December 2021 - openSUSE Security Announce

openSUSE-SU-2021:4209-1: important: Security update for gegl
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for gegl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4209-1 Rating: important References: #1194045 Cross-References: CVE-2021-45463 CVSS scores: CVE-2021-45463 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gegl fixes the following issues: - CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4209=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gegl-0.4.16-3.3.1 gegl-0_4-0.4.16-3.3.1 gegl-0_4-debuginfo-0.4.16-3.3.1 gegl-debuginfo-0.4.16-3.3.1 gegl-debugsource-0.4.16-3.3.1 gegl-devel-0.4.16-3.3.1 gegl-doc-0.4.16-3.3.1 libgegl-0_4-0-0.4.16-3.3.1 libgegl-0_4-0-debuginfo-0.4.16-3.3.1 typelib-1_0-Gegl-0_4-0.4.16-3.3.1 - openSUSE Leap 15.3 (x86_64): libgegl-0_4-0-32bit-0.4.16-3.3.1 libgegl-0_4-0-32bit-debuginfo-0.4.16-3.3.1 - openSUSE Leap 15.3 (noarch): gegl-0_4-lang-0.4.16-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-45463.html https://bugzilla.suse.com/1194045

1 0

openSUSE-SU-2021:4210-1: important: Security update for gegl
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for gegl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4210-1 Rating: important References: #1194045 Cross-References: CVE-2021-45463 CVSS scores: CVE-2021-45463 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gegl fixes the following issues: - CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4210=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gegl-0_3-0.3.34-3.3.1 gegl-0_3-debuginfo-0.3.34-3.3.1 libgegl-0_3-0-0.3.34-3.3.1 libgegl-0_3-0-debuginfo-0.3.34-3.3.1 typelib-1_0-Gegl-0_3-0.3.34-3.3.1 - openSUSE Leap 15.3 (noarch): gegl-0_3-lang-0.3.34-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-45463.html https://bugzilla.suse.com/1194045

1 0

openSUSE-SU-2021:1646-1: important: Security update for privoxy
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1646-1 Rating: important References: #1193584 Cross-References: CVE-2021-44540 CVE-2021-44541 CVE-2021-44542 CVE-2021-44543 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.33 (boo#1193584): * CVE-2021-44543: Encode the template name to prevent XSS (cross-side scripting) when Privoxy is configured to servce the user-manual itself * CVE-2021-44540: Free memory of compiled pattern spec before bailing * CVE-2021-44541: Free header memory when failing to get the request destination. * CVE-2021-44542: Prevent memory leaks when handling errors * Disable fast-redirects for a number of domains * Update default block lists * Many bug fixes and minor enhancements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1646=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1646=1 Package List: - openSUSE Leap 15.2 (x86_64): privoxy-3.0.33-lp152.3.12.1 privoxy-debuginfo-3.0.33-lp152.3.12.1 privoxy-debugsource-3.0.33-lp152.3.12.1 - openSUSE Leap 15.2 (noarch): privoxy-doc-3.0.33-lp152.3.12.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): privoxy-3.0.33-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): privoxy-doc-3.0.33-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-44540.html https://www.suse.com/security/cve/CVE-2021-44541.html https://www.suse.com/security/cve/CVE-2021-44542.html https://www.suse.com/security/cve/CVE-2021-44543.html https://bugzilla.suse.com/1193584

1 0

openSUSE-SU-2021:1648-1: Security update for kernel-firmware
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1648-1 Rating: low References: #1167162 Cross-References: CVE-2019-15126 CVSS scores: CVE-2019-15126 (NVD) : 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-15126 (SUSE): 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kernel-firmware fixes the following issues: - CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1648=1 Package List: - openSUSE Leap 15.2 (noarch): kernel-firmware-20200107-lp152.2.9.1 ucode-amd-20200107-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-15126.html https://bugzilla.suse.com/1167162

1 0

openSUSE-SU-2021:1640-1: moderate: Security update for c-toxcore
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for c-toxcore ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1640-1 Rating: moderate References: #1193667 Cross-References: CVE-2021-44847 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: c-toxcore was updated fo fix a securiy issue: - CVE-2021-44847: Fixed a buffer overflow in handle_request in DHT.c which could lead to remote DoS and potential code execution (boo#1193667) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1640=1 Package List: - openSUSE Leap 15.2 (x86_64): c-toxcore-0.2.13-lp152.3.3.1 c-toxcore-daemon-0.2.13-lp152.3.3.1 c-toxcore-daemon-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-devel-0.2.13-lp152.3.3.1 libtoxcore2-0.2.13-lp152.3.3.1 libtoxcore2-debuginfo-0.2.13-lp152.3.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): c-toxcore-0.2.13-bp153.2.3.1 c-toxcore-daemon-0.2.13-bp153.2.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-devel-0.2.13-bp153.2.3.1 libtoxcore2-0.2.13-bp153.2.3.1 libtoxcore2-debuginfo-0.2.13-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp152.4.3.1 c-toxcore-daemon-0.2.13-bp152.4.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-devel-0.2.13-bp152.4.3.1 libtoxcore2-0.2.13-bp152.4.3.1 libtoxcore2-debuginfo-0.2.13-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp151.3.3.1 c-toxcore-daemon-0.2.13-bp151.3.3.1 c-toxcore-devel-0.2.13-bp151.3.3.1 libtoxcore2-0.2.13-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44847.html https://bugzilla.suse.com/1193667

1 0

openSUSE-SU-2021:1645-1: moderate: Security update for getdata
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for getdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1645-1 Rating: moderate References: #1186251 Cross-References: CVE-2021-20204 CVSS scores: CVE-2021-20204 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20204 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: getdata was updated to 0.11.0, fixing bugs and a security issue: - CVE-2021-20204: Fixed a use after free in _GD_Supports() in encoding.c (boo#1186251) for all relevant changes see: https://github.com/ketiltrout/getdata/releases/tag/v0.11.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1645=1 Package List: - openSUSE Leap 15.2 (x86_64): getdata-0.11.0-lp152.4.3.1 getdata-debuginfo-0.11.0-lp152.4.3.1 getdata-debugsource-0.11.0-lp152.4.3.1 getdata-devel-0.11.0-lp152.4.3.1 getdata-doc-0.11.0-lp152.4.3.1 libf95getdata7-0.11.0-lp152.4.3.1 libf95getdata7-debuginfo-0.11.0-lp152.4.3.1 libfgetdata6-0.11.0-lp152.4.3.1 libfgetdata6-debuginfo-0.11.0-lp152.4.3.1 libgetdata++7-0.11.0-lp152.4.3.1 libgetdata++7-debuginfo-0.11.0-lp152.4.3.1 libgetdata8-0.11.0-lp152.4.3.1 libgetdata8-debuginfo-0.11.0-lp152.4.3.1 perl-getdata-0.11.0-lp152.4.3.1 perl-getdata-debuginfo-0.11.0-lp152.4.3.1 python-getdata-0.11.0-lp152.4.3.1 python-getdata-debuginfo-0.11.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20204.html https://bugzilla.suse.com/1186251

1 0

openSUSE-SU-2021:1642-1: moderate: Security update for postrsd
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for postrsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1642-1 Rating: moderate References: #1180251 Cross-References: CVE-2020-35573 CVSS scores: CVE-2020-35573 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: postrsd was updated to release 1.11 [boo#1180251]: * Drop group privileges as well as user privileges * Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. [CVE-2020-35573] - Update to release 1.6 * Fix endianness issue with SHA-1 implementation * Add dual stack support * Make SRS separator configurable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1642=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): postsrsd-1.11-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-35573.html https://bugzilla.suse.com/1180251

1 0

openSUSE-SU-2021:4208-1: moderate: Security update for log4j
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4208-1 Rating: moderate References: #1194127 Cross-References: CVE-2021-44832 CVSS scores: CVE-2021-44832 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4208=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.17.0-4.16.1 log4j-javadoc-2.17.0-4.16.1 log4j-jcl-2.17.0-4.16.1 log4j-slf4j-2.17.0-4.16.1 References: https://www.suse.com/security/cve/CVE-2021-44832.html https://bugzilla.suse.com/1194127

1 0

openSUSE-SU-2021:1635-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1635-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1635=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-91.4.0-lp152.2.52.1 MozillaThunderbird-debuginfo-91.4.0-lp152.2.52.1 MozillaThunderbird-debugsource-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-common-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-other-91.4.0-lp152.2.52.1 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:4192-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4192-1 Rating: moderate References: #1174504 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Update to version 20181225: * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4192=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): permissions-20181225-23.9.1 permissions-debuginfo-20181225-23.9.1 permissions-debugsource-20181225-23.9.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20181225-23.9.1 References: https://bugzilla.suse.com/1174504

1 0

openSUSE-SU-2021:1632-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1632-1 Rating: important References: #1192310 #1192734 #1193519 #1193713 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 CVE-2021-4078 CVE-2021-4079 CVE-2021-4098 CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1632=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-96.0.4664.110-lp152.2.143.1 chromedriver-debuginfo-96.0.4664.110-lp152.2.143.1 chromium-96.0.4664.110-lp152.2.143.1 chromium-debuginfo-96.0.4664.110-lp152.2.143.1 References: https://www.suse.com/security/cve/CVE-2021-38005.html https://www.suse.com/security/cve/CVE-2021-38006.html https://www.suse.com/security/cve/CVE-2021-38007.html https://www.suse.com/security/cve/CVE-2021-38008.html https://www.suse.com/security/cve/CVE-2021-38009.html https://www.suse.com/security/cve/CVE-2021-38010.html https://www.suse.com/security/cve/CVE-2021-38011.html https://www.suse.com/security/cve/CVE-2021-38012.html https://www.suse.com/security/cve/CVE-2021-38013.html https://www.suse.com/security/cve/CVE-2021-38014.html https://www.suse.com/security/cve/CVE-2021-38015.html https://www.suse.com/security/cve/CVE-2021-38016.html https://www.suse.com/security/cve/CVE-2021-38017.html https://www.suse.com/security/cve/CVE-2021-38018.html https://www.suse.com/security/cve/CVE-2021-38019.html https://www.suse.com/security/cve/CVE-2021-38020.html https://www.suse.com/security/cve/CVE-2021-38021.html https://www.suse.com/security/cve/CVE-2021-38022.html https://www.suse.com/security/cve/CVE-2021-4052.html https://www.suse.com/security/cve/CVE-2021-4053.html https://www.suse.com/security/cve/CVE-2021-4054.html https://www.suse.com/security/cve/CVE-2021-4055.html https://www.suse.com/security/cve/CVE-2021-4056.html https://www.suse.com/security/cve/CVE-2021-4057.html https://www.suse.com/security/cve/CVE-2021-4058.html https://www.suse.com/security/cve/CVE-2021-4059.html https://www.suse.com/security/cve/CVE-2021-4061.html https://www.suse.com/security/cve/CVE-2021-4062.html https://www.suse.com/security/cve/CVE-2021-4063.html https://www.suse.com/security/cve/CVE-2021-4064.html https://www.suse.com/security/cve/CVE-2021-4065.html https://www.suse.com/security/cve/CVE-2021-4066.html https://www.suse.com/security/cve/CVE-2021-4067.html https://www.suse.com/security/cve/CVE-2021-4068.html https://www.suse.com/security/cve/CVE-2021-4078.html https://www.suse.com/security/cve/CVE-2021-4079.html https://www.suse.com/security/cve/CVE-2021-4098.html https://www.suse.com/security/cve/CVE-2021-4099.html https://www.suse.com/security/cve/CVE-2021-4100.html https://www.suse.com/security/cve/CVE-2021-4101.html https://www.suse.com/security/cve/CVE-2021-4102.html https://bugzilla.suse.com/1192310 https://bugzilla.suse.com/1192734 https://bugzilla.suse.com/1193519 https://bugzilla.suse.com/1193713

1 0

openSUSE-SU-2021:1631-1: important: Security update for kafka
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for kafka ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1631-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update of kafka fixes the following issue: - CVE-2021-4104: Remove JMSAppender from log4j jars during build to prevent bsc#1193662, Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1631=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): kafka-source-2.1.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (x86_64): kafka-kit-2.1.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1625-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1625-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1625=1 Package List: - openSUSE Leap 15.2 (x86_64): runc-1.0.3-lp152.2.12.1 runc-debuginfo-1.0.3-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:1626-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1626-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1626=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.16-1.16.12-lp152.20.1 go1.16-doc-1.16.12-lp152.20.1 go1.16-race-1.16.12-lp152.20.1 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:1624-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1624-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1624=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aom-tools-1.0.0-lp152.3.9.1 aom-tools-debuginfo-1.0.0-lp152.3.9.1 libaom-debugsource-1.0.0-lp152.3.9.1 libaom-devel-1.0.0-lp152.3.9.1 libaom0-1.0.0-lp152.3.9.1 libaom0-debuginfo-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): libaom-devel-doc-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libaom0-32bit-1.0.0-lp152.3.9.1 libaom0-32bit-debuginfo-1.0.0-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:1612-1: important: Security update for log4j12
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for log4j12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1612-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j12 fixes the following issues: - CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1612=1 Package List: - openSUSE Leap 15.2 (noarch): log4j12-1.2.17-lp152.3.3.2 log4j12-javadoc-1.2.17-lp152.3.3.2 log4j12-manual-1.2.17-lp152.3.3.2 log4j12-mini-1.2.17-lp152.3.3.2 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1613-1: important: Security update for logback
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for logback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1613-1 Rating: important References: #1193795 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan="true" set prior to attack This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1613=1 Package List: - openSUSE Leap 15.2 (noarch): logback-1.2.8-lp152.2.3.2 logback-access-1.2.8-lp152.2.3.2 logback-examples-1.2.8-lp152.2.3.2 logback-javadoc-1.2.8-lp152.2.3.2 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193795

1 0

openSUSE-SU-2021:1611-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1611-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1611=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libp11-kit0-0.23.2-lp152.7.3.1 libp11-kit0-debuginfo-0.23.2-lp152.7.3.1 p11-kit-0.23.2-lp152.7.3.1 p11-kit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-debugsource-0.23.2-lp152.7.3.1 p11-kit-devel-0.23.2-lp152.7.3.1 p11-kit-nss-trust-0.23.2-lp152.7.3.1 p11-kit-tools-0.23.2-lp152.7.3.1 p11-kit-tools-debuginfo-0.23.2-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): libp11-kit0-32bit-0.23.2-lp152.7.3.1 libp11-kit0-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-32bit-0.23.2-lp152.7.3.1 p11-kit-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-nss-trust-32bit-0.23.2-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4170-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4170-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4170=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-3.9.1 aom-tools-debuginfo-1.0.0-3.9.1 libaom-debugsource-1.0.0-3.9.1 libaom-devel-1.0.0-3.9.1 libaom0-1.0.0-3.9.1 libaom0-debuginfo-1.0.0-3.9.1 - openSUSE Leap 15.3 (noarch): libaom-devel-doc-1.0.0-3.9.1 - openSUSE Leap 15.3 (x86_64): libaom0-32bit-1.0.0-3.9.1 libaom0-32bit-debuginfo-1.0.0-3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:4169-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4169-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4169=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.12-1.37.2 go1.16-doc-1.16.12-1.37.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.12-1.37.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:4186-1: moderate: Security update for go1.17
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4186-1 Rating: moderate References: #1190649 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4186=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.5-1.14.2 go1.17-doc-1.17.5-1.14.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.5-1.14.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:4171-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4171-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4171=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): runc-1.0.3-27.1 runc-debuginfo-1.0.3-27.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:4150-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4150-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4150=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.4.0-8.45.2 MozillaThunderbird-debuginfo-91.4.0-8.45.2 MozillaThunderbird-debugsource-91.4.0-8.45.2 MozillaThunderbird-translations-common-91.4.0-8.45.2 MozillaThunderbird-translations-other-91.4.0-8.45.2 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:4154-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4154-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4154=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libp11-kit0-0.23.2-4.13.1 libp11-kit0-debuginfo-0.23.2-4.13.1 p11-kit-0.23.2-4.13.1 p11-kit-debuginfo-0.23.2-4.13.1 p11-kit-debugsource-0.23.2-4.13.1 p11-kit-devel-0.23.2-4.13.1 p11-kit-nss-trust-0.23.2-4.13.1 p11-kit-tools-0.23.2-4.13.1 p11-kit-tools-debuginfo-0.23.2-4.13.1 - openSUSE Leap 15.3 (x86_64): libp11-kit0-32bit-0.23.2-4.13.1 libp11-kit0-32bit-debuginfo-0.23.2-4.13.1 p11-kit-32bit-0.23.2-4.13.1 p11-kit-32bit-debuginfo-0.23.2-4.13.1 p11-kit-nss-trust-32bit-0.23.2-4.13.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4153-1: important: Security update for openssh
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4153-1 Rating: important References: #1183137 Cross-References: CVE-2021-28041 CVSS scores: CVE-2021-28041 (NVD) : 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-28041 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssh fixes the following issues: - CVE-2021-28041: Fixed double free in ssh-agent (bsc#1183137). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4153=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openssh-8.4p1-3.9.1 openssh-askpass-gnome-8.4p1-3.9.1 openssh-askpass-gnome-debuginfo-8.4p1-3.9.1 openssh-askpass-gnome-debugsource-8.4p1-3.9.1 openssh-cavs-8.4p1-3.9.1 openssh-cavs-debuginfo-8.4p1-3.9.1 openssh-clients-8.4p1-3.9.1 openssh-clients-debuginfo-8.4p1-3.9.1 openssh-common-8.4p1-3.9.1 openssh-common-debuginfo-8.4p1-3.9.1 openssh-debuginfo-8.4p1-3.9.1 openssh-debugsource-8.4p1-3.9.1 openssh-fips-8.4p1-3.9.1 openssh-helpers-8.4p1-3.9.1 openssh-helpers-debuginfo-8.4p1-3.9.1 openssh-server-8.4p1-3.9.1 openssh-server-debuginfo-8.4p1-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-28041.html https://bugzilla.suse.com/1183137

1 0

openSUSE-SU-2021:1606-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1606-1 Rating: important References: #1190487 #1190488 #1190489 Cross-References: CVE-2021-4009 CVE-2021-4010 CVE-2021-4011 CVSS scores: CVE-2021-4009 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4010 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4011 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4009: The handler for the CreatePointerBarrier request of the XFixes extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190487) - CVE-2021-4010: The handler for the Suspend request of the Screen Saver extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190488) - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. (bsc#1190489) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1606=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.36.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.36.1 xorg-x11-server-debugsource-1.20.3-lp152.8.36.1 xorg-x11-server-extra-1.20.3-lp152.8.36.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.36.1 xorg-x11-server-sdk-1.20.3-lp152.8.36.1 xorg-x11-server-source-1.20.3-lp152.8.36.1 xorg-x11-server-wayland-1.20.3-lp152.8.36.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.36.1 References: https://www.suse.com/security/cve/CVE-2021-4009.html https://www.suse.com/security/cve/CVE-2021-4010.html https://www.suse.com/security/cve/CVE-2021-4011.html https://bugzilla.suse.com/1190487 https://bugzilla.suse.com/1190488 https://bugzilla.suse.com/1190489

1 0

openSUSE-SU-2021:1605-1: important: Security update for log4j
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1605-1 Rating: important References: #1193887 #1193888 Cross-References: CVE-2021-45105 CVSS scores: CVE-2021-45105 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for log4j fixes the following issues: - Update to 2.17.0 - CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation. (bsc#1193887, bsc#1193888) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1605=1 Package List: - openSUSE Leap 15.2 (noarch): log4j-2.17.0-lp152.3.12.1 log4j-javadoc-2.17.0-lp152.3.12.1 log4j-jcl-2.17.0-lp152.3.12.1 log4j-slf4j-2.17.0-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2021-45105.html https://bugzilla.suse.com/1193887 https://bugzilla.suse.com/1193888

1 0

openSUSE-SU-2021:4136-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 21 Dec '21

21 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4136-1 Rating: important References: #1190487 #1190488 #1190489 Cross-References: CVE-2021-4009 CVE-2021-4010 CVE-2021-4011 CVSS scores: CVE-2021-4009 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4010 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4011 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4009: The handler for the CreatePointerBarrier request of the XFixes extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190487) - CVE-2021-4010: The handler for the Suspend request of the Screen Saver extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190488) - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. (bsc#1190489) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4136=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-22.5.42.1 xorg-x11-server-debuginfo-1.20.3-22.5.42.1 xorg-x11-server-debugsource-1.20.3-22.5.42.1 xorg-x11-server-extra-1.20.3-22.5.42.1 xorg-x11-server-extra-debuginfo-1.20.3-22.5.42.1 xorg-x11-server-sdk-1.20.3-22.5.42.1 xorg-x11-server-source-1.20.3-22.5.42.1 xorg-x11-server-wayland-1.20.3-22.5.42.1 xorg-x11-server-wayland-debuginfo-1.20.3-22.5.42.1 References: https://www.suse.com/security/cve/CVE-2021-4009.html https://www.suse.com/security/cve/CVE-2021-4010.html https://www.suse.com/security/cve/CVE-2021-4011.html https://bugzilla.suse.com/1190487 https://bugzilla.suse.com/1190488 https://bugzilla.suse.com/1190489

