --error-handling-script=<NAME> command line option to allow a helper script to be invoked when an undefined symbol or a missing library is encountered. This option can be suppressed via the configure time switch: --enable-error-handling-script=no. * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark x86-64-{baseline|v[234]} ISA level as needed. * Add -z unique-symbol to avoid duplicated local symbol names. * The creation of PE format DLLs now defaults to using a more secure set of DLL characteristics. * The linker now deduplicates the types in .ctf sections. The new command-line option --ctf-share-types describes how to do this: its default value, share-unconflicted, produces the most compact output. * The linker now omits the "variable section" from .ctf sections by default, saving space. This is almost certainly what you want unless you are working on a project that has its own analogue of symbol tables that are not reflected in the ELF symtabs. New features in other binary tools: * The ar tool's previously unused l modifier is now used for specifying dependencies of a static library. The arguments of this option (or --record-libdeps long form option) will be stored verbatim in the __.LIBDEP member of the archive, which the linker may read at link time. * Readelf can now display the contents of LTO symbol table sections when asked to do so via the --lto-syms command line option. * Readelf now accepts the -C command line option to enable the demangling of symbol names. In addition the --demangle=<style>, --no-demangle, --recurse-limit and --no-recurse-limit options are also now availale. The following security fixes are addressed by the update: - CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452). - CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (bsc#1183511). - CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory consumption in bfd's dwarf2.c read_section() (bsc#1184620). - CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794). - CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898). - CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899). - CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900). - CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901). - CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902). - CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903) - CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c via crafted PEF file (bsc#1180451). - CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value of bfd_malloc (bsc#1180454). - CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3616=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): binutils-2.37-7.21.2 binutils-debuginfo-2.37-7.21.2 binutils-debugsource-2.37-7.21.2 binutils-devel-2.37-7.21.2 binutils-gold-2.37-7.21.2 binutils-gold-debuginfo-2.37-7.21.2 bpftrace-0.11.4-3.2.1 cross-arm-binutils-2.37-7.21.1 cross-arm-binutils-debuginfo-2.37-7.21.1 cross-arm-binutils-debugsource-2.37-7.21.1 cross-avr-binutils-2.37-7.21.1 cross-avr-binutils-debuginfo-2.37-7.21.1 cross-avr-binutils-debugsource-2.37-7.21.1 cross-epiphany-binutils-2.37-7.21.1 cross-epiphany-binutils-debuginfo-2.37-7.21.1 cross-epiphany-binutils-debugsource-2.37-7.21.1 cross-hppa-binutils-2.37-7.21.1 cross-hppa-binutils-debuginfo-2.37-7.21.1 cross-hppa-binutils-debugsource-2.37-7.21.1 cross-hppa64-binutils-2.37-7.21.1 cross-hppa64-binutils-debuginfo-2.37-7.21.1 cross-hppa64-binutils-debugsource-2.37-7.21.1 cross-i386-binutils-2.37-7.21.1 