1 0

openSUSE-SU-2021:1603-1: moderate: Security update for netdata
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for netdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1603-1 Rating: moderate References: #1139094 #1139095 #1139098 Cross-References: CVE-2018-18836 CVE-2018-18837 CVE-2018-18838 CVE-2018-18839 CVSS scores: CVE-2018-18836 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2018-18837 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-18838 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-18839 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for netdata fixes the following issues: Update to 1.31.0 (go.d.plugin 0.29.0) The v1.31.0 release of Netdata comes with re-packaged and redesigned elements of the dashboard to help you focus on your metrics, even more Linux kernel insights via eBPF, on-node machine learning to help you find anomalies, and much more. This release contains 10 new collectors, 54 improvements (7 in the dashboard), 31 documentation updates, and 29 bug fixes. At a glance We re-packaged and redesigned portions of the dashboard to improve the overall experience. Part of this effort is better handling of dashboard code during installation��anyone using third-party packages (such as the Netdata Homebrew formula) will start seeing new features and the new designs starting today. The timeframe picker has moved to the top panel, and just to its right are two counters with live CRITICAL and WARNING alarm statuses for your node. Click on either of these two open the alarms modal. We've also pushed a number of powerful new collectors, including directory cache monitoring via eBPF. By monitoring directory cache, developers and SREs alike can find opportunities to optimize memory usage and reduce disk-intensive operations. Our new Z-scores and changefinder collectors use machine learning to let you know, at a glance, when key metrics start to behave oddly. We'd love to get feedback on these sophisticated, subjective new brand of collectors! Improvements * Automatically trigger Helmchart PR on Agent release. (gh#netdata/netdata#11084) * Implement ACLK env endpoint. (gh#netdata/netdata#10833) * Implement new HTTPS client for ACLK. (gh#netdata/netdata#10805) * Update ACLK passwd endpoint to match specifications of the new architecture. (gh#netdata/netdata#10859) * Implement ACLK new backoff (TBEB) architecture. (gh#netdata/netdata#10941) * Add functionality to store node_id for a host. (gh#netdata/netdata#11059) * Remove version negotiation from ACLK-NG. (gh#netdata/netdata#10980) * Persist claim IDs in local database for parent and children. (gh#netdata/netdata#10993) * Provide more agent analytics to PostHog. (gh#netdata/netdata#11020) * Reduce logging when sending agent analytics. (gh#netdata/netdata#11091) * Remove error message on Netdata restart. (gh#netdata/netdata#8685) * Add a timeout when sending anonymous statistics using curl. (gh#netdata/netdata#11010) * Improve dash-example.html. (gh#netdata/netdata#10870) * Add host_cloud_enabled attribute to analytics. (gh#netdata/netdata#11100) Dashboard * Bundle the react dashboard code into the agent repo directly. (gh#netdata/netdata#11139) * Add dashboard info strings for systemdunits collector. (gh#netdata/netdata#10904) * Update dashboard version to v2.17.0. (gh#netdata/netdata#10856) + Top bar, side panel and overall navigation has been redesigned. + Top bar now includes a light bulb icon with news/features and the number of CRITICAL or WARNING alarms. + Documentation and settings buttons moved to the sidebar. + Improved rendering of sign in/sign up option button along with an operational status option (under user settings). + In the left panel, nodes show a status badge and are now searchable if there are more than 4. Health * Improvements + Add charts configuration option to templates. (gh#netdata/netdata#11054) + Add new attributes to health configuration files. (gh#netdata/netdata#10961) + Add inconsistent state to the mysql_galera_cluster_state alarm. (gh#netdata/netdata#10945) + Add systemdunits collector alarms. (gh#netdata/netdata#10906) + Use average instead of sum in VerneMQ alarms. (gh#netdata/netdata#11037) + Check configuration for CUSTOM and MSTEAM. (gh#netdata/netdata#11113) + Reduce alarms notifications dump logging. (gh#netdata/netdata#11116) * Bug fixes + Add synchronization.conf to the Makefile. (gh#netdata/netdata#10907) + Fix Microsoft Teams naming. (gh#netdata/netdata#9905) Collectors * New + Add a chart for out of memory kills. (gh#netdata/netdata#10880) + Add a chart with Netdata uptime. (gh#netdata/netdata#10997) + Add a module for ZFS pool state. (gh#netdata/netdata#11071) + Add a plugin for the system clock synchronization state. (gh#netdata/netdata#10895) + Add new charts for extended disk metrics. (gh#netdata/netdata#10939) + Add support for renaming libvirtd LXC containers. (gh#netdata/netdata#11006) + Add a metric for Percpu memory. (gh#netdata/netdata#10964) + Add an eBPF directory cache collector. (gh#netdata/netdata#10855) + Add a Z-scores python collector. (gh#netdata/netdata#10673) + Add changefinder python collector. (gh#netdata/netdata#10672) * Improvements + Remove dots in cgroup IDs. (gh#netdata/netdata#11050) + Add support for attribute 249 (NAND Writes 1GiB) to the smartd_log module. (gh#netdata/netdata#10872) + Add RAID level to the mdstat collector chart families. (gh#netdata/netdata#11024) + Update fping version. (gh#netdata/netdata#10977) + Add plugin and module names to the python.d.plugin runtime charts. (gh#netdata/netdata#11007) + Move global stats to a separate thread. (gh#netdata/netdata#10991) + Add memory size adjustments for eBPF hash tables. (gh#netdata/netdata#10962) + Add improvements to anomalies collector. (gh#netdata/netdata#11003) + Add support for loading of kprobe names in the eBPF plugin. (gh#netdata/netdata#11034) + Don't repeat the cgroup discovery cleanup info message. (gh#netdata/netdata#11101) + Change ACLK statistics charts units from kB/s to KiB/s. (gh#netdata/netdata#11103) * Bug fixes + Fix the detection of cgroups v2 by checking the version of the default cgroup mountpoint. (gh#netdata/netdata#11102) + Fix eBPF cachestat chart type. (gh#netdata/netdata#11074) + Fix gaps in eBPF cachestat charts. (gh#netdata/netdata#10972) + Fix detection of opensipsctl executable. (gh#netdata/netdata#10978) + Fix network interfaces detection when using virsh. (gh#netdata/netdata#11096) + Fix eBPF plugin crash during shutdown. (gh#netdata/netdata#10957) Exporting * Improvements + Allow the remote write configuration to have multiple destinations (gh#netdata/netdata#11005) * Bug fixes + Fix backend chart filtering backward compatibility. (gh#netdata/netdata#11002) Bug fixes * Reduce the number of ACLK chart updates during chart obsoletion. (gh#netdata/netdata#11133) * Fix SSL random failures when using multithreaded web server with OpenSSL < 1.1.0. (gh#netdata/netdata#11089) * Fix storing an NULL claim ID on a parent node. (gh#netdata/netdata#11036) * Prevent MQTT connection attempt on OTP failure. (gh#netdata/netdata#10839) * Rename struct fields from class to classification. (gh#netdata/netdata#11019) * Fix spelling mistakes in various components: + aclk (gh#netdata/netdata#10910) + build (gh#netdata/netdata#10909) + collectors (gh#netdata/netdata#10912) + daemon (gh#netdata/netdata#10913) + database (gh#netdata/netdata#10914) + exporting (gh#netdata/netdata#10915) + libnetdata (gh#netdata/netdata#10917) + health (gh#netdata/netdata#10916) + streaming (gh#netdata/netdata#10919) + tests (gh#netdata/netdata#10920) + backend (gh#netdata/netdata#10911) + bidirectional (gh#netdata/netdata#10918) + HTTP API (gh#netdata/netdata#10921) + web (gh#netdata/netdata#10922) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1603=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): netdata-1.31.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18836.html https://www.suse.com/security/cve/CVE-2018-18837.html https://www.suse.com/security/cve/CVE-2018-18838.html https://www.suse.com/security/cve/CVE-2018-18839.html https://bugzilla.suse.com/1139094 https://bugzilla.suse.com/1139095 https://bugzilla.suse.com/1139098

1 0

openSUSE-SU-2021:4118-1: important: Security update for log4j
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4118-1 Rating: important References: #1193887 #1193888 Cross-References: CVE-2021-45105 CVSS scores: CVE-2021-45105 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for log4j fixes the following issues: - Update to 2.17.0 - CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation. (bsc#1193887, bsc#1193888) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4118=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.17.0-4.13.1 log4j-javadoc-2.17.0-4.13.1 log4j-jcl-2.17.0-4.13.1 log4j-slf4j-2.17.0-4.13.1 References: https://www.suse.com/security/cve/CVE-2021-45105.html https://bugzilla.suse.com/1193887 https://bugzilla.suse.com/1193888

1 0

openSUSE-SU-2021:1602-1: important: Security update for nextcloud
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1602-1 Rating: important References: #1192028 #1192030 #1192031 Cross-References: CVE-2021-41177 CVE-2021-41178 CVE-2021-41179 CVSS scores: CVE-2021-41177 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2021-41178 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-41179 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Update to 20.0.14 Security issues fixed: * CVE-2021-41179: Fix boo#1192028 - (CWE-304): Two-Factor Authentication not enforced for pages marked as public * CVE-2021-41178: Fix boo#1192030 - (CWE-434): File Traversal affecting SVG files on Nextcloud Server * CVE-2021-41177: Fix boo#1192031 - (CWE-799): Rate-limits not working on instances without configured memory cache backend Changes: - Add command to repair broken filesystem trees (server#26630) - Ensure that user and group IDs in LDAP's tables are also max 64chars (server#28971) - Change output format of Psalm to Github (server#29048) - File-upload: Correctly handle error responses for HTTP2 (server#29069) - Allow "TwoFactor Nextcloud Notifications" to pull the state of the 2F�� (server#29072) - Add a few sensitive config keys (server#29085) - Fix path of file_get_contents (server#29095) - Update the certificate bundle (server#29098) - Keep pw based auth tokens valid when pw-less login happens (server#29131) - Properly handle folder deletion on external s3 storage (server#29158) - Tokens without password should not trigger changed password invalidation (server#29166) - Don't further setup disabled users when logging in with apache (server#29167) - Add 'supported'-label to all supported apps (server#29181) - 21] generate a better optimized query for path prefix search filters (server#29192) - Keep group restrictions when reenabling apps after an update (server#29198) - Add proper message to created share not found (server#29205) - Add documentation for files_no_background_scan (server#29219) - Don't setup the filesystem to check for a favicon we don't use anyway (server#29223) - Fix background scan doc in config (server#29253) - Get `filesize()` if `file_exists()` (server#29290) - Fix unable to login errors due to file system not being initialized (server#29291) - Update 3rdparty ref (server#29297) - Bump icewind/streams from 0.7.3 to 0.7.5 in files_external (server#29298) - Fix app upgrade (server#29303) - Avoid PHP errors when the LDAP attribute is not found (server#29314) - Fix security issues when copying groupfolder with advanced ACL (server#29366) - Scheduling plugin not updating responding attendee status (server#29387) - Make calendar schedule options translatable (server#29388) - Add whitelist for apps inside of the server repo (server#29396) - Handle files with `is_file` instead of `file_exists` (server#29417) - Fixes an undefined index when getAccessList returns an empty array (server#29421) - Extra fixes needed for icewind/streams update to 0.7.2 (server#29426) - Backport #29260: Respect user enumeration settings in user status lists (server#29429) - Implement local filtering in file list (server#29441) - Detect mimetype by content only with content (server#29457) - Update CRL (server#29505) - Update update-psalm-baseline workflow (server#29548) - Bump icewind/streams from 0.7.1 to 0.7.5 (3rdparty#855) - Bump version (files_pdfviewer#512) - Fix deleting notifications with numeric user ID (notifications#1090) - Add integration tests for push registration (notifications#1097) - Restore old device signature so the proxy works again (notifications#1105) - Bump vue and vue-template-compiler (photos#864) - Bump prosemirror-schema-list from 1.1.5 to 1.1.6 (text#1868) - Additional checks for workspace controller (text#1887) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1602=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1602=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1602=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1602=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2021-1602=1 Package List: - openSUSE Leap 15.2 (noarch): nextcloud-20.0.14-lp152.3.15.1 nextcloud-apache-20.0.14-lp152.3.15.1 - openSUSE Backports SLE-15-SP3 (noarch): nextcloud-20.0.14-bp153.2.9.1 nextcloud-apache-20.0.14-bp153.2.9.1 - openSUSE Backports SLE-15-SP2 (noarch): nextcloud-20.0.14-bp152.2.15.1 nextcloud-apache-20.0.14-bp152.2.15.1 - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-20.0.14-bp151.3.21.1 nextcloud-apache-20.0.14-bp151.3.21.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-20.0.14-34.1 nextcloud-apache-20.0.14-34.1 References: https://www.suse.com/security/cve/CVE-2021-41177.html https://www.suse.com/security/cve/CVE-2021-41178.html https://www.suse.com/security/cve/CVE-2021-41179.html https://bugzilla.suse.com/1192028 https://bugzilla.suse.com/1192030 https://bugzilla.suse.com/1192031

1 0

openSUSE-SU-2021:1602-1: important: Security update for nextcloud
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1602-1 Rating: important References: #1192028 #1192030 #1192031 Cross-References: CVE-2021-41177 CVE-2021-41178 CVE-2021-41179 CVSS scores: CVE-2021-41177 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2021-41178 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-41179 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Update to 20.0.14 Security issues fixed: * CVE-2021-41179: Fix boo#1192028 - (CWE-304): Two-Factor Authentication not enforced for pages marked as public * CVE-2021-41178: Fix boo#1192030 - (CWE-434): File Traversal affecting SVG files on Nextcloud Server * CVE-2021-41177: Fix boo#1192031 - (CWE-799): Rate-limits not working on instances without configured memory cache backend Changes: - Add command to repair broken filesystem trees (server#26630) - Ensure that user and group IDs in LDAP's tables are also max 64chars (server#28971) - Change output format of Psalm to Github (server#29048) - File-upload: Correctly handle error responses for HTTP2 (server#29069) - Allow "TwoFactor Nextcloud Notifications" to pull the state of the 2F�� (server#29072) - Add a few sensitive config keys (server#29085) - Fix path of file_get_contents (server#29095) - Update the certificate bundle (server#29098) - Keep pw based auth tokens valid when pw-less login happens (server#29131) - Properly handle folder deletion on external s3 storage (server#29158) - Tokens without password should not trigger changed password invalidation (server#29166) - Don't further setup disabled users when logging in with apache (server#29167) - Add 'supported'-label to all supported apps (server#29181) - 21] generate a better optimized query for path prefix search filters (server#29192) - Keep group restrictions when reenabling apps after an update (server#29198) - Add proper message to created share not found (server#29205) - Add documentation for files_no_background_scan (server#29219) - Don't setup the filesystem to check for a favicon we don't use anyway (server#29223) - Fix background scan doc in config (server#29253) - Get `filesize()` if `file_exists()` (server#29290) - Fix unable to login errors due to file system not being initialized (server#29291) - Update 3rdparty ref (server#29297) - Bump icewind/streams from 0.7.3 to 0.7.5 in files_external (server#29298) - Fix app upgrade (server#29303) - Avoid PHP errors when the LDAP attribute is not found (server#29314) - Fix security issues when copying groupfolder with advanced ACL (server#29366) - Scheduling plugin not updating responding attendee status (server#29387) - Make calendar schedule options translatable (server#29388) - Add whitelist for apps inside of the server repo (server#29396) - Handle files with `is_file` instead of `file_exists` (server#29417) - Fixes an undefined index when getAccessList returns an empty array (server#29421) - Extra fixes needed for icewind/streams update to 0.7.2 (server#29426) - Backport #29260: Respect user enumeration settings in user status lists (server#29429) - Implement local filtering in file list (server#29441) - Detect mimetype by content only with content (server#29457) - Update CRL (server#29505) - Update update-psalm-baseline workflow (server#29548) - Bump icewind/streams from 0.7.1 to 0.7.5 (3rdparty#855) - Bump version (files_pdfviewer#512) - Fix deleting notifications with numeric user ID (notifications#1090) - Add integration tests for push registration (notifications#1097) - Restore old device signature so the proxy works again (notifications#1105) - Bump vue and vue-template-compiler (photos#864) - Bump prosemirror-schema-list from 1.1.5 to 1.1.6 (text#1868) - Additional checks for workspace controller (text#1887) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2021-1602=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-20.0.14-34.1 nextcloud-apache-20.0.14-34.1 References: https://www.suse.com/security/cve/CVE-2021-41177.html https://www.suse.com/security/cve/CVE-2021-41178.html https://www.suse.com/security/cve/CVE-2021-41179.html https://bugzilla.suse.com/1192028 https://bugzilla.suse.com/1192030 https://bugzilla.suse.com/1192031

1 0

openSUSE-SU-2021:1601-1: important: Security update for log4j
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1601-1 Rating: important References: #1193743 Cross-References: CVE-2021-44228 CVE-2021-45046 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-45046 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-45046 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for log4j fixes the following issue: - Previously published fixes for log4jshell turned out to be incomplete. Upstream has followed up on the original patch for CVE-2021-44228 with several additional changes (LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and LOG4J2-3211) that are included in this update. Since the totality of those patches is pretty much equivalent to an update to the latest version of log4j, we did update the package's tarball from version 2.13.0 to 2.16.0 instead of trying to apply those patches to the old version. This change brings in a new dependency on "jakarta-servlet" and a version update of "disruptor". [bsc#1193743, CVE-2021-45046] This update was imported from SUSE:SLE-15-SP2:Update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1601=1 Package List: - openSUSE Leap 15.2 (noarch): disruptor-3.4.4-lp152.2.3.1 disruptor-javadoc-3.4.4-lp152.2.3.1 jakarta-servlet-5.0.0-lp152.2.1 jakarta-servlet-javadoc-5.0.0-lp152.2.1 log4j-2.16.0-lp152.3.9.1 log4j-javadoc-2.16.0-lp152.3.9.1 log4j-jcl-2.16.0-lp152.3.9.1 log4j-slf4j-2.16.0-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://www.suse.com/security/cve/CVE-2021-45046.html https://bugzilla.suse.com/1193743

1 0

openSUSE-SU-2021:1600-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Dec '21

20 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1600-1 Rating: important References: #1193713 Cross-References: CVE-2021-4098 CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1600=1 Package List: - openSUSE Backports SLE-15-SP3 (x86_64): chromedriver-96.0.4664.110-bp153.2.48.1 chromium-96.0.4664.110-bp153.2.48.1 References: https://www.suse.com/security/cve/CVE-2021-4098.html https://www.suse.com/security/cve/CVE-2021-4099.html https://www.suse.com/security/cve/CVE-2021-4100.html https://www.suse.com/security/cve/CVE-2021-4101.html https://www.suse.com/security/cve/CVE-2021-4102.html https://bugzilla.suse.com/1193713

1 0

openSUSE-SU-2021:1598-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 19 Dec '21

19 Dec '21

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1598-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pip fixes the following issues: - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1598=1 Package List: - openSUSE Leap 15.2 (noarch): python2-pip-10.0.1-lp152.4.9.1 python2-pip-wheel-10.0.1-lp152.4.9.1 python3-pip-10.0.1-lp152.4.9.1 python3-pip-wheel-10.0.1-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2021-3572.html https://bugzilla.suse.com/1186819

1 0

openSUSE-SU-2021:1595-1: moderate: Security update for barrier
by opensuse-security＠opensuse.org 19 Dec '21

19 Dec '21

openSUSE Security Update: Security update for barrier ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1595-1 Rating: moderate References: Cross-References: CVE-2021-42072 CVE-2021-42073 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for barrier fixes the following issues: Updated to version 2.4.0: Barrier now supports client identity verification (fixes CVE-2021-42072, CVE-2021-42073). Previously a malicious client could connect to Barrier server without any authentication and send application-level messages. This made the attack surface of Barrier significantly larger. Additionally, in case the malicious client got possession of a valid screen name by brute forcing or other means it could modify the clipboard contents of the server. To support seamless upgrades from older versions of Barrier this is currently disabled by default. The feature can be enabled in the settings dialog. If enabled, older clients of Barrier will be rejected. Barrier now uses SHA256 fingerprints for establishing security of encrypted SSL connections. After upgrading client to new version the existing server fingerprint will need to be approved again. Client and server will show both SHA1 and SHA256 server fingerprints to allow interoperability with older versions of Barrier. Bugfixes: * Fixed build failure on mips*el and riscv64 architecture. * Barrier no longer uses openssl CLI tool for any operations and hooks into the openssl library directly. * More X11 clipboard MIME types have been mapped to corresponding converters (#344). * Fixed setup of multiple actions associated with a hotkey. * Fixed setup of hotkeys with special characters such as comma and semicolon (#778). * Fixed transfer of non-ASCII characters coming from a Windows server in certain cases (#527). * Barrier will now regenerate server certificate if it's invalid instead of failing to launch (#802) * Added support for additional keys on Sun Microsystems USB keyboards (#784). * Updated Chinese translation. * Updated Slovak translation. * Theme icons are now preferred to icons distributed together with Barrier (#471). Features: * Added --drop-target option that improves drag and drop support on Windows when Barrier is being run as a portable app. * The --enable-crypto command line option has been made the default to reduce chances of accidental security mishaps when configuring Barrier from command line. A new --disable-crypto command line option has been added to explicitly disable encryption. * Added support for randomart images for easier comparison of SSL certificate fingerprints. The algorithm is identical to what OpenSSH uses. * Implemented a configuration option for Server GUI auto-start. * Made it possible to use keyboard instead of mouse to modify screen layout. * Added support for keyboard backlight media keys * Added support for Eisu_toggle and Muhenkan keys * Added --profile-dir option that allows to select custom profile directory. submitted upstream at https://github.com/symless/synergy-core/pull/6261 * Bug #4749 - Clipboard thread race condition causes assertion * Bug #4720 - Plugin download shows 'Could not get Linux package * Bug #4712 - Unable to send clipboard with size above 1KB when * Bug #4690 - Log line 'activeDesktop' does not use logging * Enhancement #4901 - Auto restart when running from GUI in * Bug #4650 - SSL error log message repeats excessively and * Bug #4601 - Large clipboard data with SSL causes 'protocol is * Bug #4593 - Locking Windows server causes SSL_ERROR_SSL to * Bug #4538 - Windows service crashes intermittently with no * Bug #4566 - Client or server crashes with 'ssl handshake * Bug #4706 - Installer is not output to build config dir * Bug #4704 - Plugin 'ns' release build is overwritten with * Bug #4697 - Timing can allow an SSL socket to be used after * Enhancement #4661 - Log error but do not crash when failing * Enhancement #4708 - Download ns plugin for specific Mac * Enhancement #4587 - Include OpenSSL binaries in source for * Enhancement #4695 - Automatically upload plugins as Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1595=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64): barrier-2.4.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-42072.html https://www.suse.com/security/cve/CVE-2021-42073.html

1 0

openSUSE-SU-2021:1592-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 18 Dec '21

18 Dec '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1592-1 Rating: moderate References: #1192712 Cross-References: CVE-2021-41259 CVSS scores: CVE-2021-41259 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nim fixes the following issues: - CVE-2021-41259: Fixed vulnerability in URL parser that allowed a null byte bypass (boo#1192712) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1592=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): nim-1.2.12-bp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-41259.html https://bugzilla.suse.com/1192712

1 0

openSUSE-SU-2021:4112-1: important: Security update for log4j12
by opensuse-security＠opensuse.org 17 Dec '21

17 Dec '21

openSUSE Security Update: Security update for log4j12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4112-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j12 fixes the following issues: - CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4112=1 Package List: - openSUSE Leap 15.3 (noarch): log4j12-1.2.17-4.3.1 log4j12-javadoc-1.2.17-4.3.1 log4j12-manual-1.2.17-4.3.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:4111-1: important: Security update for log4j
by opensuse-security＠opensuse.org 17 Dec '21

17 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4111-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issue: - CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4111=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-manual-1.2.17-5.6.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:4109-1: important: Security update for logback
by opensuse-security＠opensuse.org 17 Dec '21

17 Dec '21

openSUSE Security Update: Security update for logback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4109-1 Rating: important References: #1193795 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan="true" set prior to attack Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4109=1 Package List: - openSUSE Leap 15.3 (noarch): logback-1.2.8-3.3.1 logback-access-1.2.8-3.3.1 logback-examples-1.2.8-3.3.1 logback-javadoc-1.2.8-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193795

1 0

openSUSE-SU-2021:1591-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 17 Dec '21

17 Dec '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1591-1 Rating: moderate References: #1152964 #1174075 #1181400 #1188875 #1190069 #1190896 SLE-17903 SLE-18059 SLE-18159 Cross-References: CVE-2021-36386 CVE-2021-39272 CVSS scores: CVE-2021-36386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36386 (SUSE): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-39272 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities, contains three features and has four fixes is now available. Description: This update for fetchmail fixes the following issues: - CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875). - CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069). - Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059) - Remove all python2 dependencies (bsc#1190896). - De-hardcode /usr/lib path for launch executable (bsc#1174075). - Added hardening to systemd service(s) (bsc#1181400). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1591=1 Package List: - openSUSE Leap 15.2 (x86_64): fetchmail-6.4.22-lp152.6.12.1 fetchmail-debuginfo-6.4.22-lp152.6.12.1 fetchmail-debugsource-6.4.22-lp152.6.12.1 fetchmailconf-6.4.22-lp152.6.12.1 References: https://www.suse.com/security/cve/CVE-2021-36386.html https://www.suse.com/security/cve/CVE-2021-39272.html https://bugzilla.suse.com/1152964 https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1188875 https://bugzilla.suse.com/1190069 https://bugzilla.suse.com/1190896

1 0

openSUSE-SU-2021:4107-1: important: Security update for log4j
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4107-1 Rating: important References: #1193743 Cross-References: CVE-2021-44228 CVE-2021-45046 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-45046 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-45046 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for log4j fixes the following issue: - Previously published fixes for log4jshell turned out to be incomplete. Upstream has followed up on the original patch for CVE-2021-44228 with several additional changes (LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and LOG4J2-3211) that are included in this update. Since the totality of those patches is pretty much equivalent to an update to the latest version of log4j, we did update the package's tarball from version 2.13.0 to 2.16.0 instead of trying to apply those patches to the old version. This change brings in a new dependency on "jakarta-servlet" and a version update of "disruptor". [bsc#1193743, CVE-2021-45046] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4107=1 Package List: - openSUSE Leap 15.3 (noarch): disruptor-3.4.4-3.3.1 disruptor-javadoc-3.4.4-3.3.1 jakarta-servlet-5.0.0-5.3.1 jakarta-servlet-javadoc-5.0.0-5.3.1 log4j-2.16.0-4.10.1 log4j-javadoc-2.16.0-4.10.1 log4j-jcl-2.16.0-4.10.1 log4j-slf4j-2.16.0-4.10.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://www.suse.com/security/cve/CVE-2021-45046.html https://bugzilla.suse.com/1193743

1 0

openSUSE-SU-2021:1588-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1588-1 Rating: important References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for seamonkey fixes the following issues: update to SeaMonkey 2.53.10.1 * Security fix for NSS code bug 1737470. * Only use networks and servers in lower case in ChatZilla bug 1742502. * Change classic form icon in SeaMonkey composer bug 1710915. * Addition fixes for SeaMonkey 32x32 default icons on Windows and macOS bug 1729153. * SeaMonkey 2.53.10.1 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.10.1 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 91.4 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.10 * Minor fixes for testdisplay command in ChatZilla bug 1727976. * Show CTCP requests (excluding ACTION and DCC) bug 1722156. * IRCv3: Add support for server-time bug 1724586. * Add localization note for network editor dialog width in ChatZilla bug 1727977. * IRCv3: Add support for extended-join and account-notify bug 1722159. * Add ability to collapse message groups in ChatZilla bug 1724588. * Fix JS strict warnings in unescapeTagValue in ChatZilla bug 1727989. * IRCv3: Add support for invite-notify bug 1722161. * IRCv3: Add support for batch bug 1724589. * Fix JS strict warning in addHistory in cZ static.js bug 1727992. * IRCv3: Add support for cap-notify bug 1722162. * Stop using canonical name as collection keys in ChatZilla bug 1728025. * IRCv3: Add support for TLS and STS bug 1722166. * Helper function for renaming irc server properties in ChatZilla bug 1728027. * IRCv3: Add support for MONITOR bug 1722174. * Remove use of msg.commasp in ChatZilla bug 1726965. * Allow shiftKey to modify behaviour of link clicking in cZ bug 1713458. * IRCv3: Add support for echo-message bug 1722211. * In ChatZilla make /commands return all matches starting with pattern bug 1726966. * Use SeaMonkey prefs to determine how links behave in cZ bug 1713467. * Allow parameters to be localised in ChatZilla bug 1724105. * Add identify command to cZ and hook into password management bug 1713470. * IRCv3.1: Implement SASL with PLAIN mechanism bug 1717545. * IRCv3: Add support for message tags bug 1724584. * Add last read message divider to ChatZilla bug 1729159. * IRCv3: Add support for account-tag bug 1724585. * Missing option "text encoding Unicode/UTF-8" in preferences - Mailnews bug 1679260. * Detect Crashreporter using AppConstants in SeaMonkey bug 1735236. * Link about LEGACY extensions in Add-ons Manager is broken bug 1656797. * Update help for clear private data preferences and dialog bug 1728911. * Fix typo in cs_nav_prefs_appearance bug 1737473. * Drop leftover "Edit Menu" comment from messageWindow.xul and addressbook.xul bug 1725121. * Add dummy tab routines to SeaMonkey mailnews tab browser bug 1735243. * Folder pane and tab/window title not updated correctly when opening in new tab bug 1726940. * Allow mail tab bar to be controlled separately to browser tab bar bug 1724515. * Copy any user set values for new mail.tabs prefs bug 1729165. * Merge Master Passwords and Passwords pref panes into a single pref pane bug 1728099. * Move warning about redirection pref from Content to Privacy & Security pane bug 1728185. * Move website icons prefs from content pref pane to browser pref pane bug 1727425. * Move browser / mailnews system integration prefs into advanced pane bug 1727659. * Have separate opentabfor.middleclick for mailnews bug 1727948. * Add removeBrowser helper for tabbrowser bug 1730391. * Put <browser> in a <stack> so it's easy to overlay bug 1730392. * Allow browser focus to be avoided bug 1720003. * SeaMonkey 32x32 default icon has light stripe at the bottom bug 1729153. * Support <input type=time> and <input type=date> in SeaMonkey bug 1730408. * Middleclick on browser tab handled twice (closes tab and loads URL from primary or clipboard) bug 1734407. * Unable to create a new "Saved Search Folder" using "Save View as a Folder..." bug 1738669. * Enable compression for standard http connections bug 1728996. * Support VS2022 for compiling under Windows bug 1728988. * SeaMonkey 2.53.10 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.10 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.15 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.9.1 * Fix the lazy loading of images from some websites bug 1727967. * Move certain font family defaults from serif to sans serif bug 1727982. * SeaMonkey 2.53.9.1 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.9.1 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.14 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.9 * There is now an option to clear browser history during shutdown bug 1621445. * Uninstall plugin command for ChatZilla bug 541719. * Update icons used in ChatZilla status bar bug 1710238 and bug 1710249. * Make ChatZilla understand mIRC color code 99 bug 1710298. * Implement IRCv3 basic CAP negotiation bug 1717539 and CAP LIST and update CAP ACK and CAP LS bug 1710313. * Use Unicode instead of images for emojis in ChatZilla bug 1711375 and add some extra emojis bug 1711376. * Use SeaMonkey's configured web search rather than a separate one in ChatZilla bug 1712498. * Add a networks editor to ChatZilla bug 1716232. * Implement IRCv3 away-notify bug 1717543, chghost and userhost-in-names bug 1717544, self-messaging bug 1722212 and WHOX bug 1722214. * Link to SeaMonkey website in debugQA for verification sites and development section bug 1685606. * Send button should be disable until we have a recipient bug 104973. * Remove need to use a modifier for marking messages as unread bug 1719216. * SeaMonkey 2.53.9 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.9 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.13 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1588=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 x86_64): seamonkey-2.53.10.1-bp153.10.1 seamonkey-dom-inspector-2.53.10.1-bp153.10.1 seamonkey-irc-2.53.10.1-bp153.10.1 References:

1 0

openSUSE-SU-2021:4104-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4104-1 Rating: moderate References: #1180125 #1183374 #1183858 #1185588 #1187668 #1189241 #1189287 Cross-References: CVE-2021-3426 CVE-2021-3733 CVE-2021-3737 CVSS scores: CVE-2021-3426 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3426 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3733 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3737 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for python3 fixes the following issues: - CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374). - CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241). - CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287). - We do not require python-rpm-macros package (bsc#1180125). - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858). - Stop providing "python" symbol, which means python2 currently (bsc#1185588). - Modify Lib/ensurepip/__init__.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4104=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-10.9.1 libpython3_6m1_0-debuginfo-3.6.15-10.9.1 python3-3.6.15-10.9.1 python3-base-3.6.15-10.9.1 python3-base-debuginfo-3.6.15-10.9.1 python3-core-debugsource-3.6.15-10.9.1 python3-curses-3.6.15-10.9.1 python3-curses-debuginfo-3.6.15-10.9.1 python3-dbm-3.6.15-10.9.1 python3-dbm-debuginfo-3.6.15-10.9.1 python3-debuginfo-3.6.15-10.9.1 python3-debugsource-3.6.15-10.9.1 python3-devel-3.6.15-10.9.1 python3-devel-debuginfo-3.6.15-10.9.1 python3-doc-3.6.15-10.9.1 python3-doc-devhelp-3.6.15-10.9.1 python3-idle-3.6.15-10.9.1 python3-testsuite-3.6.15-10.9.1 python3-testsuite-debuginfo-3.6.15-10.9.1 python3-tk-3.6.15-10.9.1 python3-tk-debuginfo-3.6.15-10.9.1 python3-tools-3.6.15-10.9.1 - openSUSE Leap 15.3 (x86_64): libpython3_6m1_0-32bit-3.6.15-10.9.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-10.9.1 References: https://www.suse.com/security/cve/CVE-2021-3426.html https://www.suse.com/security/cve/CVE-2021-3733.html https://www.suse.com/security/cve/CVE-2021-3737.html https://bugzilla.suse.com/1180125 https://bugzilla.suse.com/1183374 https://bugzilla.suse.com/1183858 https://bugzilla.suse.com/1185588 https://bugzilla.suse.com/1187668 https://bugzilla.suse.com/1189241 https://bugzilla.suse.com/1189287

1 0

openSUSE-SU-2021:1587-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1587-1 Rating: important References: #1193030 Cross-References: CVE-2021-4008 CVSS scores: CVE-2021-4008 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4008: Fixed Privilege Escalation Vulnerability via Out-Of-Bounds Access in SProcRenderCompositeGlyphs (bsc#1193030). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1587=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.33.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.33.1 xorg-x11-server-debugsource-1.20.3-lp152.8.33.1 xorg-x11-server-extra-1.20.3-lp152.8.33.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.33.1 xorg-x11-server-sdk-1.20.3-lp152.8.33.1 xorg-x11-server-source-1.20.3-lp152.8.33.1 xorg-x11-server-wayland-1.20.3-lp152.8.33.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.33.1 References: https://www.suse.com/security/cve/CVE-2021-4008.html https://bugzilla.suse.com/1193030

1 0

openSUSE-SU-2021:1586-1: important: Security update for log4j
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1586-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issue: CVE-2021-44228: The previously published fix by upstream turned out to be incomplete. Therefore, upstream has recommended disabling JNDI support in log4j by default to be completely sure that this vulnerability cannot be exploited. This update implements that recommendation and disables JNDI support by default. [bsc#1193611, CVE-2021-44228] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1586=1 Package List: - openSUSE Leap 15.2 (noarch): log4j-2.13.0-lp152.3.6.1 log4j-javadoc-2.13.0-lp152.3.6.1 log4j-jcl-2.13.0-lp152.3.6.1 log4j-slf4j-2.13.0-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:1585-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1585-1 Rating: moderate References: #1192712 Cross-References: CVE-2021-41259 CVSS scores: CVE-2021-41259 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nim fixes the following issues: - CVE-2021-41259: Fixed vulnerability in URL parser that allowed a null byte bypass (boo#1192712) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1585=1 Package List: - openSUSE Leap 15.2 (x86_64): nim-1.2.12-lp152.2.6.1 nim-debuginfo-1.2.12-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-41259.html https://bugzilla.suse.com/1192712

1 0

openSUSE-SU-2021:1584-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1584-1 Rating: important References: #1192516 Cross-References: CVE-2021-23214 CVE-2021-23222 CVSS scores: CVE-2021-23214 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-23222 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1584=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): postgresql10-10.19-lp152.2.27.1 postgresql10-contrib-10.19-lp152.2.27.1 postgresql10-contrib-debuginfo-10.19-lp152.2.27.1 postgresql10-debuginfo-10.19-lp152.2.27.1 postgresql10-debugsource-10.19-lp152.2.27.1 postgresql10-devel-10.19-lp152.2.27.1 postgresql10-devel-debuginfo-10.19-lp152.2.27.1 postgresql10-plperl-10.19-lp152.2.27.1 postgresql10-plperl-debuginfo-10.19-lp152.2.27.1 postgresql10-plpython-10.19-lp152.2.27.1 postgresql10-plpython-debuginfo-10.19-lp152.2.27.1 postgresql10-pltcl-10.19-lp152.2.27.1 postgresql10-pltcl-debuginfo-10.19-lp152.2.27.1 postgresql10-server-10.19-lp152.2.27.1 postgresql10-server-debuginfo-10.19-lp152.2.27.1 postgresql10-test-10.19-lp152.2.27.1 - openSUSE Leap 15.2 (noarch): postgresql10-docs-10.19-lp152.2.27.1 References: https://www.suse.com/security/cve/CVE-2021-23214.html https://www.suse.com/security/cve/CVE-2021-23222.html https://bugzilla.suse.com/1192516

1 0

openSUSE-SU-2021:4094-1: important: Security update for log4j
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4094-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issue: CVE-2021-44228: The previously published fix by upstream turned out to be incomplete. Therefore, upstream has recommended disabling JNDI support in log4j by default to be completely sure that this vulnerability cannot be exploited. This update implements that recommendation and disables JNDI support by default. [bsc#1193611, CVE-2021-44228] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4094=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.13.0-4.6.1 log4j-javadoc-2.13.0-4.6.1 log4j-jcl-2.13.0-4.6.1 log4j-slf4j-2.13.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:4063-1: important: Security update for icu.691
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for icu.691 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4063-1 Rating: important References: #1158955 #1159131 #1161007 #1162882 #1167603 #1182252 #1182645 SLE-17893 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes and contains one feature can now be installed. Description: This update for icu.691 fixes the following issues: - Renamed package from icu 69.1 for SUSE:SLE-15-SP3:Update. (jsc#SLE-17893) - Fix undefined behaviour in 'ComplexUnitsConverter::applyRounder' - Update to release 69.1 - For Norwegian, "no" is back to being the canonical code, with "nb" treated as equivalent. This aligns handling of Norwegian with other macro language codes. - Binary prefixes in measurement units (KiB, MiB, etc.) - Time zone offsets from local time with new APIs. - Don't disable testsuite under 'qemu-linux-user' - Fixed an issue when ICU test on 'aarch64 fails. (bsc#1182645) - Drop 'SUSE_ASNEEDED' as the issue was in binutils. (bsc#1182252) - Fix 'pthread' dependency issue. (bsc#1182252) - Update to release 68.2 - Fix memory problem in 'FormattedStringBuilder' - Fix assertion when 'setKeywordValue w/' long value. - Fix UBSan breakage on 8bit of rbbi - fix int32_t overflow in listFormat - Fix memory handling in MemoryPool::operator=() - Fix memory leak in AliasReplacer - Add back icu.keyring. - Update to release 68.1 - PluralRules selection for ranges of numbers - Locale ID canonicalization now conforms to the CLDR spec including edge cases - DateIntervalFormat supports output options such as capitalization - Measurement units are normalized in skeleton string output - Time zone data (tzdata) version 2020d - Add the provides for libicu to Make .Net core can install successfully. (bsc#1167603, bsc#1161007) - Update to version 67.1 - Unicode 13 (ICU-20893, same as in ICU 66) - Total of 5930 new characters - 4 new scripts - 55 new emoji characters, plus additional new sequences - New CJK extension, first characters in plane 3: U+30000..U+3134A - New language at Modern coverage: Nigerian Pidgin - New languages at Basic coverage: Fulah (Adlam), Maithili, Manipuri, Santali, Sindhi (Devanagari), Sundanese - Region containment: EU no longer includes GB - Unicode 13 root collation data and Chinese data for collation and transliteration - DateTimePatternGenerator now obeys the "hc" preference in the locale identifier - Various other improvements for ECMA-402 conformance - Number skeletons have a new "concise" form that can be used in MessageFormat strings - Currency formatting options for formal and other currency display name variants - ListFormatter: new public API to select the style & type - ListFormatter now selects the proper ��and��/��or�� form for Spanish & Hebrew. - Locale ID canonicalization upgraded to implement the complete CLDR spec. - LocaleMatcher: New option to ignore one-way matches - acceptLanguage() reimplemented via LocaleMatcher - Data build tool: tzdbNames.res moved from the "zone_tree" category to the "zone_supplemental" category - Fixed uses of u8"literals" broken by the C++20 introduction of the incompatible char8_t type - and added a few API overloads to reduce the need for reinterpret_cast. - Support for manipulating CLDR 37 unit identifiers in MeasureUnit. - Drop icu-versioning. (bsc#1159131) - Update to version 66.1 - Unicode 13 support - Fix uses of u8"literals" broken by C++20 introduction of incompatible char8_t type. - Fixed an issue when Qt apps can't handle non-ASCII filesystem path. ([bsc#1162882) - Remove '/usr/lib(64)/icu/current'. (bsc#1158955) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4063=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): icu.691-69.1-7.3.2 icu.691-debuginfo-69.1-7.3.2 icu.691-debugsource-69.1-7.3.2 icu.691-devel-69.1-7.3.2 icu.691-doc-69.1-7.3.2 libicu69-69.1-7.3.2 libicu69-debuginfo-69.1-7.3.2 - openSUSE Leap 15.3 (noarch): libicu69-bedata-69.1-7.3.2 libicu69-ledata-69.1-7.3.2 References: https://bugzilla.suse.com/1158955 https://bugzilla.suse.com/1159131 https://bugzilla.suse.com/1161007 https://bugzilla.suse.com/1162882 https://bugzilla.suse.com/1167603 https://bugzilla.suse.com/1182252 https://bugzilla.suse.com/1182645