cross-i386-binutils-debuginfo-2.37-7.21.1 cross-i386-binutils-debugsource-2.37-7.21.1 cross-ia64-binutils-2.37-7.21.1 cross-ia64-binutils-debuginfo-2.37-7.21.1 cross-ia64-binutils-debugsource-2.37-7.21.1 cross-m68k-binutils-2.37-7.21.1 cross-m68k-binutils-debuginfo-2.37-7.21.1 cross-m68k-binutils-debugsource-2.37-7.21.1 cross-mips-binutils-2.37-7.21.1 cross-mips-binutils-debuginfo-2.37-7.21.1 cross-mips-binutils-debugsource-2.37-7.21.1 cross-ppc-binutils-2.37-7.21.1 cross-ppc-binutils-debuginfo-2.37-7.21.1 cross-ppc-binutils-debugsource-2.37-7.21.1 cross-ppc64-binutils-2.37-7.21.1 cross-ppc64-binutils-debuginfo-2.37-7.21.1 cross-ppc64-binutils-debugsource-2.37-7.21.1 cross-riscv64-binutils-2.37-7.21.1 cross-riscv64-binutils-debuginfo-2.37-7.21.1 cross-riscv64-binutils-debugsource-2.37-7.21.1 cross-rx-binutils-2.37-7.21.1 cross-rx-binutils-debuginfo-2.37-7.21.1 cross-rx-binutils-debugsource-2.37-7.21.1 cross-s390-binutils-2.37-7.21.1 cross-s390-binutils-debuginfo-2.37-7.21.1 cross-s390-binutils-debugsource-2.37-7.21.1 cross-sparc-binutils-2.37-7.21.1 cross-sparc-binutils-debuginfo-2.37-7.21.1 cross-sparc-binutils-debugsource-2.37-7.21.1 cross-sparc64-binutils-2.37-7.21.1 cross-sparc64-binutils-debuginfo-2.37-7.21.1 cross-sparc64-binutils-debugsource-2.37-7.21.1 cross-spu-binutils-2.37-7.21.1 cross-spu-binutils-debuginfo-2.37-7.21.1 cross-spu-binutils-debugsource-2.37-7.21.1 libctf-nobfd0-2.37-7.21.2 libctf-nobfd0-debuginfo-2.37-7.21.2 libctf0-2.37-7.21.2 libctf0-debuginfo-2.37-7.21.2 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): cross-s390x-binutils-2.37-7.21.1 cross-s390x-binutils-debuginfo-2.37-7.21.1 cross-s390x-binutils-debugsource-2.37-7.21.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x): cross-x86_64-binutils-2.37-7.21.1 cross-x86_64-binutils-debuginfo-2.37-7.21.1 cross-x86_64-binutils-debugsource-2.37-7.21.1 - openSUSE Leap 15.3 (aarch64 s390x x86_64): cross-ppc64le-binutils-2.37-7.21.1 cross-ppc64le-binutils-debuginfo-2.37-7.21.1 cross-ppc64le-binutils-debugsource-2.37-7.21.1 - openSUSE Leap 15.3 (ppc64le s390x x86_64): cross-aarch64-binutils-2.37-7.21.1 cross-aarch64-binutils-debuginfo-2.37-7.21.1 cross-aarch64-binutils-debugsource-2.37-7.21.1 - openSUSE Leap 15.3 (x86_64): binutils-devel-32bit-2.37-7.21.2 - openSUSE Leap 15.3 (noarch): bpftrace-tools-0.11.4-3.2.1 References: https://www.suse.com/security/cve/CVE-2020-16590.html https://www.suse.com/security/cve/CVE-2020-16591.html https://www.suse.com/security/cve/CVE-2020-16592.html https://www.suse.com/security/cve/CVE-2020-16593.html https://www.suse.com/security/cve/CVE-2020-16598.html https://www.suse.com/security/cve/CVE-2020-16599.html https://www.suse.com/security/cve/CVE-2020-35448.html https://www.suse.com/security/cve/CVE-2020-35493.html https://www.suse.com/security/cve/CVE-2020-35496.html https://www.suse.com/security/cve/CVE-2020-35507.html https://www.suse.com/security/cve/CVE-2021-20197.html https://www.suse.com/security/cve/CVE-2021-20284.html https://www.suse.com/security/cve/CVE-2021-3487.html https://bugzilla.suse.com/1179898 https://bugzilla.suse.com/1179899 https://bugzilla.suse.com/1179900 https://bugzilla.suse.com/1179901 https://bugzilla.suse.com/1179902 https://bugzilla.suse.com/1179903 https://bugzilla.suse.com/1180451 https://bugzilla.suse.com/1180454 https://bugzilla.suse.com/1180461 https://bugzilla.suse.com/1181452 https://bugzilla.suse.com/1182252 https://bugzilla.suse.com/1183511 https://bugzilla.suse.com/1184620 https://bugzilla.suse.com/1184794