1 0

openSUSE-SU-2021:4070-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4070-1 Rating: important References: #1193030 Cross-References: CVE-2021-4008 CVSS scores: CVE-2021-4008 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4008: Fixed Privilege Escalation Vulnerability via Out-Of-Bounds Access in SProcRenderCompositeGlyphs (bsc#1193030). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4070=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xorg-x11-server-1.20.3-22.5.39.1 xorg-x11-server-debuginfo-1.20.3-22.5.39.1 xorg-x11-server-debugsource-1.20.3-22.5.39.1 xorg-x11-server-extra-1.20.3-22.5.39.1 xorg-x11-server-extra-debuginfo-1.20.3-22.5.39.1 xorg-x11-server-sdk-1.20.3-22.5.39.1 xorg-x11-server-source-1.20.3-22.5.39.1 xorg-x11-server-wayland-1.20.3-22.5.39.1 xorg-x11-server-wayland-debuginfo-1.20.3-22.5.39.1 References: https://www.suse.com/security/cve/CVE-2021-4008.html https://bugzilla.suse.com/1193030

1 0

openSUSE-SU-2021:4058-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4058-1 Rating: important References: #1192516 Cross-References: CVE-2021-23214 CVE-2021-23222 CVSS scores: CVE-2021-23214 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-23222 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4058=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): postgresql10-10.19-8.41.1 postgresql10-contrib-10.19-8.41.1 postgresql10-contrib-debuginfo-10.19-8.41.1 postgresql10-debuginfo-10.19-8.41.1 postgresql10-debugsource-10.19-8.41.1 postgresql10-plperl-10.19-8.41.1 postgresql10-plperl-debuginfo-10.19-8.41.1 postgresql10-plpython-10.19-8.41.1 postgresql10-plpython-debuginfo-10.19-8.41.1 postgresql10-pltcl-10.19-8.41.1 postgresql10-pltcl-debuginfo-10.19-8.41.1 postgresql10-server-10.19-8.41.1 postgresql10-server-debuginfo-10.19-8.41.1 postgresql10-test-10.19-8.41.1 - openSUSE Leap 15.3 (noarch): postgresql10-docs-10.19-8.41.1 References: https://www.suse.com/security/cve/CVE-2021-23214.html https://www.suse.com/security/cve/CVE-2021-23222.html https://bugzilla.suse.com/1192516

1 0

openSUSE-SU-2021:4018-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4018-1 Rating: moderate References: #1152964 #1174075 #1181400 #1188875 #1190069 #1190896 SLE-17903 SLE-18059 SLE-18159 Cross-References: CVE-2021-36386 CVE-2021-39272 CVSS scores: CVE-2021-36386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36386 (SUSE): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-39272 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities, contains three features and has four fixes is now available. Description: This update for fetchmail fixes the following issues: - CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875). - CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069). - Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059) - Remove all python2 dependencies (bsc#1190896). - De-hardcode /usr/lib path for launch executable (bsc#1174075). - Added hardening to systemd service(s) (bsc#1181400). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4018=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fetchmail-6.4.22-20.20.1 fetchmail-debuginfo-6.4.22-20.20.1 fetchmail-debugsource-6.4.22-20.20.1 fetchmailconf-6.4.22-20.20.1 References: https://www.suse.com/security/cve/CVE-2021-36386.html https://www.suse.com/security/cve/CVE-2021-39272.html https://bugzilla.suse.com/1152964 https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1188875 https://bugzilla.suse.com/1190069 https://bugzilla.suse.com/1190896

1 0

openSUSE-SU-2021:1583-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1583-1 Rating: moderate References: #1181836 Cross-References: CVE-2021-20176 CVSS scores: CVE-2021-20176 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20176 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20176: Fixed division by zero caused by processing crafted file (bsc#1181836). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1583=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ImageMagick-7.0.7.34-lp152.12.18.1 ImageMagick-config-7-SUSE-7.0.7.34-lp152.12.18.1 ImageMagick-config-7-upstream-7.0.7.34-lp152.12.18.1 ImageMagick-debuginfo-7.0.7.34-lp152.12.18.1 ImageMagick-debugsource-7.0.7.34-lp152.12.18.1 ImageMagick-devel-7.0.7.34-lp152.12.18.1 ImageMagick-extra-7.0.7.34-lp152.12.18.1 ImageMagick-extra-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-devel-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.18.1 perl-PerlMagick-7.0.7.34-lp152.12.18.1 perl-PerlMagick-debuginfo-7.0.7.34-lp152.12.18.1 - openSUSE Leap 15.2 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-devel-32bit-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.18.1 - openSUSE Leap 15.2 (noarch): ImageMagick-doc-7.0.7.34-lp152.12.18.1 References: https://www.suse.com/security/cve/CVE-2021-20176.html https://bugzilla.suse.com/1181836

1 0

openSUSE-SU-2021:1582-1: important: Security update for chromium
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1582-1 Rating: important References: #1192310 #1192734 #1193519 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 CVE-2021-4078 CVE-2021-4079 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 36 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Ensure newer libs and LLVM is used on Leap (boo#1192310) - Explicitly BuildRequire python3-six. Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication Lord of the Browsers: The Two Compilers: * Go back to GCC Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1582=1 Package List: - openSUSE Backports SLE-15-SP3 (x86_64): chromedriver-96.0.4664.93-bp153.2.45.2 chromedriver-debuginfo-96.0.4664.93-bp153.2.45.2 chromium-96.0.4664.93-bp153.2.45.2 chromium-debuginfo-96.0.4664.93-bp153.2.45.2 References: https://www.suse.com/security/cve/CVE-2021-38005.html https://www.suse.com/security/cve/CVE-2021-38006.html https://www.suse.com/security/cve/CVE-2021-38007.html https://www.suse.com/security/cve/CVE-2021-38008.html https://www.suse.com/security/cve/CVE-2021-38009.html https://www.suse.com/security/cve/CVE-2021-38010.html https://www.suse.com/security/cve/CVE-2021-38011.html https://www.suse.com/security/cve/CVE-2021-38012.html https://www.suse.com/security/cve/CVE-2021-38013.html https://www.suse.com/security/cve/CVE-2021-38014.html https://www.suse.com/security/cve/CVE-2021-38015.html https://www.suse.com/security/cve/CVE-2021-38016.html https://www.suse.com/security/cve/CVE-2021-38017.html https://www.suse.com/security/cve/CVE-2021-38018.html https://www.suse.com/security/cve/CVE-2021-38019.html https://www.suse.com/security/cve/CVE-2021-38020.html https://www.suse.com/security/cve/CVE-2021-38021.html https://www.suse.com/security/cve/CVE-2021-38022.html https://www.suse.com/security/cve/CVE-2021-4052.html https://www.suse.com/security/cve/CVE-2021-4053.html https://www.suse.com/security/cve/CVE-2021-4054.html https://www.suse.com/security/cve/CVE-2021-4055.html https://www.suse.com/security/cve/CVE-2021-4056.html https://www.suse.com/security/cve/CVE-2021-4057.html https://www.suse.com/security/cve/CVE-2021-4058.html https://www.suse.com/security/cve/CVE-2021-4059.html https://www.suse.com/security/cve/CVE-2021-4061.html https://www.suse.com/security/cve/CVE-2021-4062.html https://www.suse.com/security/cve/CVE-2021-4063.html https://www.suse.com/security/cve/CVE-2021-4064.html https://www.suse.com/security/cve/CVE-2021-4065.html https://www.suse.com/security/cve/CVE-2021-4066.html https://www.suse.com/security/cve/CVE-2021-4067.html https://www.suse.com/security/cve/CVE-2021-4068.html https://www.suse.com/security/cve/CVE-2021-4078.html https://www.suse.com/security/cve/CVE-2021-4079.html https://bugzilla.suse.com/1192310 https://bugzilla.suse.com/1192734 https://bugzilla.suse.com/1193519

1 0

openSUSE-SU-2021:4001-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4001-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pip fixes the following issues: - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4001=1 Package List: - openSUSE Leap 15.3 (noarch): python2-pip-20.0.2-6.15.1 python3-pip-20.0.2-6.15.1 References: https://www.suse.com/security/cve/CVE-2021-3572.html https://bugzilla.suse.com/1186819

1 0

openSUSE-SU-2021:1577-1: important: Security update for log4j
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1577-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2021-44228: Fix a remote code execution vulnerability that existed in the LDAP JNDI parser. [bsc#1193611, CVE-2021-44228] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1577=1 Package List: - openSUSE Leap 15.2 (noarch): log4j-2.13.0-lp152.3.3.1 log4j-javadoc-2.13.0-lp152.3.3.1 log4j-jcl-2.13.0-lp152.3.3.1 log4j-slf4j-2.13.0-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:4002-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4002-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pip fixes the following issues: - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4002=1 Package List: - openSUSE Leap 15.3 (noarch): python2-pip-wheel-10.0.1-3.9.1 python3-pip-wheel-10.0.1-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-3572.html https://bugzilla.suse.com/1186819

1 0

openSUSE-SU-2021:3999-1: important: Security update for log4j
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3999-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2021-44228: Fix a remote code execution vulnerability that existed in the LDAP JNDI parser. [bsc#1193611, CVE-2021-44228] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3999=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.13.0-4.3.1 log4j-javadoc-2.13.0-4.3.1 log4j-jcl-2.13.0-4.3.1 log4j-slf4j-2.13.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:1574-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1574-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1574=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs12-12.22.7-lp152.3.21.1 nodejs12-debuginfo-12.22.7-lp152.3.21.1 nodejs12-debugsource-12.22.7-lp152.3.21.1 nodejs12-devel-12.22.7-lp152.3.21.1 npm12-12.22.7-lp152.3.21.1 - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.22.7-lp152.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

openSUSE-SU-2021:1575-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1575-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1575=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-91.4.0-lp152.2.74.1 MozillaFirefox-branding-upstream-91.4.0-lp152.2.74.1 MozillaFirefox-debuginfo-91.4.0-lp152.2.74.1 MozillaFirefox-debugsource-91.4.0-lp152.2.74.1 MozillaFirefox-devel-91.4.0-lp152.2.74.1 MozillaFirefox-translations-common-91.4.0-lp152.2.74.1 MozillaFirefox-translations-other-91.4.0-lp152.2.74.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:1573-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1573-1 Rating: moderate References: #1188284 #1192346 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav fixes the following issues: - Update to 0.103.4 (bsc#1192346). - Update to 0.103.3 (bsc#1188284). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1573=1 Package List: - openSUSE Leap 15.2 (x86_64): clamav-0.103.4-lp152.6.12.1 clamav-debuginfo-0.103.4-lp152.6.12.1 clamav-debugsource-0.103.4-lp152.6.12.1 clamav-devel-0.103.4-lp152.6.12.1 libclamav9-0.103.4-lp152.6.12.1 libclamav9-debuginfo-0.103.4-lp152.6.12.1 libfreshclam2-0.103.4-lp152.6.12.1 libfreshclam2-debuginfo-0.103.4-lp152.6.12.1 References: https://bugzilla.suse.com/1188284 https://bugzilla.suse.com/1192346

1 0

openSUSE-SU-2021:1569-1: moderate: Security update for gmp
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for gmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1569-1 Rating: moderate References: #1192717 Cross-References: CVE-2021-43618 CVSS scores: CVE-2021-43618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43618 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gmp fixes the following issues: - CVE-2021-43618: Fixed buffer overflow via crafted input in mpz/inp_raw.c (bsc#1192717). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1569=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gmp-debugsource-6.1.2-lp152.6.6.1 gmp-devel-6.1.2-lp152.6.6.1 libgmp10-6.1.2-lp152.6.6.1 libgmp10-debuginfo-6.1.2-lp152.6.6.1 libgmpxx4-6.1.2-lp152.6.6.1 libgmpxx4-debuginfo-6.1.2-lp152.6.6.1 - openSUSE Leap 15.2 (x86_64): gmp-devel-32bit-6.1.2-lp152.6.6.1 libgmp10-32bit-6.1.2-lp152.6.6.1 libgmp10-32bit-debuginfo-6.1.2-lp152.6.6.1 libgmpxx4-32bit-6.1.2-lp152.6.6.1 libgmpxx4-32bit-debuginfo-6.1.2-lp152.6.6.1 References: https://www.suse.com/security/cve/CVE-2021-43618.html https://bugzilla.suse.com/1192717

1 0

openSUSE-SU-2021:1570-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1570-1 Rating: moderate References: #1175508 #1192050 #1193041 Cross-References: CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1570=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.21.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.21.1 php7-7.4.6-lp152.2.21.1 php7-bcmath-7.4.6-lp152.2.21.1 php7-bcmath-debuginfo-7.4.6-lp152.2.21.1 php7-bz2-7.4.6-lp152.2.21.1 php7-bz2-debuginfo-7.4.6-lp152.2.21.1 php7-calendar-7.4.6-lp152.2.21.1 php7-calendar-debuginfo-7.4.6-lp152.2.21.1 php7-ctype-7.4.6-lp152.2.21.1 php7-ctype-debuginfo-7.4.6-lp152.2.21.1 php7-curl-7.4.6-lp152.2.21.1 php7-curl-debuginfo-7.4.6-lp152.2.21.1 php7-dba-7.4.6-lp152.2.21.1 php7-dba-debuginfo-7.4.6-lp152.2.21.1 php7-debuginfo-7.4.6-lp152.2.21.1 php7-debugsource-7.4.6-lp152.2.21.1 php7-devel-7.4.6-lp152.2.21.1 php7-dom-7.4.6-lp152.2.21.1 php7-dom-debuginfo-7.4.6-lp152.2.21.1 php7-embed-7.4.6-lp152.2.21.1 php7-embed-debuginfo-7.4.6-lp152.2.21.1 php7-enchant-7.4.6-lp152.2.21.1 php7-enchant-debuginfo-7.4.6-lp152.2.21.1 php7-exif-7.4.6-lp152.2.21.1 php7-exif-debuginfo-7.4.6-lp152.2.21.1 php7-fastcgi-7.4.6-lp152.2.21.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.21.1 php7-fileinfo-7.4.6-lp152.2.21.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.21.1 php7-firebird-7.4.6-lp152.2.21.1 php7-firebird-debuginfo-7.4.6-lp152.2.21.1 php7-fpm-7.4.6-lp152.2.21.1 php7-fpm-debuginfo-7.4.6-lp152.2.21.1 php7-ftp-7.4.6-lp152.2.21.1 php7-ftp-debuginfo-7.4.6-lp152.2.21.1 php7-gd-7.4.6-lp152.2.21.1 php7-gd-debuginfo-7.4.6-lp152.2.21.1 php7-gettext-7.4.6-lp152.2.21.1 php7-gettext-debuginfo-7.4.6-lp152.2.21.1 php7-gmp-7.4.6-lp152.2.21.1 php7-gmp-debuginfo-7.4.6-lp152.2.21.1 php7-iconv-7.4.6-lp152.2.21.1 php7-iconv-debuginfo-7.4.6-lp152.2.21.1 php7-intl-7.4.6-lp152.2.21.1 php7-intl-debuginfo-7.4.6-lp152.2.21.1 php7-json-7.4.6-lp152.2.21.1 php7-json-debuginfo-7.4.6-lp152.2.21.1 php7-ldap-7.4.6-lp152.2.21.1 php7-ldap-debuginfo-7.4.6-lp152.2.21.1 php7-mbstring-7.4.6-lp152.2.21.1 php7-mbstring-debuginfo-7.4.6-lp152.2.21.1 php7-mysql-7.4.6-lp152.2.21.1 php7-mysql-debuginfo-7.4.6-lp152.2.21.1 php7-odbc-7.4.6-lp152.2.21.1 php7-odbc-debuginfo-7.4.6-lp152.2.21.1 php7-opcache-7.4.6-lp152.2.21.1 php7-opcache-debuginfo-7.4.6-lp152.2.21.1 php7-openssl-7.4.6-lp152.2.21.1 php7-openssl-debuginfo-7.4.6-lp152.2.21.1 php7-pcntl-7.4.6-lp152.2.21.1 php7-pcntl-debuginfo-7.4.6-lp152.2.21.1 php7-pdo-7.4.6-lp152.2.21.1 php7-pdo-debuginfo-7.4.6-lp152.2.21.1 php7-pgsql-7.4.6-lp152.2.21.1 php7-pgsql-debuginfo-7.4.6-lp152.2.21.1 php7-phar-7.4.6-lp152.2.21.1 php7-phar-debuginfo-7.4.6-lp152.2.21.1 php7-posix-7.4.6-lp152.2.21.1 php7-posix-debuginfo-7.4.6-lp152.2.21.1 php7-readline-7.4.6-lp152.2.21.1 php7-readline-debuginfo-7.4.6-lp152.2.21.1 php7-shmop-7.4.6-lp152.2.21.1 php7-shmop-debuginfo-7.4.6-lp152.2.21.1 php7-snmp-7.4.6-lp152.2.21.1 php7-snmp-debuginfo-7.4.6-lp152.2.21.1 php7-soap-7.4.6-lp152.2.21.1 php7-soap-debuginfo-7.4.6-lp152.2.21.1 php7-sockets-7.4.6-lp152.2.21.1 php7-sockets-debuginfo-7.4.6-lp152.2.21.1 php7-sodium-7.4.6-lp152.2.21.1 php7-sodium-debuginfo-7.4.6-lp152.2.21.1 php7-sqlite-7.4.6-lp152.2.21.1 php7-sqlite-debuginfo-7.4.6-lp152.2.21.1 php7-sysvmsg-7.4.6-lp152.2.21.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.21.1 php7-sysvsem-7.4.6-lp152.2.21.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.21.1 php7-sysvshm-7.4.6-lp152.2.21.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.21.1 php7-test-7.4.6-lp152.2.21.1 php7-tidy-7.4.6-lp152.2.21.1 php7-tidy-debuginfo-7.4.6-lp152.2.21.1 php7-tokenizer-7.4.6-lp152.2.21.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.21.1 php7-xmlreader-7.4.6-lp152.2.21.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.21.1 php7-xmlrpc-7.4.6-lp152.2.21.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.21.1 php7-xmlwriter-7.4.6-lp152.2.21.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.21.1 php7-xsl-7.4.6-lp152.2.21.1 php7-xsl-debuginfo-7.4.6-lp152.2.21.1 php7-zip-7.4.6-lp152.2.21.1 php7-zip-debuginfo-7.4.6-lp152.2.21.1 php7-zlib-7.4.6-lp152.2.21.1 php7-zlib-debuginfo-7.4.6-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1175508 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041

1 0

openSUSE-SU-2021:3996-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3996-1 Rating: moderate References: #1181836 Cross-References: CVE-2021-20176 CVSS scores: CVE-2021-20176 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20176 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20176: Fixed division by zero caused by processing crafted file (bsc#1181836). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3996=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ImageMagick-7.0.7.34-10.18.1 ImageMagick-config-7-SUSE-7.0.7.34-10.18.1 ImageMagick-config-7-upstream-7.0.7.34-10.18.1 ImageMagick-debuginfo-7.0.7.34-10.18.1 ImageMagick-debugsource-7.0.7.34-10.18.1 ImageMagick-devel-7.0.7.34-10.18.1 ImageMagick-extra-7.0.7.34-10.18.1 ImageMagick-extra-debuginfo-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 perl-PerlMagick-7.0.7.34-10.18.1 perl-PerlMagick-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (x86_64): ImageMagick-devel-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (noarch): ImageMagick-doc-7.0.7.34-10.18.1 References: https://www.suse.com/security/cve/CVE-2021-20176.html https://bugzilla.suse.com/1181836

1 0

openSUSE-SU-2021:3993-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3993-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3993=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.4.0-152.9.1 MozillaFirefox-branding-upstream-91.4.0-152.9.1 MozillaFirefox-debuginfo-91.4.0-152.9.1 MozillaFirefox-debugsource-91.4.0-152.9.1 MozillaFirefox-devel-91.4.0-152.9.1 MozillaFirefox-translations-common-91.4.0-152.9.1 MozillaFirefox-translations-other-91.4.0-152.9.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:1566-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1566-1 Rating: moderate References: #1192830 Cross-References: CVE-2021-39920 CVE-2021-39921 CVE-2021-39922 CVE-2021-39924 CVE-2021-39925 CVE-2021-39926 CVE-2021-39928 CVE-2021-39929 CVSS scores: CVE-2021-39920 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39921 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39922 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39924 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39924 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39925 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39926 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39926 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39928 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39929 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Update to Wireshark 3.4.10: - CVE-2021-39920: IPPUSB dissector crash (bsc#1192830). - CVE-2021-39921: Modbus dissector crash (bsc#1192830). - CVE-2021-39922: C12.22 dissector crash (bsc#1192830). - CVE-2021-39924: Bluetooth DHT dissector large loop (bsc#1192830). - CVE-2021-39925: Bluetooth SDP dissector crash (bsc#1192830). - CVE-2021-39926: Bluetooth HCI_ISO dissector crash (bsc#1192830). - CVE-2021-39928: IEEE 802.11 dissector crash (bsc#1192830). - CVE-2021-39929: Bluetooth DHT dissector crash (bsc#1192830). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1566=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark14-3.4.10-lp152.2.21.1 libwireshark14-debuginfo-3.4.10-lp152.2.21.1 libwiretap11-3.4.10-lp152.2.21.1 libwiretap11-debuginfo-3.4.10-lp152.2.21.1 libwsutil12-3.4.10-lp152.2.21.1 libwsutil12-debuginfo-3.4.10-lp152.2.21.1 wireshark-3.4.10-lp152.2.21.1 wireshark-debuginfo-3.4.10-lp152.2.21.1 wireshark-debugsource-3.4.10-lp152.2.21.1 wireshark-devel-3.4.10-lp152.2.21.1 wireshark-ui-qt-3.4.10-lp152.2.21.1 wireshark-ui-qt-debuginfo-3.4.10-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-39920.html https://www.suse.com/security/cve/CVE-2021-39921.html https://www.suse.com/security/cve/CVE-2021-39922.html https://www.suse.com/security/cve/CVE-2021-39924.html https://www.suse.com/security/cve/CVE-2021-39925.html https://www.suse.com/security/cve/CVE-2021-39926.html https://www.suse.com/security/cve/CVE-2021-39928.html https://www.suse.com/security/cve/CVE-2021-39929.html https://bugzilla.suse.com/1192830

1 0

openSUSE-SU-2021:1560-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1560-1 Rating: moderate References: #1027496 #1183085 Cross-References: CVE-2016-10228 CVSS scores: CVE-2016-10228 (NVD) : 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2016-10228 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - libio: do not attempt to free wide buffers of legacy streams (bsc#1183085) - CVE-2016-10228: Rewrite iconv option parsing to fix security issue (bsc#1027496) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1560=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.12.1 glibc-debuginfo-2.26-lp152.26.12.1 glibc-debugsource-2.26-lp152.26.12.1 glibc-devel-2.26-lp152.26.12.1 glibc-devel-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-2.26-lp152.26.12.1 glibc-locale-2.26-lp152.26.12.1 glibc-locale-base-2.26-lp152.26.12.1 glibc-locale-base-debuginfo-2.26-lp152.26.12.1 glibc-profile-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.12.1 glibc-extra-debuginfo-2.26-lp152.26.12.1 glibc-utils-2.26-lp152.26.12.1 glibc-utils-debuginfo-2.26-lp152.26.12.1 glibc-utils-src-debugsource-2.26-lp152.26.12.1 nscd-2.26-lp152.26.12.1 nscd-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.12.1 glibc-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-32bit-2.26-lp152.26.12.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.12.1 glibc-profile-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.12.1 glibc-i18ndata-2.26-lp152.26.12.1 glibc-info-2.26-lp152.26.12.1 References: https://www.suse.com/security/cve/CVE-2016-10228.html https://bugzilla.suse.com/1027496 https://bugzilla.suse.com/1183085

1 0

openSUSE-SU-2021:1552-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1552-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1552=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.18.1-lp152.17.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.18.1-lp152.17.1 nodejs14-debuginfo-14.18.1-lp152.17.1 nodejs14-debugsource-14.18.1-lp152.17.1 nodejs14-devel-14.18.1-lp152.17.1 npm14-14.18.1-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

openSUSE-SU-2021:1553-1: important: Security update for python-Babel
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for python-Babel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: #1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution (bsc#1185768). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1553=1 Package List: - openSUSE Leap 15.2 (noarch): python-Babel-doc-2.8.0-lp152.2.3.1 python2-Babel-2.8.0-lp152.2.3.1 python3-Babel-2.8.0-lp152.2.3.1 python3-Babel-doc-2.8.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-42771.html https://bugzilla.suse.com/1185768

1 0

openSUSE-SU-2021:1554-1: important: Security update for glib-networking
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glib-networking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1554-1 Rating: important References: #1172460 Cross-References: CVE-2020-13645 CVSS scores: CVE-2020-13645 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-13645 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glib-networking fixes the following issues: Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1554=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): glib-networking-2.62.4-lp152.2.3.1 glib-networking-debuginfo-2.62.4-lp152.2.3.1 glib-networking-debugsource-2.62.4-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): glib-networking-lang-2.62.4-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): glib-networking-32bit-2.62.4-lp152.2.3.1 glib-networking-32bit-debuginfo-2.62.4-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13645.html https://bugzilla.suse.com/1172460

1 0

openSUSE-SU-2021:1557-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1557-1 Rating: important References: #1192063 Cross-References: CVE-2021-30846 CVE-2021-30851 CVSS scores: CVE-2021-30846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30846 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). - CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1557=1 Package List: - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-2.34.1-lp152.2.25.3 libjavascriptcoregtk-4_0-18-debuginfo-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-debuginfo-2.34.1-lp152.2.25.3 typelib-1_0-JavaScriptCore-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-lp152.2.25.3 webkit-jsc-4-2.34.1-lp152.2.25.3 webkit-jsc-4-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk3-debugsource-2.34.1-lp152.2.25.3 webkit2gtk3-devel-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-debuginfo-2.34.1-lp152.2.25.3 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.34.1-lp152.2.25.3 References: https://www.suse.com/security/cve/CVE-2021-30846.html https://www.suse.com/security/cve/CVE-2021-30851.html https://bugzilla.suse.com/1192063

1 0

openSUSE-SU-2021:1550-1: moderate: Security update for hiredis
by opensuse-security＠opensuse.org 09 Dec '21

09 Dec '21

openSUSE Security Update: Security update for hiredis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1550-1 Rating: moderate References: #1191331 Cross-References: CVE-2021-32765 CVSS scores: CVE-2021-32765 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiredis fixes the following issues: - CVE-2021-32765: Fix integer/buffer (boo#1191331) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1550=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): hiredis-0.13.3-bp152.4.3.1 hiredis-devel-0.13.3-bp152.4.3.1 libhiredis0_13-0.13.3-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-32765.html https://bugzilla.suse.com/1191331

1 0

openSUSE-SU-2021:3968-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3968-1 Rating: moderate References: #1027519 #1191363 #1192554 #1192557 #1192559 Cross-References: CVE-2021-28702 CVE-2021-28704 CVE-2021-28705 CVE-2021-28706 CVE-2021-28707 CVE-2021-28708 CVE-2021-28709 CVSS scores: CVE-2021-28702 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-28704 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28705 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28705 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28706 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-28706 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28707 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28708 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28709 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363). - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557). - CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559). - CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554). - Update to Xen 4.14.3 bug fix release (bsc#1027519). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3968=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.3_04-3.15.1 xen-debugsource-4.14.3_04-3.15.1 xen-devel-4.14.3_04-3.15.1 xen-doc-html-4.14.3_04-3.15.1 xen-libs-4.14.3_04-3.15.1 xen-libs-debuginfo-4.14.3_04-3.15.1 xen-tools-4.14.3_04-3.15.1 xen-tools-debuginfo-4.14.3_04-3.15.1 xen-tools-domU-4.14.3_04-3.15.1 xen-tools-domU-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.3_04-3.15.1 xen-libs-32bit-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.3_04-3.15.1 References: https://www.suse.com/security/cve/CVE-2021-28702.html https://www.suse.com/security/cve/CVE-2021-28704.html https://www.suse.com/security/cve/CVE-2021-28705.html https://www.suse.com/security/cve/CVE-2021-28706.html https://www.suse.com/security/cve/CVE-2021-28707.html https://www.suse.com/security/cve/CVE-2021-28708.html https://www.suse.com/security/cve/CVE-2021-28709.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191363 https://bugzilla.suse.com/1192554 https://bugzilla.suse.com/1192557 https://bugzilla.suse.com/1192559

1 0

openSUSE-SU-2021:3964-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3964-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3964=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.18.1-15.21.2 nodejs14-debuginfo-14.18.1-15.21.2 nodejs14-debugsource-14.18.1-15.21.2 nodejs14-devel-14.18.1-15.21.2 npm14-14.18.1-15.21.2 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.18.1-15.21.2 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

Discontinuation notice of openSUSE Leap 15.2
by Marcus Meissner 07 Dec '21

07 Dec '21

Hi folks, This is the discontinuation notice for openSUSE Leap 15.2. On December 31st 2021 openSUSE Leap 15.2 will reach its end of support after 1.5 years of lifetime (it was released June 2020). openSUSE Leap 15.2 will receive no further maintenance or security updates after that date. It is recommended for openSUSE Leap users to upgrade to the current release openSUSE Leap 15.3. The next release openSUSE Leap 15.4 is scheduled for mid 2022. (I tried sending it our earlier, but I used the old list addresses.) Ciao, Marcus, for SUSE Security and openSUSE Maintenance

1 0

openSUSE-SU-2021:1543-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1543-1 Rating: moderate References: #1027519 #1191363 #1192554 #1192557 #1192559 Cross-References: CVE-2021-28702 CVE-2021-28704 CVE-2021-28705 CVE-2021-28706 CVE-2021-28707 CVE-2021-28708 CVE-2021-28709 CVSS scores: CVE-2021-28702 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-28704 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28705 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28706 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-28706 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28707 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28708 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28709 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363). - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557). - CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559). - CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554). - Update to Xen 4.13.4 bug fix release (bsc#1027519). This update was imported from the SUSE:SLE-15-SP2:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1543=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.4_02-lp152.2.33.1 xen-devel-4.13.4_02-lp152.2.33.1 xen-libs-4.13.4_02-lp152.2.33.1 xen-libs-debuginfo-4.13.4_02-lp152.2.33.1 xen-tools-domU-4.13.4_02-lp152.2.33.1 xen-tools-domU-debuginfo-4.13.4_02-lp152.2.33.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.4_02-lp152.2.33.1 xen-doc-html-4.13.4_02-lp152.2.33.1 xen-libs-32bit-4.13.4_02-lp152.2.33.1 xen-libs-32bit-debuginfo-4.13.4_02-lp152.2.33.1 xen-tools-4.13.4_02-lp152.2.33.1 xen-tools-debuginfo-4.13.4_02-lp152.2.33.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.4_02-lp152.2.33.1 References: https://www.suse.com/security/cve/CVE-2021-28702.html https://www.suse.com/security/cve/CVE-2021-28704.html https://www.suse.com/security/cve/CVE-2021-28705.html https://www.suse.com/security/cve/CVE-2021-28706.html https://www.suse.com/security/cve/CVE-2021-28707.html https://www.suse.com/security/cve/CVE-2021-28708.html https://www.suse.com/security/cve/CVE-2021-28709.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191363 https://bugzilla.suse.com/1192554 https://bugzilla.suse.com/1192557 https://bugzilla.suse.com/1192559

1 0

openSUSE-SU-2021:3946-1: moderate: Security update for gmp
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for gmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3946-1 Rating: moderate References: #1192717 Cross-References: CVE-2021-43618 CVSS scores: CVE-2021-43618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43618 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gmp fixes the following issues: - CVE-2021-43618: Fixed buffer overflow via crafted input in mpz/inp_raw.c (bsc#1192717). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3946=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gmp-debugsource-6.1.2-4.9.1 gmp-devel-6.1.2-4.9.1 libgmp10-6.1.2-4.9.1 libgmp10-debuginfo-6.1.2-4.9.1 libgmpxx4-6.1.2-4.9.1 libgmpxx4-debuginfo-6.1.2-4.9.1 - openSUSE Leap 15.3 (x86_64): gmp-devel-32bit-6.1.2-4.9.1 libgmp10-32bit-6.1.2-4.9.1 libgmp10-32bit-debuginfo-6.1.2-4.9.1 libgmpxx4-32bit-6.1.2-4.9.1 libgmpxx4-32bit-debuginfo-6.1.2-4.9.1 References: https://www.suse.com/security/cve/CVE-2021-43618.html https://bugzilla.suse.com/1192717

1 0

openSUSE-SU-2021:1544-1: moderate: Security update for aaa_base
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1544-1 Rating: moderate References: #1162581 #1174504 #1191563 #1192248 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for aaa_base fixes the following issues: - Allowed ping and ICMP commands without CAP_NET_RAW (bsc#1174504). - Add $HOME/.local/bin to PATH, if it exists (bsc#1192248). - Fixed get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563). - Support xz compressed kernel (bsc#1162581) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1544=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aaa_base-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-debugsource-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-extras-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-lp152.14.10.1 aaa_base-wsl-84.87+git20180409.04c9dae-lp152.14.10.1 References: https://bugzilla.suse.com/1162581 https://bugzilla.suse.com/1174504 https://bugzilla.suse.com/1191563 https://bugzilla.suse.com/1192248

1 0

openSUSE-SU-2021:3940-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3940-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3940=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.7-4.22.1 nodejs12-debuginfo-12.22.7-4.22.1 nodejs12-debugsource-12.22.7-4.22.1 nodejs12-devel-12.22.7-4.22.1 npm12-12.22.7-4.22.1 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.7-4.22.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

openSUSE-SU-2021:3944-1: important: Security update for glib-networking
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for glib-networking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3944-1 Rating: important References: #1172460 Cross-References: CVE-2020-13645 CVSS scores: CVE-2020-13645 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-13645 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glib-networking fixes the following issues: Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset (bsc#1172460). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3944=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): glib-networking-2.62.4-3.3.1 glib-networking-debuginfo-2.62.4-3.3.1 glib-networking-debugsource-2.62.4-3.3.1 - openSUSE Leap 15.3 (noarch): glib-networking-lang-2.62.4-3.3.1 - openSUSE Leap 15.3 (x86_64): glib-networking-32bit-2.62.4-3.3.1 glib-networking-32bit-debuginfo-2.62.4-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-13645.html https://bugzilla.suse.com/1172460

1 0

openSUSE-SU-2021:1535-1: important: Security update for ruby2.5
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1535-1 Rating: important References: #1188160 #1188161 #1190375 Cross-References: CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 CVSS scores: CVE-2021-31799 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-31810 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-32066 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ruby2.5 fixes the following issues: - CVE-2021-31799: Fixed Command injection vulnerability in RDoc (bsc#1190375). - CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161). - CVE-2021-32066: Fixed StartTLS stripping vulnerability in Net:IMAP (bsc#1188160). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1535=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libruby2_5-2_5-2.5.9-lp152.2.9.1 libruby2_5-2_5-debuginfo-2.5.9-lp152.2.9.1 ruby2.5-2.5.9-lp152.2.9.1 ruby2.5-debuginfo-2.5.9-lp152.2.9.1 ruby2.5-debugsource-2.5.9-lp152.2.9.1 ruby2.5-devel-2.5.9-lp152.2.9.1 ruby2.5-devel-extra-2.5.9-lp152.2.9.1 ruby2.5-doc-2.5.9-lp152.2.9.1 ruby2.5-stdlib-2.5.9-lp152.2.9.1 ruby2.5-stdlib-debuginfo-2.5.9-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): ruby2.5-doc-ri-2.5.9-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-31799.html https://www.suse.com/security/cve/CVE-2021-31810.html https://www.suse.com/security/cve/CVE-2021-32066.html https://bugzilla.suse.com/1188160 https://bugzilla.suse.com/1188161 https://bugzilla.suse.com/1190375

1 0

openSUSE-SU-2021:3942-1: moderate: Security update for brotli
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for brotli ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3942-1 Rating: moderate References: #1175825 Cross-References: CVE-2020-8927 CVSS scores: CVE-2020-8927 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2020-8927 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for brotli fixes the following issues: - CVE-2020-8927: Fixed integer overflow when input chunk is larger than 2GiB (bsc#1175825). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3942=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): brotli-1.0.7-3.3.1 brotli-debuginfo-1.0.7-3.3.1 brotli-debugsource-1.0.7-3.3.1 libbrotli-devel-1.0.7-3.3.1 libbrotlicommon1-1.0.7-3.3.1 libbrotlicommon1-debuginfo-1.0.7-3.3.1 libbrotlidec1-1.0.7-3.3.1 libbrotlidec1-debuginfo-1.0.7-3.3.1 libbrotlienc1-1.0.7-3.3.1 libbrotlienc1-debuginfo-1.0.7-3.3.1 - openSUSE Leap 15.3 (x86_64): libbrotlicommon1-32bit-1.0.7-3.3.1 libbrotlicommon1-32bit-debuginfo-1.0.7-3.3.1 libbrotlidec1-32bit-1.0.7-3.3.1 libbrotlidec1-32bit-debuginfo-1.0.7-3.3.1 libbrotlienc1-32bit-1.0.7-3.3.1 libbrotlienc1-32bit-debuginfo-1.0.7-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-8927.html https://bugzilla.suse.com/1175825

1 0

openSUSE-SU-2021:1539-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1539-1 Rating: moderate References: #1182345 #1192377 #1192378 Cross-References: CVE-2021-41771 CVE-2021-41772 CVSS scores: CVE-2021-41772 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Security update go1.16.10 (released 2021-11-04) (bsc#1182345). - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377). - CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1539=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.16-1.16.10-lp152.17.1 go1.16-doc-1.16.10-lp152.17.1 go1.16-race-1.16.10-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-41771.html https://www.suse.com/security/cve/CVE-2021-41772.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1192377 https://bugzilla.suse.com/1192378