1 0

openSUSE-SU-2021:3605-1: important: Security update for qemu
by opensuse-security＠opensuse.org 03 Nov '21

03 Nov '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3605-1 Rating: important References: #1189234 #1189702 #1189938 #1190425 Cross-References: CVE-2021-3713 CVE-2021-3748 CVSS scores: CVE-2021-3713 (SUSE): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-3748 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702) - CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938) Non-security issues fixed: - Add transfer length item in block limits page of scsi vpd (bsc#1190425) - Fix qemu crash while deleting xen-block (bsc#1189234) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3605=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-106.4 qemu-arm-5.2.0-106.4 qemu-arm-debuginfo-5.2.0-106.4 qemu-audio-alsa-5.2.0-106.4 qemu-audio-alsa-debuginfo-5.2.0-106.4 qemu-audio-pa-5.2.0-106.4 qemu-audio-pa-debuginfo-5.2.0-106.4 qemu-audio-spice-5.2.0-106.4 qemu-audio-spice-debuginfo-5.2.0-106.4 qemu-block-curl-5.2.0-106.4 qemu-block-curl-debuginfo-5.2.0-106.4 qemu-block-dmg-5.2.0-106.4 qemu-block-dmg-debuginfo-5.2.0-106.4 qemu-block-gluster-5.2.0-106.4 qemu-block-gluster-debuginfo-5.2.0-106.4 qemu-block-iscsi-5.2.0-106.4 qemu-block-iscsi-debuginfo-5.2.0-106.4 qemu-block-nfs-5.2.0-106.4 qemu-block-nfs-debuginfo-5.2.0-106.4 qemu-block-rbd-5.2.0-106.4 qemu-block-rbd-debuginfo-5.2.0-106.4 qemu-block-ssh-5.2.0-106.4 qemu-block-ssh-debuginfo-5.2.0-106.4 qemu-chardev-baum-5.2.0-106.4 qemu-chardev-baum-debuginfo-5.2.0-106.4 qemu-chardev-spice-5.2.0-106.4 qemu-chardev-spice-debuginfo-5.2.0-106.4 qemu-debuginfo-5.2.0-106.4 qemu-debugsource-5.2.0-106.4 qemu-extra-5.2.0-106.4 qemu-extra-debuginfo-5.2.0-106.4 qemu-guest-agent-5.2.0-106.4 qemu-guest-agent-debuginfo-5.2.0-106.4 qemu-hw-display-qxl-5.2.0-106.4 qemu-hw-display-qxl-debuginfo-5.2.0-106.4 qemu-hw-display-virtio-gpu-5.2.0-106.4 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-106.4 qemu-hw-display-virtio-gpu-pci-5.2.0-106.4 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-106.4 qemu-hw-display-virtio-vga-5.2.0-106.4 qemu-hw-display-virtio-vga-debuginfo-5.2.0-106.4 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-106.4 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-106.4 qemu-hw-usb-redirect-5.2.0-106.4 qemu-hw-usb-redirect-debuginfo-5.2.0-106.4 qemu-hw-usb-smartcard-5.2.0-106.4 qemu-hw-usb-smartcard-debuginfo-5.2.0-106.4 qemu-ivshmem-tools-5.2.0-106.4 qemu-ivshmem-tools-debuginfo-5.2.0-106.4 qemu-ksm-5.2.0-106.4 qemu-lang-5.2.0-106.4 qemu-linux-user-5.2.0-106.3 qemu-linux-user-debuginfo-5.2.0-106.3 qemu-linux-user-debugsource-5.2.0-106.3 qemu-ppc-5.2.0-106.4 qemu-ppc-debuginfo-5.2.0-106.4 qemu-s390x-5.2.0-106.4 qemu-s390x-debuginfo-5.2.0-106.4 qemu-testsuite-5.2.0-106.3 qemu-tools-5.2.0-106.4 qemu-tools-debuginfo-5.2.0-106.4 qemu-ui-curses-5.2.0-106.4 qemu-ui-curses-debuginfo-5.2.0-106.4 qemu-ui-gtk-5.2.0-106.4 qemu-ui-gtk-debuginfo-5.2.0-106.4 qemu-ui-opengl-5.2.0-106.4 qemu-ui-opengl-debuginfo-5.2.0-106.4 qemu-ui-spice-app-5.2.0-106.4 qemu-ui-spice-app-debuginfo-5.2.0-106.4 qemu-ui-spice-core-5.2.0-106.4 qemu-ui-spice-core-debuginfo-5.2.0-106.4 qemu-vhost-user-gpu-5.2.0-106.4 qemu-vhost-user-gpu-debuginfo-5.2.0-106.4 qemu-x86-5.2.0-106.4 qemu-x86-debuginfo-5.2.0-106.4 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-106.4 - openSUSE Leap 15.3 (noarch): qemu-ipxe-1.0.0+-106.4 qemu-microvm-5.2.0-106.4 qemu-seabios-1.14.0_0_g155821a-106.4 qemu-sgabios-8-106.4 qemu-skiboot-5.2.0-106.4 qemu-vgabios-1.14.0_0_g155821a-106.4 References: https://www.suse.com/security/cve/CVE-2021-3713.html https://www.suse.com/security/cve/CVE-2021-3748.html https://bugzilla.suse.com/1189234 https://bugzilla.suse.com/1189702 https://bugzilla.suse.com/1189938 https://bugzilla.suse.com/1190425