1 0

openSUSE-SU-2021:3941-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3941-1 Rating: important References: #1152489 #1169263 #1170269 #1184924 #1190523 #1190795 #1191790 #1191961 #1192045 #1192217 #1192273 #1192328 #1192375 #1192473 #1192718 #1192740 #1192745 #1192750 #1192753 #1192758 #1192781 #1192802 #1192896 #1192906 #1192918 SLE-22573 Cross-References: CVE-2021-0941 CVE-2021-20322 CVE-2021-31916 CVE-2021-34981 CVSS scores: CVE-2021-0941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20322 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-31916 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-31916 (SUSE): 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-34981 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities, contains one feature and has 21 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0) - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045 ). - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781). - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790) - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961). The following non-security bugs were fixed: - ABI: sysfs-kernel-slab: Document some stats (git-fixes). - ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes). - ALSA: hda: Free card instance properly at probe errors (git-fixes). - ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes). - ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375). - ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes). - ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375). - ALSA: usb-audio: Use int for dB map values (bsc#1192375). - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473). - auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes). - auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes). - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes). - bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573) - bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22574) - bpf: Disallow unprivileged bpf by default (jsc#SLE-22573). - bpf: Disallow unprivileged bpf by default (jsc#SLE-22574). - bpf: Fix BPF_JIT kconfig symbol dependency (git-fixes jsc#SLE-22574). - bpf: Fix potential race in tail call compatibility check (git-fixes). - bpf, kconfig: Add consolidated menu entry for bpf with core options (jsc#SLE-22574). - btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896). - btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896). - btrfs: fix memory ordering between normal and ordered work functions (git-fixes). - btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896). - cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes). - config: disable unprivileged BPF by default (jsc#SLE-22573) Backport of mainline commit 8a03e56b253e ("bpf: Disallow unprivileged bpf by default") only changes kconfig default, used e.g. for "make oldconfig" when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default. - crypto: caam - disable pkc for non-E SoCs (git-fixes). - crypto: qat - detect PFVF collision after ACK (git-fixes). - crypto: qat - disregard spurious PFVF interrupts (git-fixes). - drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758). - drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802). - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489). - Eradicate Patch-mainline: No The pre-commit check can reject this deprecated tag then. - exfat: fix erroneous discard when clear cluster bit (git-fixes). - exfat: handle wrong stream entry size in exfat_readdir() (git-fixes). - exfat: properly set s_time_gran (bsc#1192328). - exfat: truncate atimes to 2s granularity (bsc#1192328). - Fix problem with missing installkernel on Tumbleweed. - fuse: fix page stealing (bsc#1192718). - gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code and avoid a leak (git-fixes). - gpio/rockchip: add driver for rockchip gpio (bsc#1192217). - gpio/rockchip: drop irq_gc_lock/irq_gc_unlock for irq set type (bsc#1192217). - gpio/rockchip: extended debounce support is only available on v2 (bsc#1192217). - gpio/rockchip: fetch deferred output settings on probe (bsc#1192217). - gpio/rockchip: fix get_direction value handling (bsc#1192217). - gpio/rockchip: support next version gpio controller (bsc#1192217). - gpio/rockchip: use struct rockchip_gpio_regs for gpio controller (bsc#1192217). - HID: u2fzero: clarify error check and length calculations (git-fixes). - HID: u2fzero: properly handle timeouts in usb_submit_urb (git-fixes). - ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510). - ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629). - ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629). - iio: dac: ad5446: Fix ad5622_write() return value (git-fixes). - Input: elantench - fix misreporting trackpoint coordinates (bsc#1192918). - kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740). - mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906). - Move upstreamed sound fix into sorted section - net: dsa: felix: re-enable TX flow control in ocelot_port_flush() (git-fixes). - net: mscc: ocelot: fix hardware timestamp dequeue logic. - net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb (git-fixes). - net/smc: Correct smc link connection counter in case of smc client (git-fixes). - net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work (git-fixes). - ocfs2: do not zero pages beyond i_size (bsc#1190795). - ocfs2: fix data corruption on truncate (bsc#1190795). - PCI: aardvark: Do not clear status bits of masked interrupts (git-fixes). - PCI: aardvark: Do not spam about PIO Response Status (git-fixes). - PCI: aardvark: Do not unmask unused interrupts (git-fixes). - PCI: aardvark: Fix checking for link up via LTSSM state (git-fixes). - PCI: aardvark: Fix reporting Data Link Layer Link Active (git-fixes). - PCI: aardvark: Fix return value of MSI domain .alloc() method (git-fixes). - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG (git-fixes). - PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set() (bsc#1169263). - PCI/ACPI: Clarify message about _OSC failure (bsc#1169263). - PCI/ACPI: Move _OSC query checks to separate function (bsc#1169263). - PCI/ACPI: Move supported and control calculations to separate functions (bsc#1169263). - PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS (bsc#1169263). - PCI/ACPI: Remove unnecessary osc_lock (bsc#1169263). - PCI: pci-bridge-emul: Fix emulation of W1C bits (git-fixes). - PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation (git-fixes). - pinctrl: core: fix possible memory leak in pinctrl_enable() (git-fixes). - pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours (bsc#1192217). - pinctrl/rockchip: add a queue for deferred pin output settings on probe (bsc#1192217). - pinctrl/rockchip: add pinctrl device to gpio bank struct (bsc#1192217). - pinctrl: rockchip: add rk3308 SoC support (bsc#1192217). - pinctrl: rockchip: add support for rk3568 (bsc#1192217). - pinctrl/rockchip: always enable clock for gpio controller (bsc#1192217). - pinctrl: rockchip: clear int status when driver probed (bsc#1192217). - pinctrl: rockchip: create irq mapping in gpio_to_irq (bsc#1192217). - pinctrl: rockchip: do coding style for mux route struct (bsc#1192217). - pinctrl/rockchip: drop the gpio related codes (bsc#1192217). - pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq (bsc#1192217). - pinctrl: rockchip: make driver be tristate module (bsc#1192217). - pinctrl: rockchip: Replace HTTP links with HTTPS ones (bsc#1192217). - pinctrl: rockchip: return ENOMEM instead of EINVAL if allocation fails (bsc#1192217). - pinctrl/rockchip: separate struct rockchip_pin_bank to a head file (bsc#1192217). - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error (git-fixes). - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold (git-fixes). - power: supply: max17042_battery: use VFSOC for capacity when no rsns (git-fixes). - power: supply: rt5033-battery: Change voltage values to 5V (git-fixes). - printk/console: Allow to disable console output by using console="" or console=null (bsc#1192753). - printk: handle blank console arguments passed in (bsc#1192753). - qtnfmac: fix potential Spectre vulnerabilities (bsc#1192802). - r8152: add a helper function about setting EEE (git-fixes). - r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2 (git-fixes). - r8152: Disable PLA MCU clock speed down (git-fixes). - r8152: disable U2P3 for RTL8153B (git-fixes). - r8152: divide the tx and rx bottom functions (git-fixes). - r8152: do not enable U1U2 with USB_SPEED_HIGH for RTL8153B (git-fixes). - r8152: fix runtime resume for linking change (git-fixes). - r8152: replace array with linking list for rx information (git-fixes). - r8152: reset flow control patch when linking on for RTL8153B (git-fixes). - r8152: saving the settings of EEE (git-fixes). - r8152: separate the rx buffer size (git-fixes). - r8152: use alloc_pages for rx buffer (git-fixes). - random: fix crash on multiple early calls to add_bootloader_randomness() (bsc#1184924) - Revert "ibmvnic: check failover_pending in login response" (bsc#1190523 ltc#194510). - Revert "platform/x86: i2c-multi-instantiate: Do not create platform device for INT3515 ACPI nodes" (git-fixes). - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" (git-fixes). - Revert "scsi: ufs: fix a missing check of devm_reset_control_get" (git-fixes). - Revert "x86/kvm: fix vcpu-id indexed array sizes" (git-fixes). - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (git-fixes). - s390/dasd: fix use after free in dasd path handling (git-fixes). - s390/pci: fix use after free of zpci_dev (git-fixes). - s390/pci: fix zpci_zdev_put() on reserve (git-fixes). - s390/qeth: fix deadlock during failing recovery (git-fixes). - s390/qeth: Fix deadlock in remove_discipline (git-fixes). - s390/qeth: fix NULL deref in qeth_clear_working_pool_list() (git-fixes). - s390/topology: clear thread/group maps for offline cpus (git-fixes). - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() (git-fixes). - scsi: BusLogic: Fix missing pr_cont() use (git-fixes). - scsi: core: Fix spelling in a source code comment (git-fixes). - scsi: csiostor: Add module softdep on cxgb4 (git-fixes). - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() (git-fixes). - scsi: dc395: Fix error case unwinding (git-fixes). - scsi: fdomain: Fix error return code in fdomain_probe() (git-fixes). - scsi: FlashPoint: Rename si_flags field (git-fixes). - scsi: iscsi: Fix iface sysfs attr detection (git-fixes). - scsi: libsas: Use _safe() loop in sas_resume_port() (git-fixes). - scsi: mpt3sas: Fix error return value in _scsih_expander_add() (git-fixes). - scsi: qedf: Add pointer checks in qedf_update_link_speed() (git-fixes). - scsi: qedf: Fix error codes in qedf_alloc_global_queues() (git-fixes). - scsi: qedi: Fix error codes in qedi_alloc_global_queues() (git-fixes). - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() (git-fixes). - scsi: qla2xxx: Make sure that aborted commands are freed (git-fixes). - scsi: smartpqi: Fix an error code in pqi_get_raid_map() (git-fixes). - scsi: snic: Fix an error message (git-fixes). - scsi: ufs-pci: Add quirk for broken auto-hibernate for Intel EHL (git-fixes). - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer (git-fixes). - serial: 8250_dw: Drop wrong use of ACPI_PTR() (git-fixes). - serial: xilinx_uartps: Fix race condition causing stuck TX (git-fixes). - staging: r8712u: fix control-message timeout (git-fixes). - staging: rtl8192u: fix control-message timeouts (git-fixes). - stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() (git-fixes). - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together (bsc#1192745). - Update config files: Add CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set - Update config files: pull BPF configs together - usb: gadget: hid: fix error code in do_config() (git-fixes). - USB: iowarrior: fix control-message timeouts (git-fixes). - usb: max-3421: Use driver data instead of maintaining a list of bound devices (git-fixes). - usb: musb: Balance list entry in musb_gadget_queue (git-fixes). - USB: serial: keyspan: fix memleak on probe errors (git-fixes). - video: fbdev: chipsfb: use memset_io() instead of memset() (git-fixes). - x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c (bsc#1152489). - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (git-fixes). - xen-pciback: Fix return in pm_ctrl_init() (git-fixes). - xen: Fix implicit type conversion (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3941=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-5.3.18-59.37.2 cluster-md-kmp-default-debuginfo-5.3.18-59.37.2 dlm-kmp-default-5.3.18-59.37.2 dlm-kmp-default-debuginfo-5.3.18-59.37.2 gfs2-kmp-default-5.3.18-59.37.2 gfs2-kmp-default-debuginfo-5.3.18-59.37.2 kernel-default-5.3.18-59.37.2 kernel-default-base-5.3.18-59.37.2.18.23.3 kernel-default-base-rebuild-5.3.18-59.37.2.18.23.3 kernel-default-debuginfo-5.3.18-59.37.2 kernel-default-debugsource-5.3.18-59.37.2 kernel-default-devel-5.3.18-59.37.2 kernel-default-devel-debuginfo-5.3.18-59.37.2 kernel-default-extra-5.3.18-59.37.2 kernel-default-extra-debuginfo-5.3.18-59.37.2 kernel-default-livepatch-5.3.18-59.37.2 kernel-default-livepatch-devel-5.3.18-59.37.2 kernel-default-optional-5.3.18-59.37.2 kernel-default-optional-debuginfo-5.3.18-59.37.2 kernel-obs-build-5.3.18-59.37.3 kernel-obs-build-debugsource-5.3.18-59.37.3 kernel-obs-qa-5.3.18-59.37.1 kernel-syms-5.3.18-59.37.1 kselftests-kmp-default-5.3.18-59.37.2 kselftests-kmp-default-debuginfo-5.3.18-59.37.2 ocfs2-kmp-default-5.3.18-59.37.2 ocfs2-kmp-default-debuginfo-5.3.18-59.37.2 reiserfs-kmp-default-5.3.18-59.37.2 reiserfs-kmp-default-debuginfo-5.3.18-59.37.2 - openSUSE Leap 15.3 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-59.37.2 cluster-md-kmp-preempt-debuginfo-5.3.18-59.37.2 dlm-kmp-preempt-5.3.18-59.37.2 dlm-kmp-preempt-debuginfo-5.3.18-59.37.2 gfs2-kmp-preempt-5.3.18-59.37.2 gfs2-kmp-preempt-debuginfo-5.3.18-59.37.2 kernel-preempt-5.3.18-59.37.2 kernel-preempt-debuginfo-5.3.18-59.37.2 kernel-preempt-debugsource-5.3.18-59.37.2 kernel-preempt-devel-5.3.18-59.37.2 kernel-preempt-devel-debuginfo-5.3.18-59.37.2 kernel-preempt-extra-5.3.18-59.37.2 kernel-preempt-extra-debuginfo-5.3.18-59.37.2 kernel-preempt-livepatch-devel-5.3.18-59.37.2 kernel-preempt-optional-5.3.18-59.37.2 kernel-preempt-optional-debuginfo-5.3.18-59.37.2 kselftests-kmp-preempt-5.3.18-59.37.2 kselftests-kmp-preempt-debuginfo-5.3.18-59.37.2 ocfs2-kmp-preempt-5.3.18-59.37.2 ocfs2-kmp-preempt-debuginfo-5.3.18-59.37.2 reiserfs-kmp-preempt-5.3.18-59.37.2 reiserfs-kmp-preempt-debuginfo-5.3.18-59.37.2 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-5.3.18-59.37.2 kernel-debug-debuginfo-5.3.18-59.37.2 kernel-debug-debugsource-5.3.18-59.37.2 kernel-debug-devel-5.3.18-59.37.2 kernel-debug-devel-debuginfo-5.3.18-59.37.2 kernel-debug-livepatch-devel-5.3.18-59.37.2 kernel-kvmsmall-5.3.18-59.37.2 kernel-kvmsmall-debuginfo-5.3.18-59.37.2 kernel-kvmsmall-debugsource-5.3.18-59.37.2 kernel-kvmsmall-devel-5.3.18-59.37.2 kernel-kvmsmall-devel-debuginfo-5.3.18-59.37.2 kernel-kvmsmall-livepatch-devel-5.3.18-59.37.2 - openSUSE Leap 15.3 (aarch64): cluster-md-kmp-64kb-5.3.18-59.37.2 cluster-md-kmp-64kb-debuginfo-5.3.18-59.37.2 dlm-kmp-64kb-5.3.18-59.37.2 dlm-kmp-64kb-debuginfo-5.3.18-59.37.2 dtb-al-5.3.18-59.37.1 dtb-allwinner-5.3.18-59.37.1 dtb-altera-5.3.18-59.37.1 dtb-amd-5.3.18-59.37.1 dtb-amlogic-5.3.18-59.37.1 dtb-apm-5.3.18-59.37.1 dtb-arm-5.3.18-59.37.1 dtb-broadcom-5.3.18-59.37.1 dtb-cavium-5.3.18-59.37.1 dtb-exynos-5.3.18-59.37.1 dtb-freescale-5.3.18-59.37.1 dtb-hisilicon-5.3.18-59.37.1 dtb-lg-5.3.18-59.37.1 dtb-marvell-5.3.18-59.37.1 dtb-mediatek-5.3.18-59.37.1 dtb-nvidia-5.3.18-59.37.1 dtb-qcom-5.3.18-59.37.1 dtb-renesas-5.3.18-59.37.1 dtb-rockchip-5.3.18-59.37.1 dtb-socionext-5.3.18-59.37.1 dtb-sprd-5.3.18-59.37.1 dtb-xilinx-5.3.18-59.37.1 dtb-zte-5.3.18-59.37.1 gfs2-kmp-64kb-5.3.18-59.37.2 gfs2-kmp-64kb-debuginfo-5.3.18-59.37.2 kernel-64kb-5.3.18-59.37.2 kernel-64kb-debuginfo-5.3.18-59.37.2 kernel-64kb-debugsource-5.3.18-59.37.2 kernel-64kb-devel-5.3.18-59.37.2 kernel-64kb-devel-debuginfo-5.3.18-59.37.2 kernel-64kb-extra-5.3.18-59.37.2 kernel-64kb-extra-debuginfo-5.3.18-59.37.2 kernel-64kb-livepatch-devel-5.3.18-59.37.2 kernel-64kb-optional-5.3.18-59.37.2 kernel-64kb-optional-debuginfo-5.3.18-59.37.2 kselftests-kmp-64kb-5.3.18-59.37.2 kselftests-kmp-64kb-debuginfo-5.3.18-59.37.2 ocfs2-kmp-64kb-5.3.18-59.37.2 ocfs2-kmp-64kb-debuginfo-5.3.18-59.37.2 reiserfs-kmp-64kb-5.3.18-59.37.2 reiserfs-kmp-64kb-debuginfo-5.3.18-59.37.2 - openSUSE Leap 15.3 (noarch): kernel-devel-5.3.18-59.37.2 kernel-docs-5.3.18-59.37.2 kernel-docs-html-5.3.18-59.37.2 kernel-macros-5.3.18-59.37.2 kernel-source-5.3.18-59.37.2 kernel-source-vanilla-5.3.18-59.37.2 - openSUSE Leap 15.3 (s390x): kernel-zfcpdump-5.3.18-59.37.2 kernel-zfcpdump-debuginfo-5.3.18-59.37.2 kernel-zfcpdump-debugsource-5.3.18-59.37.2 References: https://www.suse.com/security/cve/CVE-2021-0941.html https://www.suse.com/security/cve/CVE-2021-20322.html https://www.suse.com/security/cve/CVE-2021-31916.html https://www.suse.com/security/cve/CVE-2021-34981.html https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1169263 https://bugzilla.suse.com/1170269 https://bugzilla.suse.com/1184924 https://bugzilla.suse.com/1190523 https://bugzilla.suse.com/1190795 https://bugzilla.suse.com/1191790 https://bugzilla.suse.com/1191961 https://bugzilla.suse.com/1192045 https://bugzilla.suse.com/1192217 https://bugzilla.suse.com/1192273 https://bugzilla.suse.com/1192328 https://bugzilla.suse.com/1192375 https://bugzilla.suse.com/1192473 https://bugzilla.suse.com/1192718 https://bugzilla.suse.com/1192740 https://bugzilla.suse.com/1192745 https://bugzilla.suse.com/1192750 https://bugzilla.suse.com/1192753 https://bugzilla.suse.com/1192758 https://bugzilla.suse.com/1192781 https://bugzilla.suse.com/1192802 https://bugzilla.suse.com/1192896 https://bugzilla.suse.com/1192906 https://bugzilla.suse.com/1192918

1 0

openSUSE-SU-2021:1536-1: moderate: Security update for hiredis
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for hiredis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1536-1 Rating: moderate References: #1191331 Cross-References: CVE-2021-32765 CVSS scores: CVE-2021-32765 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiredis fixes the following issues: - CVE-2021-32765: Fix integer/buffer (boo#1191331) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1536=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1536=1 Package List: - openSUSE Leap 15.2 (x86_64): hiredis-0.13.3-lp152.4.3.1 hiredis-debuginfo-0.13.3-lp152.4.3.1 hiredis-debugsource-0.13.3-lp152.4.3.1 hiredis-devel-0.13.3-lp152.4.3.1 libhiredis0_13-0.13.3-lp152.4.3.1 libhiredis0_13-debuginfo-0.13.3-lp152.4.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): hiredis-0.13.3-bp153.2.3.1 hiredis-devel-0.13.3-bp153.2.3.1 libhiredis0_13-0.13.3-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-32765.html https://bugzilla.suse.com/1191331

1 0

openSUSE-SU-2021:3934-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3934-1 Rating: important References: #1193170 Cross-References: CVE-2021-43527 CVSS scores: CVE-2021-43527 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mozilla-nss fixes the following issues: Update to version 3.68.1: - CVE-2021-43527: Fixed a Heap overflow in NSS when verifying DER-encoded DSA or RSA-PSS signatures (bsc#1193170). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3934=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libfreebl3-3.68.1-3.61.1 libfreebl3-debuginfo-3.68.1-3.61.1 libfreebl3-hmac-3.68.1-3.61.1 libsoftokn3-3.68.1-3.61.1 libsoftokn3-debuginfo-3.68.1-3.61.1 libsoftokn3-hmac-3.68.1-3.61.1 mozilla-nss-3.68.1-3.61.1 mozilla-nss-certs-3.68.1-3.61.1 mozilla-nss-certs-debuginfo-3.68.1-3.61.1 mozilla-nss-debuginfo-3.68.1-3.61.1 mozilla-nss-debugsource-3.68.1-3.61.1 mozilla-nss-devel-3.68.1-3.61.1 mozilla-nss-sysinit-3.68.1-3.61.1 mozilla-nss-sysinit-debuginfo-3.68.1-3.61.1 mozilla-nss-tools-3.68.1-3.61.1 mozilla-nss-tools-debuginfo-3.68.1-3.61.1 - openSUSE Leap 15.3 (x86_64): libfreebl3-32bit-3.68.1-3.61.1 libfreebl3-32bit-debuginfo-3.68.1-3.61.1 libfreebl3-hmac-32bit-3.68.1-3.61.1 libsoftokn3-32bit-3.68.1-3.61.1 libsoftokn3-32bit-debuginfo-3.68.1-3.61.1 libsoftokn3-hmac-32bit-3.68.1-3.61.1 mozilla-nss-32bit-3.68.1-3.61.1 mozilla-nss-32bit-debuginfo-3.68.1-3.61.1 mozilla-nss-certs-32bit-3.68.1-3.61.1 mozilla-nss-certs-32bit-debuginfo-3.68.1-3.61.1 mozilla-nss-sysinit-32bit-3.68.1-3.61.1 mozilla-nss-sysinit-32bit-debuginfo-3.68.1-3.61.1 References: https://www.suse.com/security/cve/CVE-2021-43527.html https://bugzilla.suse.com/1193170

1 0

openSUSE-SU-2021:3950-1: important: Security update for openssh
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3950-1 Rating: important References: #1190975 Cross-References: CVE-2021-41617 CVSS scores: CVE-2021-41617 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-41617 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssh fixes the following issues: - CVE-2021-41617: Fixed privilege escalation when AuthorizedKeysCommand/AuthorizedPrincipalsCommand are configured (bsc#1190975). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3950=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openssh-8.4p1-3.6.1 openssh-askpass-gnome-8.4p1-3.6.1 openssh-askpass-gnome-debuginfo-8.4p1-3.6.1 openssh-askpass-gnome-debugsource-8.4p1-3.6.1 openssh-cavs-8.4p1-3.6.1 openssh-cavs-debuginfo-8.4p1-3.6.1 openssh-clients-8.4p1-3.6.1 openssh-clients-debuginfo-8.4p1-3.6.1 openssh-common-8.4p1-3.6.1 openssh-common-debuginfo-8.4p1-3.6.1 openssh-debuginfo-8.4p1-3.6.1 openssh-debugsource-8.4p1-3.6.1 openssh-fips-8.4p1-3.6.1 openssh-helpers-8.4p1-3.6.1 openssh-helpers-debuginfo-8.4p1-3.6.1 openssh-server-8.4p1-3.6.1 openssh-server-debuginfo-8.4p1-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-41617.html https://bugzilla.suse.com/1190975

1 0

openSUSE-SU-2021:1538-1: moderate: Security update for speex
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for speex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1538-1 Rating: moderate References: #1192580 Cross-References: CVE-2020-23903 CVSS scores: CVE-2020-23903 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for speex fixes the following issues: - CVE-2020-23903: Fixed zero division error in read_samples (bsc#1192580). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1538=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libspeex1-1.2-lp152.4.3.1 libspeex1-debuginfo-1.2-lp152.4.3.1 speex-1.2-lp152.4.3.1 speex-debuginfo-1.2-lp152.4.3.1 speex-debugsource-1.2-lp152.4.3.1 speex-devel-1.2-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libspeex1-32bit-1.2-lp152.4.3.1 libspeex1-32bit-debuginfo-1.2-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-23903.html https://bugzilla.suse.com/1192580