1 0

openSUSE-SU-2021:3603-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 03 Nov '21

03 Nov '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3603-1 Rating: important References: #1191937 Cross-References: CVE-2021-42762 CVSS scores: CVE-2021-42762 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3603=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.32.4-15.1 libjavascriptcoregtk-4_0-18-debuginfo-2.32.4-15.1 libwebkit2gtk-4_0-37-2.32.4-15.1 libwebkit2gtk-4_0-37-debuginfo-2.32.4-15.1 typelib-1_0-JavaScriptCore-4_0-2.32.4-15.1 typelib-1_0-WebKit2-4_0-2.32.4-15.1 typelib-1_0-WebKit2WebExtension-4_0-2.32.4-15.1 webkit-jsc-4-2.32.4-15.1 webkit-jsc-4-debuginfo-2.32.4-15.1 webkit2gtk-4_0-injected-bundles-2.32.4-15.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.32.4-15.1 webkit2gtk3-debugsource-2.32.4-15.1 webkit2gtk3-devel-2.32.4-15.1 webkit2gtk3-minibrowser-2.32.4-15.1 webkit2gtk3-minibrowser-debuginfo-2.32.4-15.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.32.4-15.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.32.4-15.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.32.4-15.1 libwebkit2gtk-4_0-37-32bit-2.32.4-15.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.32.4-15.1 References: https://www.suse.com/security/cve/CVE-2021-42762.html https://bugzilla.suse.com/1191937

1 0

openSUSE-SU-2021:3604-1: important: Security update for qemu
by opensuse-security＠opensuse.org 03 Nov '21

03 Nov '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3604-1 Rating: important References: #1189234 #1189702 #1189938 #1190425 Cross-References: CVE-2021-3713 CVE-2021-3748 CVSS scores: CVE-2021-3713 (SUSE): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-3748 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702) - CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938) Non-security issues fixed: - Add transfer length item in block limits page of scsi vpd (bsc#1190425) - Fix qemu crash while deleting xen-block (bsc#1189234) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3604=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-s390-4.2.1-11.31.3 qemu-s390-debuginfo-4.2.1-11.31.3 References: https://www.suse.com/security/cve/CVE-2021-3713.html https://www.suse.com/security/cve/CVE-2021-3748.html https://bugzilla.suse.com/1189234 https://bugzilla.suse.com/1189702 https://bugzilla.suse.com/1189938 https://bugzilla.suse.com/1190425

1 0

openSUSE-SU-2021:1438-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1438-1 Rating: important References: #1190666 #1190669 #1190702 #1190703 Cross-References: CVE-2021-34798 CVE-2021-36160 CVE-2021-39275 CVE-2021-40438 CVSS scores: CVE-2021-34798 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36160 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39275 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-40438 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703) - CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702) - CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666) - CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1438=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-2.4.43-lp152.2.21.1 apache2-debuginfo-2.4.43-lp152.2.21.1 apache2-debugsource-2.4.43-lp152.2.21.1 apache2-devel-2.4.43-lp152.2.21.1 apache2-event-2.4.43-lp152.2.21.1 apache2-event-debuginfo-2.4.43-lp152.2.21.1 apache2-example-pages-2.4.43-lp152.2.21.1 apache2-prefork-2.4.43-lp152.2.21.1 apache2-prefork-debuginfo-2.4.43-lp152.2.21.1 apache2-utils-2.4.43-lp152.2.21.1 apache2-utils-debuginfo-2.4.43-lp152.2.21.1 apache2-worker-2.4.43-lp152.2.21.1 apache2-worker-debuginfo-2.4.43-lp152.2.21.1 - openSUSE Leap 15.2 (noarch): apache2-doc-2.4.43-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-34798.html https://www.suse.com/security/cve/CVE-2021-36160.html https://www.suse.com/security/cve/CVE-2021-39275.html https://www.suse.com/security/cve/CVE-2021-40438.html https://bugzilla.suse.com/1190666 https://bugzilla.suse.com/1190669 https://bugzilla.suse.com/1190702 https://bugzilla.suse.com/1190703