1 0

openSUSE-SU-2021:3943-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3943-1 Rating: moderate References: #1175508 #1192050 #1193041 Cross-References: CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3943=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.29.1 apache2-mod_php7-debuginfo-7.4.6-3.29.1 php7-7.4.6-3.29.1 php7-bcmath-7.4.6-3.29.1 php7-bcmath-debuginfo-7.4.6-3.29.1 php7-bz2-7.4.6-3.29.1 php7-bz2-debuginfo-7.4.6-3.29.1 php7-calendar-7.4.6-3.29.1 php7-calendar-debuginfo-7.4.6-3.29.1 php7-ctype-7.4.6-3.29.1 php7-ctype-debuginfo-7.4.6-3.29.1 php7-curl-7.4.6-3.29.1 php7-curl-debuginfo-7.4.6-3.29.1 php7-dba-7.4.6-3.29.1 php7-dba-debuginfo-7.4.6-3.29.1 php7-debuginfo-7.4.6-3.29.1 php7-debugsource-7.4.6-3.29.1 php7-devel-7.4.6-3.29.1 php7-dom-7.4.6-3.29.1 php7-dom-debuginfo-7.4.6-3.29.1 php7-embed-7.4.6-3.29.1 php7-embed-debuginfo-7.4.6-3.29.1 php7-enchant-7.4.6-3.29.1 php7-enchant-debuginfo-7.4.6-3.29.1 php7-exif-7.4.6-3.29.1 php7-exif-debuginfo-7.4.6-3.29.1 php7-fastcgi-7.4.6-3.29.1 php7-fastcgi-debuginfo-7.4.6-3.29.1 php7-fileinfo-7.4.6-3.29.1 php7-fileinfo-debuginfo-7.4.6-3.29.1 php7-firebird-7.4.6-3.29.1 php7-firebird-debuginfo-7.4.6-3.29.1 php7-fpm-7.4.6-3.29.1 php7-fpm-debuginfo-7.4.6-3.29.1 php7-ftp-7.4.6-3.29.1 php7-ftp-debuginfo-7.4.6-3.29.1 php7-gd-7.4.6-3.29.1 php7-gd-debuginfo-7.4.6-3.29.1 php7-gettext-7.4.6-3.29.1 php7-gettext-debuginfo-7.4.6-3.29.1 php7-gmp-7.4.6-3.29.1 php7-gmp-debuginfo-7.4.6-3.29.1 php7-iconv-7.4.6-3.29.1 php7-iconv-debuginfo-7.4.6-3.29.1 php7-intl-7.4.6-3.29.1 php7-intl-debuginfo-7.4.6-3.29.1 php7-json-7.4.6-3.29.1 php7-json-debuginfo-7.4.6-3.29.1 php7-ldap-7.4.6-3.29.1 php7-ldap-debuginfo-7.4.6-3.29.1 php7-mbstring-7.4.6-3.29.1 php7-mbstring-debuginfo-7.4.6-3.29.1 php7-mysql-7.4.6-3.29.1 php7-mysql-debuginfo-7.4.6-3.29.1 php7-odbc-7.4.6-3.29.1 php7-odbc-debuginfo-7.4.6-3.29.1 php7-opcache-7.4.6-3.29.1 php7-opcache-debuginfo-7.4.6-3.29.1 php7-openssl-7.4.6-3.29.1 php7-openssl-debuginfo-7.4.6-3.29.1 php7-pcntl-7.4.6-3.29.1 php7-pcntl-debuginfo-7.4.6-3.29.1 php7-pdo-7.4.6-3.29.1 php7-pdo-debuginfo-7.4.6-3.29.1 php7-pgsql-7.4.6-3.29.1 php7-pgsql-debuginfo-7.4.6-3.29.1 php7-phar-7.4.6-3.29.1 php7-phar-debuginfo-7.4.6-3.29.1 php7-posix-7.4.6-3.29.1 php7-posix-debuginfo-7.4.6-3.29.1 php7-readline-7.4.6-3.29.1 php7-readline-debuginfo-7.4.6-3.29.1 php7-shmop-7.4.6-3.29.1 php7-shmop-debuginfo-7.4.6-3.29.1 php7-snmp-7.4.6-3.29.1 php7-snmp-debuginfo-7.4.6-3.29.1 php7-soap-7.4.6-3.29.1 php7-soap-debuginfo-7.4.6-3.29.1 php7-sockets-7.4.6-3.29.1 php7-sockets-debuginfo-7.4.6-3.29.1 php7-sodium-7.4.6-3.29.1 php7-sodium-debuginfo-7.4.6-3.29.1 php7-sqlite-7.4.6-3.29.1 php7-sqlite-debuginfo-7.4.6-3.29.1 php7-sysvmsg-7.4.6-3.29.1 php7-sysvmsg-debuginfo-7.4.6-3.29.1 php7-sysvsem-7.4.6-3.29.1 php7-sysvsem-debuginfo-7.4.6-3.29.1 php7-sysvshm-7.4.6-3.29.1 php7-sysvshm-debuginfo-7.4.6-3.29.1 php7-test-7.4.6-3.29.1 php7-tidy-7.4.6-3.29.1 php7-tidy-debuginfo-7.4.6-3.29.1 php7-tokenizer-7.4.6-3.29.1 php7-tokenizer-debuginfo-7.4.6-3.29.1 php7-xmlreader-7.4.6-3.29.1 php7-xmlreader-debuginfo-7.4.6-3.29.1 php7-xmlrpc-7.4.6-3.29.1 php7-xmlrpc-debuginfo-7.4.6-3.29.1 php7-xmlwriter-7.4.6-3.29.1 php7-xmlwriter-debuginfo-7.4.6-3.29.1 php7-xsl-7.4.6-3.29.1 php7-xsl-debuginfo-7.4.6-3.29.1 php7-zip-7.4.6-3.29.1 php7-zip-debuginfo-7.4.6-3.29.1 php7-zlib-7.4.6-3.29.1 php7-zlib-debuginfo-7.4.6-3.29.1 References: https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1175508 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041

1 0

openSUSE-SU-2021:3949-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3949-1 Rating: moderate References: #1188284 #1192346 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav fixes the following issues: - Update to 0.103.4 (bsc#1192346). - Update to 0.103.3 (bsc#1188284). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3949=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): clamav-0.103.4-3.32.1 clamav-debuginfo-0.103.4-3.32.1 clamav-debugsource-0.103.4-3.32.1 clamav-devel-0.103.4-3.32.1 libclamav9-0.103.4-3.32.1 libclamav9-debuginfo-0.103.4-3.32.1 libfreshclam2-0.103.4-3.32.1 libfreshclam2-debuginfo-0.103.4-3.32.1 References: https://bugzilla.suse.com/1188284 https://bugzilla.suse.com/1192346

1 0

openSUSE-SU-2021:3938-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3938-1 Rating: moderate References: #1192830 Cross-References: CVE-2021-39920 CVE-2021-39921 CVE-2021-39922 CVE-2021-39924 CVE-2021-39925 CVE-2021-39926 CVE-2021-39928 CVE-2021-39929 CVSS scores: CVE-2021-39920 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39921 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39922 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39924 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39924 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39925 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39926 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39926 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39928 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39929 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Update to Wireshark 3.4.10: - CVE-2021-39920: IPPUSB dissector crash (bsc#1192830). - CVE-2021-39921: Modbus dissector crash (bsc#1192830). - CVE-2021-39922: C12.22 dissector crash (bsc#1192830). - CVE-2021-39924: Bluetooth DHT dissector large loop (bsc#1192830). - CVE-2021-39925: Bluetooth SDP dissector crash (bsc#1192830). - CVE-2021-39926: Bluetooth HCI_ISO dissector crash (bsc#1192830). - CVE-2021-39928: IEEE 802.11 dissector crash (bsc#1192830). - CVE-2021-39929: Bluetooth DHT dissector crash (bsc#1192830). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3938=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwireshark14-3.4.10-3.62.1 libwireshark14-debuginfo-3.4.10-3.62.1 libwiretap11-3.4.10-3.62.1 libwiretap11-debuginfo-3.4.10-3.62.1 libwsutil12-3.4.10-3.62.1 libwsutil12-debuginfo-3.4.10-3.62.1 wireshark-3.4.10-3.62.1 wireshark-debuginfo-3.4.10-3.62.1 wireshark-debugsource-3.4.10-3.62.1 wireshark-devel-3.4.10-3.62.1 wireshark-ui-qt-3.4.10-3.62.1 wireshark-ui-qt-debuginfo-3.4.10-3.62.1 References: https://www.suse.com/security/cve/CVE-2021-39920.html https://www.suse.com/security/cve/CVE-2021-39921.html https://www.suse.com/security/cve/CVE-2021-39922.html https://www.suse.com/security/cve/CVE-2021-39924.html https://www.suse.com/security/cve/CVE-2021-39925.html https://www.suse.com/security/cve/CVE-2021-39926.html https://www.suse.com/security/cve/CVE-2021-39928.html https://www.suse.com/security/cve/CVE-2021-39929.html https://bugzilla.suse.com/1192830

1 0

openSUSE-SU-2021:1537-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1537-1 Rating: moderate References: #1192498 #1192556 Cross-References: CVE-2021-3933 CVE-2021-3941 CVSS scores: CVE-2021-3933 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3941 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2021-3941: Fixed divide-by-zero in Imf_3_1:RGBtoXYZ (bsc#1192556). - CVE-2021-3933: Fixed integer-overflow in Imf_3_1:bytesPerDeepLineTable (bsc#1192498). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1537=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.23.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.23.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.23.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.23.1 openexr-2.2.1-lp152.7.23.1 openexr-debuginfo-2.2.1-lp152.7.23.1 openexr-debugsource-2.2.1-lp152.7.23.1 openexr-devel-2.2.1-lp152.7.23.1 openexr-doc-2.2.1-lp152.7.23.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.23.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.23.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.23.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.23.1 References: https://www.suse.com/security/cve/CVE-2021-3933.html https://www.suse.com/security/cve/CVE-2021-3941.html https://bugzilla.suse.com/1192498 https://bugzilla.suse.com/1192556

1 0

openSUSE-SU-2021:3945-1: important: Security update for python-Babel
by opensuse-security＠opensuse.org 06 Dec '21

06 Dec '21

openSUSE Security Update: Security update for python-Babel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3945-1 Rating: important References: #1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution (bsc#1185768). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3945=1 Package List: - openSUSE Leap 15.3 (noarch): python-Babel-doc-2.8.0-3.3.1 python2-Babel-2.8.0-3.3.1 python3-Babel-2.8.0-3.3.1 python3-Babel-doc-2.8.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-42771.html https://bugzilla.suse.com/1185768

1 0

openSUSE-SU-2021:1525-1: moderate: Security update for singularity
by opensuse-security＠opensuse.org 04 Dec '21

04 Dec '21

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1525-1 Rating: moderate References: #1193273 Cross-References: CVE-2021-41190 CVSS scores: CVE-2021-41190 (NVD) : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity fixes the following issues: Update to 3.8.5: - CVE-2021-41190: Fixed OCI manifest and index parsing confusion (boo#1193273). - Building Singularity from source requires go greater or equal 1.16. We now aim to support the two most recent stable versions of Go. This corresponds to the Go Release Maintenance Policy - Sourcing a script based on PATH is now permitted, fixing a regression introduced in 3.6.0. - Environment variables in container definition files are properly scoped, fixing a regression introduced in 3.8.0. - Fix the oras contexts to avoid hangs upon failed pushes to Harbor registry. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1525=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 s390x x86_64): singularity-3.8.5-bp153.2.10.1 References: https://www.suse.com/security/cve/CVE-2021-41190.html https://bugzilla.suse.com/1193273

1 0

openSUSE-SU-2021:1524-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 03 Dec '21

03 Dec '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1524-1 Rating: moderate References: #1192658 Cross-References: CVE-2021-22929 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: tor 0.4.6.8: * Improving reporting of general overload state for DNS timeout errors by relays * Regenerate fallback directories for October 2021 * Bug fixes for onion services * CVE-2021-22929: do not log v2 onion services access attempt warnings on disk excessively (TROVE-2021-008, boo#1192658) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1524=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): tor-0.4.6.8-bp152.2.18.1 References: https://www.suse.com/security/cve/CVE-2021-22929.html https://bugzilla.suse.com/1192658

1 0

openSUSE-SU-2021:1521-1: important: Security update for python-Pygments
by opensuse-security＠opensuse.org 03 Dec '21

03 Dec '21

openSUSE Security Update: Security update for python-Pygments ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1521-1 Rating: important References: #1184812 Cross-References: CVE-2021-27291 CVSS scores: CVE-2021-27291 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27291 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Pygments fixes the following issues: - CVE-2021-27291: Fixed ReDoS via crafted malicious input (bsc#1184812). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1521=1 Package List: - openSUSE Leap 15.2 (noarch): python3-Pygments-2.6.1-lp152.5.12.1 References: https://www.suse.com/security/cve/CVE-2021-27291.html https://bugzilla.suse.com/1184812

1 0

openSUSE-SU-2021:3899-1: moderate: Security update for aaa_base
by opensuse-security＠opensuse.org 03 Dec '21

03 Dec '21

openSUSE Security Update: Security update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3899-1 Rating: moderate References: #1162581 #1174504 #1191563 #1192248 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for aaa_base fixes the following issues: - Allowed ping and ICMP commands without CAP_NET_RAW (bsc#1174504). - Add $HOME/.local/bin to PATH, if it exists (bsc#1192248). - Fixed get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563). - Support xz compressed kernel (bsc#1162581) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3899=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aaa_base-84.87+git20180409.04c9dae-3.52.1 aaa_base-debuginfo-84.87+git20180409.04c9dae-3.52.1 aaa_base-debugsource-84.87+git20180409.04c9dae-3.52.1 aaa_base-extras-84.87+git20180409.04c9dae-3.52.1 aaa_base-malloccheck-84.87+git20180409.04c9dae-3.52.1 aaa_base-wsl-84.87+git20180409.04c9dae-3.52.1 References: https://bugzilla.suse.com/1162581 https://bugzilla.suse.com/1174504 https://bugzilla.suse.com/1191563 https://bugzilla.suse.com/1192248

1 0

openSUSE-SU-2021:1520-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 02 Dec '21