1 0

openSUSE-SU-2021:1440-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1440-1 Rating: moderate References: #1122417 #1125886 #1178236 #1188921 Cross-References: CVE-2021-37600 CVSS scores: CVE-2021-37600 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-37600 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for util-linux fixes the following issues: Update to version 2.33.2 to provide seamless update from SLE12 SP5 to SLE15 SP2: - CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c (bsc#1188921). - agetty: Fix 8-bit processing in get_logname() (bsc#1125886). - mount: Fix "mount" output for net file systems (bsc#1122417). - ipcs: Avoid overflows (bsc#1178236) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1440=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libblkid-devel-2.33.2-lp152.5.9.1 libblkid-devel-static-2.33.2-lp152.5.9.1 libblkid1-2.33.2-lp152.5.9.1 libblkid1-debuginfo-2.33.2-lp152.5.9.1 libfdisk-devel-2.33.2-lp152.5.9.1 libfdisk-devel-static-2.33.2-lp152.5.9.1 libfdisk1-2.33.2-lp152.5.9.1 libfdisk1-debuginfo-2.33.2-lp152.5.9.1 libmount-devel-2.33.2-lp152.5.9.1 libmount-devel-static-2.33.2-lp152.5.9.1 libmount1-2.33.2-lp152.5.9.1 libmount1-debuginfo-2.33.2-lp152.5.9.1 libsmartcols-devel-2.33.2-lp152.5.9.1 libsmartcols-devel-static-2.33.2-lp152.5.9.1 libsmartcols1-2.33.2-lp152.5.9.1 libsmartcols1-debuginfo-2.33.2-lp152.5.9.1 libuuid-devel-2.33.2-lp152.5.9.1 libuuid-devel-static-2.33.2-lp152.5.9.1 libuuid1-2.33.2-lp152.5.9.1 libuuid1-debuginfo-2.33.2-lp152.5.9.1 util-linux-2.33.2-lp152.5.9.1 util-linux-debuginfo-2.33.2-lp152.5.9.1 util-linux-debugsource-2.33.2-lp152.5.9.1 util-linux-systemd-2.33.2-lp152.5.9.1 util-linux-systemd-debuginfo-2.33.2-lp152.5.9.1 util-linux-systemd-debugsource-2.33.2-lp152.5.9.1 uuidd-2.33.2-lp152.5.9.1 uuidd-debuginfo-2.33.2-lp152.5.9.1 - openSUSE Leap 15.2 (noarch): util-linux-lang-2.33.2-lp152.5.9.1 - openSUSE Leap 15.2 (x86_64): libblkid-devel-32bit-2.33.2-lp152.5.9.1 libblkid1-32bit-2.33.2-lp152.5.9.1 libblkid1-32bit-debuginfo-2.33.2-lp152.5.9.1 libmount-devel-32bit-2.33.2-lp152.5.9.1 libmount1-32bit-2.33.2-lp152.5.9.1 libmount1-32bit-debuginfo-2.33.2-lp152.5.9.1 libuuid-devel-32bit-2.33.2-lp152.5.9.1 libuuid1-32bit-2.33.2-lp152.5.9.1 libuuid1-32bit-debuginfo-2.33.2-lp152.5.9.1 python3-libmount-2.33.2-lp152.5.9.1 python3-libmount-debuginfo-2.33.2-lp152.5.9.1 python3-libmount-debugsource-2.33.2-lp152.5.9.1 References: https://www.suse.com/security/cve/CVE-2021-37600.html https://bugzilla.suse.com/1122417 https://bugzilla.suse.com/1125886 https://bugzilla.suse.com/1178236 https://bugzilla.suse.com/1188921

1 0

openSUSE-SU-2021:1439-1: important: Security update for transfig
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1439-1 Rating: important References: #1189325 #1189343 #1189345 #1189346 #1190607 #1190611 #1190612 #1190615 #1190616 #1190617 #1190618 #1192019 Cross-References: CVE-2020-21529 CVE-2020-21530 CVE-2020-21531 CVE-2020-21532 CVE-2020-21533 CVE-2020-21534 CVE-2020-21535 CVE-2020-21680 CVE-2020-21681 CVE-2020-21682 CVE-2020-21683 CVE-2021-32280 CVSS scores: CVE-2020-21529 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21530 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21531 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21532 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21533 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21534 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21535 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-21680 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21681 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21682 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-21683 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32280 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for transfig fixes the following issues: Update to fig2dev version 3.2.8 Patchlevel 8b (Aug 2021) - bsc#1190618, CVE-2020-21529: stack buffer overflow in the bezier_spline function in genepic.c. - bsc#1190615, CVE-2020-21530: segmentation fault in the read_objects function in read.c. - bsc#1190617, CVE-2020-21531: global buffer overflow in the conv_pattern_index function in gencgm.c. - bsc#1190616, CVE-2020-21532: global buffer overflow in the setfigfont function in genepic.c. - bsc#1190612, CVE-2020-21533: stack buffer overflow in the read_textobject function in read.c. - bsc#1190611, CVE-2020-21534: global buffer overflow in the get_line function in read.c. - bsc#1190607, CVE-2020-21535: segmentation fault in the gencgm_start function in gencgm.c. - bsc#1192019, CVE-2021-32280: NULL pointer dereference in compute_closed_spline() in trans_spline.c This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1439=1 Package List: - openSUSE Leap 15.2 (x86_64): transfig-3.2.8b-lp152.6.9.1 transfig-debuginfo-3.2.8b-lp152.6.9.1 transfig-debugsource-3.2.8b-lp152.6.9.1 References: https://www.suse.com/security/cve/CVE-2020-21529.html https://www.suse.com/security/cve/CVE-2020-21530.html https://www.suse.com/security/cve/CVE-2020-21531.html https://www.suse.com/security/cve/CVE-2020-21532.html https://www.suse.com/security/cve/CVE-2020-21533.html https://www.suse.com/security/cve/CVE-2020-21534.html https://www.suse.com/security/cve/CVE-2020-21535.html https://www.suse.com/security/cve/CVE-2020-21680.html https://www.suse.com/security/cve/CVE-2020-21681.html https://www.suse.com/security/cve/CVE-2020-21682.html https://www.suse.com/security/cve/CVE-2020-21683.html https://www.suse.com/security/cve/CVE-2021-32280.html https://bugzilla.suse.com/1189325 https://bugzilla.suse.com/1189343 https://bugzilla.suse.com/1189345 https://bugzilla.suse.com/1189346 https://bugzilla.suse.com/1190607 https://bugzilla.suse.com/1190611 https://bugzilla.suse.com/1190612 https://bugzilla.suse.com/1190615 https://bugzilla.suse.com/1190616 https://bugzilla.suse.com/1190617 https://bugzilla.suse.com/1190618 https://bugzilla.suse.com/1192019

1 0

openSUSE-SU-2021:1441-1: moderate: Security update for pcre
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for pcre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1441-1 Rating: moderate References: #1172973 #1172974 Cross-References: CVE-2019-20838 CVE-2020-14155 CVSS scores: CVE-2019-20838 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-20838 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-14155 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-14155 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pcre fixes the following issues: Update pcre to version 8.45: - CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974). - CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1441=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpcre1-8.45-lp152.7.6.1 libpcre1-debuginfo-8.45-lp152.7.6.1 libpcre16-0-8.45-lp152.7.6.1 libpcre16-0-debuginfo-8.45-lp152.7.6.1 libpcrecpp0-8.45-lp152.7.6.1 libpcrecpp0-debuginfo-8.45-lp152.7.6.1 libpcreposix0-8.45-lp152.7.6.1 libpcreposix0-debuginfo-8.45-lp152.7.6.1 pcre-debugsource-8.45-lp152.7.6.1 pcre-devel-8.45-lp152.7.6.1 pcre-devel-static-8.45-lp152.7.6.1 pcre-tools-8.45-lp152.7.6.1 pcre-tools-debuginfo-8.45-lp152.7.6.1 - openSUSE Leap 15.2 (noarch): pcre-doc-8.45-lp152.7.6.1 - openSUSE Leap 15.2 (x86_64): libpcre1-32bit-8.45-lp152.7.6.1 libpcre1-32bit-debuginfo-8.45-lp152.7.6.1 libpcre16-0-32bit-8.45-lp152.7.6.1 libpcre16-0-32bit-debuginfo-8.45-lp152.7.6.1 libpcrecpp0-32bit-8.45-lp152.7.6.1 libpcrecpp0-32bit-debuginfo-8.45-lp152.7.6.1 libpcreposix0-32bit-8.45-lp152.7.6.1 libpcreposix0-32bit-debuginfo-8.45-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2019-20838.html https://www.suse.com/security/cve/CVE-2020-14155.html https://bugzilla.suse.com/1172973 https://bugzilla.suse.com/1172974

1 0