02 Dec '21

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1520-1 Rating: moderate References: #1028975 #1029961 #1093414 #1133678 #1148788 #1150345 #1150366 #1151190 #1157498 #1160285 #1160764 #1161335 #1161779 #1163588 #1167163 #1169614 #1171164 #1171173 #1171569 #1171580 #1171686 #1171879 #1171882 #1173221 #1174504 #1175720 #1175867 #1178475 #1178476 #1183669 Cross-References: CVE-2019-3687 CVE-2019-3688 CVE-2020-8013 CVSS scores: CVE-2019-3687 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2019-3687 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2019-3688 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2019-3688 (SUSE): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2020-8013 (NVD) : 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2020-8013 (SUSE): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 27 fixes is now available. Description: This update for permissions fixes the following issues: Update to version 20200127: * Makefile: Leap 15.3 still uses /etc, so adjust the installation setup Update to version 20181225: * mgetty: faxq-helper now finally reside in /usr/libexec * libksysguard5: Updated path for ksgrd_network_helper * kdesu: Updated path for kdesud * sbin_dirs cleanup: these binaries have already been moved to /usr/sbin * mariadb: revert auth_pam_tool to /usr/lib{,64} again * cleanup: revert virtualbox back to plain /usr/lib * cleanup: remove deprecated /etc/ssh/sshd_config * hawk_invoke is not part of newer hawk2 packages anymore * cleanup: texlive-filesystem: public now resides in libexec * cleanup: authbind: helper now resides in libexec * cleanup: polkit: the agent now also resides in libexec * libexec cleanup: 'inn' news binaries now reside in libexec * whitelist please (boo#1183669) * Fix enlightenment paths * usbauth: drop compatibility variable for libexec * usbauth: Updated path for usbauth-npriv * profiles: finish usage of variable for polkit-agent-helper-1 * Makefile: fix custom flags support when using make command line variables * added information about know limitations of this approach * Makefile: compile with LFO support to fix 32-bit emulation on 64-bit hosts (boo#1178476) * Makefile: support CXXFLAGS and LDFLAGS override / extension via make/env variables (boo#1178475) * profiles: prepare /usr/sbin versions of profile entries (boo#1029961) * profiles: use new variables feature to remove redundant entries * profiles: remove now superfluous squid pinger paths (boo#1171569) * tests: implement basic tests for new the new variable feature * tests: avoid redundant specification of test names by using class names * regtests: split up base types and actual test implementation * man pages: add documentation about variables, update copyrights * chkstat: implement support for variables in profile paths * chkstat: prepare reuse of config file locations * chkstat: fix some typos and whitespace * etc/permissions: remove unnecessary, duplicate, outdated entries * etc/permissions: remove trailing whitespace * ksgrd_network_helper: remove obviously wrong path * adjust squid pinger path (boo#1171569) * mgetty: remove long dead (or never existing) locks directory (boo#1171882) * squid: remove basic_pam_auth which doesn't need special perms (boo#1171569) * cleanup now useless /usr/lib entries after move to /usr/libexec (boo#1171164) * drop (f)ping capabilities in favor of ICMP_PROTO sockets (boo#1174504) * whitelist Xorg setuid-root wrapper (boo#1175867) * screen: remove /run/uscreens covered by systemd-tmpfiles (boo#1171879) * Add /usr/libexec for cockpit-session as new path * physlock: whitelist with tight restrictions (boo#1175720) * mtr-packet: stop requiring dialout group * etc/permissions: fix mtr permission * list_permissions: improve output format * list_permissions: support globbing in --path argument * list_permissions: implement simplifications suggested in PR#92 * list_permissions: new tool for better path configuration overview * regtest: support new getcap output format in libcap-2.42 * regtest: print individual test case errors to stderr * etc/permissions: remove static /var/spool/* dirs * etc/permissions: remove outdated entries * etc/permissions: remove unnecessary static dirs and devices * screen: remove now unused /var/run/uscreens * Revert "etc/permissions: remove entries for bind-chrootenv" * rework permissions.local text (boo#1173221) * dbus-1: adjust to new libexec dir location (boo#1171164) * permission profiles: reinstate kdesud for kde5 * etc/permissions: remove entries for bind-chrootenv * etc/permissions: remove traceroute entry * VirtualBox: remove outdated entry which is only a symlink any more * /bin/su: remove path refering to symlink * etc/permissions: remove legacy RPM directory entries * /etc/permissions: remove outdated sudo directories * singularity: remove outdated setuid-binary entries * chromium: remove now unneeded chrome_sandbox entry (boo#1163588) * dbus-1: remove deprecated alternative paths * PolicyKit: remove outdated entries last used in SLE-11 * pcp: remove no longer needed / conflicting entries * gnats: remove entries for package removed from Factory * kdelibs4: remove entries for package removed from Factory * v4l-base: remove entries for package removed from Factory * mailman: remove entries for package deleted from Factory * gnome-pty-helper: remove dead entry no longer part of the vte package * gnokii: remove entries for package no longer in Factory * xawtv (v4l-conf): correct group ownership in easy profile * systemd-journal: remove unnecessary profile entries * thttp: make makeweb entry usable in the secure profile (boo#1171580) * profiles: add entries for enlightenment (boo#1171686) * permissions fixed profile: utempter: reinstate libexec compatibility entry * chkstat: fix sign conversion warnings on non 32-bit architectures * chkstat: allow simultaneous use of `--set` and `--system` * regtest: adjust TestUnkownOwnership test to new warning output behaviour * whitelist texlive public binary (boo#1171686) * fixed permissions: adjust to new libexec dir location (boo#1171164) * chkstat: don't print warning about unknown user/group by default * Makefile: link with --as-needed, move libs to the end of the command line * setuid bit for cockpit (boo#1169614) * Fix paranoid mode for newgidmap and newuidmap (boo#1171173) * chkstat: collectProfilePaths(): use directory_iterator to simplify code * chkstat: collectProfilePaths(): prefer /usr over /etc * regtest: add relative symlink corner case to TestSymlinkBehaviour * Chkstat::parseProfile(): avoid use of raw pointer * parseSysconfig(): only emmit warning if value is non-empty * incorporate a bunch of PR #56 review comments * regtest: add test for correct ownership change * chkstat: final pass over refactored code * chkstat: finish refactoring of safeOpen() * chkstat: improve/fix output of mismatches * chkstat: support numerical owner/group specification in profiles * chkstat: safeOpen: simplify path handling by using a std::string * chkstat regtest: support debug build * chkstat: start refactoring of safe_open() -> safeOpen() * chkstat: processEntries: pull out change logic into applyChanges() * chkstat: processEntries: pull out safety check logic * chkstat: processEntries: separate printing code and simplify ownership flags * chkstat: processEntries: also add file_status and *_ok flags to EntryContext * chkstat: processEntries: also add caps to EntryContext * chkstat: also move fd_path into EntryContext * chkstat: processEntries(): introduce EntryContext data structure * chkstat: introduce class type to deal with capabilities * chkstat: overhaul of the main entry processing loop * chkstat: smaller cleanup of Chkstat::run() * chkstat: remove last global variables `root` and `rootl` * chkstat: refactor parsing of permission profiles * chkstat: replace global `permlist` by STL map * chkstat: remove now obsolete usage() function * chkstat: refactor collection of permission files * regtest: support --after-test-enter-shell * chkstat: change global euid variable into const class member * chkstat: replace global level, nlevel by a vector data structure * chkstat: refactor check_fscaps_enabled() * chkstat: refactor parse_sysconfig as a member function Chkstat::parseSysconfig * chkstat: introduce separate processArguments() and refactor --files logic * chkstat: replace C style chkecklist by std::set * chkstat: refactor command line parsing * allow /usr/libexec in addition to /usr/lib (boo#1171164) * whitelist s390-tools setgid bit on log directory (boo#1167163) * whitelist WMP (boo#1161335) * regtest: improve readability of path variables by using literals * regtest: adjust test suite to new path locations in /usr/share/permissions * regtest: only catch explicit FileNotFoundError * regtest: provide valid home directory in /root * regtest: mount permissions src repository in /usr/src/permissions * regtest: move initialialization of TestBase paths into the prepare() function * chkstat: suppport new --config-root command line option * fix spelling of icingacmd group * chkstat: fix readline() on platforms with unsigned char * remove capability whitelisting for radosgw * whitelist ceph log directory (boo#1150366) * adjust testsuite to post CVE-2020-8013 link handling * testsuite: add option to not mount /proc * do not follow symlinks that are the final path element: CVE-2020-8013 * add a test for symlinked directories * fix relative symlink handling * include cpp compat headers, not C headers * Move permissions and permissions.* except .local to /usr/share/permissions * regtest: fix the static PATH list which was missing /usr/bin * regtest: also unshare the PID namespace to support /proc mounting * regtest: bindMount(): explicitly reject read-only recursive mounts * Makefile: force remove upon clean target to prevent bogus errors * regtest: by default automatically (re)build chkstat before testing * regtest: add test for symlink targets * regtest: make capability setting tests optional * regtest: fix capability assertion helper logic * regtests: add another test case that catches set*id or caps in world-writable sub-trees * regtest: add another test that catches when privilege bits are set for special files * regtest: add test case for user owned symlinks * regtest: employ subuid and subgid feature in user namespace * regtest: add another test case that covers unknown user/group config * regtest: add another test that checks rejection of insecure mixed-owner paths * regtest: add test that checks for rejection of world-writable paths * regtest: add test for detection of unexpected parent directory ownership * regtest: add further helper functions, allow access to main instance * regtest: introduce some basic coloring support to improve readability * regtest: sort imports, another piece of rationale * regtest: add capability test case * regtest: improve error flagging of test cases and introduce warnings * regtest: support caps * regtest: add a couple of command line parameter test cases * regtest: add another test that checks whether the default profile works * regtests: add tests for correct application of local profiles * regtest: add further test cases that test correct profile application * regtest: simplify test implementation and readability * regtest: add helpers for permissions.d per package profiles * regtest: support read-only bind mounts, also bind-mount permissions repo * tests: introduce a regression test suite for chkstat * Makefile: allow to build test version programmatically * README.md: add basic readme file that explains the repository's purpose * chkstat: change and harmonize coding style * chkstat: switch to C++ compilation unit * remove obsolete/broken entries for rcp/rsh/rlogin * chkstat: handle symlinks in final path elements correctly * Revert "Revert "mariadb: settings for new auth_pam_tool (boo#1160285)"" * Revert "mariadb: settings for new auth_pam_tool (boo#1160285)" * mariadb: settings for new auth_pam_tool (boo#1160285) * add read-only fallback when /proc is not mounted (boo#1160764) * capability handling fixes (boo#1161779) * better error message when refusing to fix dir perms (#32) * fix paths of ksysguard whitelisting * fix zero-termination of error message for overly long paths * fix misleading indendation * fix changing of capabilities * fix warning text for unlisted files * fix error message with insecure sym links * remove useless if around realloc() * fix invalid free() when permfiles points to argv * use path-based operations with /proc/self/fd/X to avoid errors due to O_PATH * add .gitignore for chkstat binary * add/fix compiler warnings, free memory at exit * only open regular files/directories without O_PATH, fix stat buffer initialization * update * rewrite while protecting against symlinks and races * fix whitespace * faxq-helper: correct "secure" permission for trusted group (boo#1157498) * whitelist ksysguard network helper (boo#1151190) * fix syntax of paranoid profile * fix squid permissions (boo#1093414, CVE-2019-3688) * setgid bit for nagios directory (boo#1028975, boo#1150345) * global: removal of unneeded SuSEconfig file and directory * global: restructure repository layout * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687) * add one more missing slash for icinga2 * fix more missing slashes for directories * cron directory permissions: add slashes * iputils: Add capability permissions for clockdiff * iputils/ping: Drop effective capability * iputils/ping6: Remove definitions * singluarity: Add starter-suid for version 3.2.0 * removed entry for /var/cache/man. Conflicts with packaging and man:man is the better setting anyway (boo#1133678) * fixed error in description of permissions.paranoid. Make it clear that this is not a usable profile, but intended as a base for own developments * Misleading comment fix * removed old entry for wodim * removed old entry for netatalk * removed old entry for suidperl * removed old entriy for utempter * removed old entriy for hostname * removed old directory entries * removed old entry for qemu-bridge-helper * removed old entries for pccardctl * removed old entries for isdnctrl * removed old entries for unix(2)_chkpwd * removed old entries for mount.nfs * removed old entries for (u)mount * removed old entry for fileshareset * removed old entries for KDE * removed old entry for heartbeat * removed old entry for gnome-control-center * removed old entry for pcp * removed old entry for lpdfilter * removed old entry for scotty * removed old entry for ia32el * removed old entry for squid * removed old qpopper whitelist * removed pt_chown entries. Not needed anymore and a bad idea anyway * removed old majordomo entry * removed stale entries for old ncpfs tools * removed old entry for rmtab * Fixed type in icinga2 whitelist entry * New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox * Removed whitelist for /usr/bin/su.core. According to comment a temporary hack introduced 2012 to help moving su from coretuils to util-linux. I couldn't find it anywhere, so we don't need it anymore * Remove entry for /usr/bin/yaps. We don't ship it anymore and the group that is used doesn't exists anymore starting with Leap 15, so it will not work there anyway. Users using this (old) package can do this individually * removed entry for /etc/ftpaccess. We currently don't have it anywhere (and judging from my search this has been the case for quite a while) * Ensure consistency of entries, otherwise switching between settings becomes problematic * Fix spelling of SUSE * adjust settings for amanda to current binary layout Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-1520=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): permissions-20200127-lp153.24.3.1 permissions-debuginfo-20200127-lp153.24.3.1 permissions-debugsource-20200127-lp153.24.3.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20200127-lp153.24.3.1 References: https://www.suse.com/security/cve/CVE-2019-3687.html https://www.suse.com/security/cve/CVE-2019-3688.html https://www.suse.com/security/cve/CVE-2020-8013.html https://bugzilla.suse.com/1028975 https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1093414 https://bugzilla.suse.com/1133678 https://bugzilla.suse.com/1148788 https://bugzilla.suse.com/1150345 https://bugzilla.suse.com/1150366 https://bugzilla.suse.com/1151190 https://bugzilla.suse.com/1157498 https://bugzilla.suse.com/1160285 https://bugzilla.suse.com/1160764 https://bugzilla.suse.com/1161335 https://bugzilla.suse.com/1161779 https://bugzilla.suse.com/1163588 https://bugzilla.suse.com/1167163 https://bugzilla.suse.com/1169614 https://bugzilla.suse.com/1171164 https://bugzilla.suse.com/1171173 https://bugzilla.suse.com/1171569 https://bugzilla.suse.com/1171580 https://bugzilla.suse.com/1171686 https://bugzilla.suse.com/1171879 https://bugzilla.suse.com/1171882 https://bugzilla.suse.com/1173221 https://bugzilla.suse.com/1174504 https://bugzilla.suse.com/1175720 https://bugzilla.suse.com/1175867 https://bugzilla.suse.com/1178475 https://bugzilla.suse.com/1178476 https://bugzilla.suse.com/1183669

1 0

openSUSE-SU-2021:3873-1: important: Security update for netcdf
by opensuse-security＠opensuse.org 02 Dec '21

02 Dec '21

openSUSE Security Update: Security update for netcdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3873-1 Rating: important References: #1191856 Cross-References: CVE-2019-20005 CVE-2019-20006 CVE-2019-20007 CVE-2019-20198 CVE-2019-20199 CVE-2019-20200 CVE-2019-20201 CVE-2019-20202 CVE-2021-26220 CVE-2021-26221 CVE-2021-26222 CVE-2021-30485 CVE-2021-31229 CVE-2021-31347 CVE-2021-31348 CVE-2021-31598 CVSS scores: CVE-2019-20005 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20005 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20006 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-20006 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20007 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20007 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20198 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20198 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20199 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20199 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20200 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20200 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20201 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20201 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20202 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20202 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-26220 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-26221 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-26222 (SUSE): 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H CVE-2021-30485 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-30485 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31229 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31347 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31348 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31348 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31598 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-31598 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for netcdf fixes the following issues: - Fixed multiple vulnerabilities in ezXML: CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202, CVE-2019-20199, CVE-2019-20200, CVE-2019-20198, CVE-2021-26221, CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347, CVE-2021-31348, CVE-2021-31598 (bsc#1191856) Note: * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23 not relevant for netcdf: code isn't used. * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14 Issue cannot be reproduced and no patch is available upstream. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3873=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libnetcdf-gnu-hpc-4.7.4-4.3.2 libnetcdf-gnu-mpich-hpc-4.7.4-4.3.2 libnetcdf-gnu-mvapich2-hpc-4.7.4-4.3.2 libnetcdf-gnu-openmpi2-hpc-4.7.4-4.3.2 libnetcdf-gnu-openmpi3-hpc-4.7.4-4.3.2 libnetcdf-gnu-openmpi4-hpc-4.7.4-4.3.2 libnetcdf18-4.7.4-4.3.2 libnetcdf18-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi2-4.7.4-4.3.2 libnetcdf18-openmpi2-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi3-4.7.4-4.3.2 libnetcdf18-openmpi3-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi4-4.7.4-4.3.2 libnetcdf18-openmpi4-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-hpc-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-mpich-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-mpich-hpc-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-mvapich2-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-mvapich2-hpc-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi2-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi2-hpc-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi3-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi3-hpc-debuginfo-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi4-hpc-4.7.4-4.3.2 libnetcdf_4_7_4-gnu-openmpi4-hpc-debuginfo-4.7.4-4.3.2 netcdf-4.7.4-4.3.2 netcdf-debuginfo-4.7.4-4.3.2 netcdf-debugsource-4.7.4-4.3.2 netcdf-devel-4.7.4-4.3.2 netcdf-devel-data-4.7.4-4.3.2 netcdf-devel-debuginfo-4.7.4-4.3.2 netcdf-devel-static-4.7.4-4.3.2 netcdf-openmpi2-4.7.4-4.3.2 netcdf-openmpi2-debuginfo-4.7.4-4.3.2 netcdf-openmpi2-debugsource-4.7.4-4.3.2 netcdf-openmpi2-devel-4.7.4-4.3.2 netcdf-openmpi2-devel-debuginfo-4.7.4-4.3.2 netcdf-openmpi2-devel-static-4.7.4-4.3.2 netcdf-openmpi3-4.7.4-4.3.2 netcdf-openmpi3-debuginfo-4.7.4-4.3.2 netcdf-openmpi3-debugsource-4.7.4-4.3.2 netcdf-openmpi3-devel-4.7.4-4.3.2 netcdf-openmpi3-devel-debuginfo-4.7.4-4.3.2 netcdf-openmpi3-devel-static-4.7.4-4.3.2 netcdf-openmpi4-4.7.4-4.3.2 netcdf-openmpi4-debuginfo-4.7.4-4.3.2 netcdf-openmpi4-debugsource-4.7.4-4.3.2 netcdf-openmpi4-devel-4.7.4-4.3.2 netcdf-openmpi4-devel-debuginfo-4.7.4-4.3.2 netcdf-openmpi4-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-hpc-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-mpich-hpc-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-mvapich2-hpc-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi2-hpc-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi3-hpc-devel-static-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-debugsource-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-devel-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-devel-debuginfo-4.7.4-4.3.2 netcdf_4_7_4-gnu-openmpi4-hpc-devel-static-4.7.4-4.3.2 - openSUSE Leap 15.3 (x86_64): libnetcdf18-32bit-4.7.4-4.3.2 libnetcdf18-32bit-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi2-32bit-4.7.4-4.3.2 libnetcdf18-openmpi2-32bit-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi3-32bit-4.7.4-4.3.2 libnetcdf18-openmpi3-32bit-debuginfo-4.7.4-4.3.2 libnetcdf18-openmpi4-32bit-4.7.4-4.3.2 libnetcdf18-openmpi4-32bit-debuginfo-4.7.4-4.3.2 - openSUSE Leap 15.3 (noarch): netcdf-gnu-hpc-4.7.4-4.3.2 netcdf-gnu-hpc-devel-4.7.4-4.3.2 netcdf-gnu-mpich-hpc-4.7.4-4.3.2 netcdf-gnu-mpich-hpc-devel-4.7.4-4.3.2 netcdf-gnu-mvapich2-hpc-4.7.4-4.3.2 netcdf-gnu-mvapich2-hpc-devel-4.7.4-4.3.2 netcdf-gnu-openmpi2-hpc-4.7.4-4.3.2 netcdf-gnu-openmpi2-hpc-devel-4.7.4-4.3.2 netcdf-gnu-openmpi3-hpc-4.7.4-4.3.2 netcdf-gnu-openmpi3-hpc-devel-4.7.4-4.3.2 netcdf-gnu-openmpi4-hpc-4.7.4-4.3.2 netcdf-gnu-openmpi4-hpc-devel-4.7.4-4.3.2 References: https://www.suse.com/security/cve/CVE-2019-20005.html https://www.suse.com/security/cve/CVE-2019-20006.html https://www.suse.com/security/cve/CVE-2019-20007.html https://www.suse.com/security/cve/CVE-2019-20198.html https://www.suse.com/security/cve/CVE-2019-20199.html https://www.suse.com/security/cve/CVE-2019-20200.html https://www.suse.com/security/cve/CVE-2019-20201.html https://www.suse.com/security/cve/CVE-2019-20202.html https://www.suse.com/security/cve/CVE-2021-26220.html https://www.suse.com/security/cve/CVE-2021-26221.html https://www.suse.com/security/cve/CVE-2021-26222.html https://www.suse.com/security/cve/CVE-2021-30485.html https://www.suse.com/security/cve/CVE-2021-31229.html https://www.suse.com/security/cve/CVE-2021-31347.html https://www.suse.com/security/cve/CVE-2021-31348.html https://www.suse.com/security/cve/CVE-2021-31598.html https://bugzilla.suse.com/1191856

1 0

openSUSE-SU-2021:3874-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 02 Dec '21

02 Dec '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3874-1 Rating: important References: #1192063 Cross-References: CVE-2021-30846 CVE-2021-30851 CVSS scores: CVE-2021-30846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30846 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). - CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3874=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.34.1-18.1 libjavascriptcoregtk-4_0-18-debuginfo-2.34.1-18.1 libwebkit2gtk-4_0-37-2.34.1-18.1 libwebkit2gtk-4_0-37-debuginfo-2.34.1-18.1 typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 typelib-1_0-WebKit2-4_0-2.34.1-18.1 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 webkit-jsc-4-2.34.1-18.1 webkit-jsc-4-debuginfo-2.34.1-18.1 webkit2gtk-4_0-injected-bundles-2.34.1-18.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.34.1-18.1 webkit2gtk3-debugsource-2.34.1-18.1 webkit2gtk3-devel-2.34.1-18.1 webkit2gtk3-minibrowser-2.34.1-18.1 webkit2gtk3-minibrowser-debuginfo-2.34.1-18.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.34.1-18.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.34.1-18.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.34.1-18.1 libwebkit2gtk-4_0-37-32bit-2.34.1-18.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.34.1-18.1 References: https://www.suse.com/security/cve/CVE-2021-30846.html https://www.suse.com/security/cve/CVE-2021-30851.html https://bugzilla.suse.com/1192063

1 0

openSUSE-SU-2021:3876-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 02 Dec '21

02 Dec '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3876-1 Rating: important References: #1100416 #1108488 #1129735 #1129898 #1133374 #1136513 #1171420 #1176724 #1177666 #1181158 #1184673 #1184804 #1185377 #1185726 #1185758 #1185973 #1186078 #1186109 #1186390 #1186482 #1186672 #1188062 #1188063 #1188172 #1188563 #1188601 #1188616 #1188838 #1188876 #1188983 #1188985 #1189057 #1189262 #1189291 #1189399 #1189400 #1189706 #1189846 #1189884 #1190023 #1190025 #1190067 #1190115 #1190117 #1190159 #1190276 #1190349 #1190351 #1190479 #1190534 #1190601 #1190717 #1191193 #1191315 #1191317 #1191349 #1191457 #1191628 #1191790 #1191800 #1191888 #1191961 #1192045 #1192267 #1192379 #1192400 #1192775 #1192781 #1192802 SLE-22573 Cross-References: CVE-2018-13405 CVE-2018-9517 CVE-2019-3874 CVE-2019-3900 CVE-2020-0429 CVE-2020-12770 CVE-2020-3702 CVE-2020-4788 CVE-2021-0941 CVE-2021-20322 CVE-2021-22543 CVE-2021-31916 CVE-2021-33033 CVE-2021-33909 CVE-2021-34556 CVE-2021-34981 CVE-2021-3542 CVE-2021-35477 CVE-2021-3640 CVE-2021-3653 CVE-2021-3655 CVE-2021-3656 CVE-2021-3659 CVE-2021-3679 CVE-2021-3715 CVE-2021-37159 CVE-2021-3732 CVE-2021-3744 CVE-2021-3752 CVE-2021-3753 CVE-2021-37576 CVE-2021-3759 CVE-2021-3760 CVE-2021-3764 CVE-2021-3772 CVE-2021-38160 CVE-2021-38198 CVE-2021-38204 CVE-2021-40490 CVE-2021-41864 CVE-2021-42008 CVE-2021-42252 CVE-2021-42739 CVSS scores: CVE-2018-13405 (NVD) : 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2018-13405 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2018-9517 (NVD) : 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2018-9517 (SUSE): 2.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2019-3874 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-3874 (SUSE): 5.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-3900 (NVD) : 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2019-3900 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-0429 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-0429 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-12770 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-12770 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2020-3702 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-3702 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-4788 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-0941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20322 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22543 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-22543 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-31916 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-31916 (SUSE): 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-33033 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33033 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-33909 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33909 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-34556 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-34981 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-3542 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-35477 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-3640 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3653 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3655 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-3656 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3659 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3679 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3715 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-37159 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-37159 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3732 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-3744 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3752 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3753 (SUSE): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-37576 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3759 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3760 (SUSE): 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3764 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3772 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38160 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38198 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38204 (SUSE): 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-40490 (SUSE): 6.1 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-41864 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-42008 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-42008 (SUSE): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-42252 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-42739 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 43 vulnerabilities, contains one feature and has 26 fixes is now available. Description: The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0) - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045). - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781). - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790) - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961). - CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601). - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351). - CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563). - CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876). - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067). - CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673). - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063). - CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735). - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349). - CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983). - CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985). - CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes (bnc#1190479). - CVE-2021-41864: prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317). - CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access (bnc#1191315). - CVE-2021-3759: Unaccounted ipc objects could have lead to breaking memcg limits and DoS attacks (bsc#1190115). - CVE-2020-3702: Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic (bnc#1191193). - CVE-2021-3752: Fixed a use after free vulnerability in the bluetooth module. (bsc#1190023) - CVE-2021-40490: A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel (bnc#1190159 bnc#1192775) - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884) - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534) - CVE-2020-12770: An issue was discovered in the Linux kernel sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040 (bnc#1171420). - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172). - CVE-2019-3900: An infinite loop issue was found in the vhost_net kernel module, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario (bnc#1133374). - CVE-2019-3874: The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. (bnc#1129898). - CVE-2018-9517: In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. (bnc#1108488). - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117) - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025). - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706). - CVE-2021-3653: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7 (bnc#1189399). - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291). - CVE-2021-3679: A lack of CPU resource in the tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057). - CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#0 bnc#1177666 bnc#1181158). - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876). - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1176724). - CVE-2021-37576: arch/powerpc/kvm/book3s_rtas.c on the powerpc platform allowed KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e (bnc#1188838 bnc#1190276). - CVE-2021-22543: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bnc#1186482 bnc#1190276). - CVE-2021-33909: fs/seq_file.c did not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05 (bnc#1188062 bnc#1188063). The following non-security bugs were fixed: - Add arch-dependent support markers in supported.conf (bsc#1186672) - Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796) - bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22913) - bpf: Disallow unprivileged bpf by default (jsc#SLE-22913). - ceph: take snap_empty_lock atomically with snaprealm refcount change (bsc#1191888). - config: disable unprivileged BPF by default (jsc#SLE-22913) - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (bsc#1185758,bsc#1192400). - drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802). - ftrace: Fix scripts/recordmcount.pl due to new binutils (bsc#1192267). - gigaset: fix spectre issue in do_data_b3_req (bsc#1192802). - hisax: fix spectre issues (bsc#1192802). - hv: mana: adjust mana_select_queue to old API (jsc#SLE-18779, bsc#1185726). - hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185726). - hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185726). - hysdn: fix spectre issue in hycapi_send_message (bsc#1192802). - infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802). - infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802). - ipc: remove memcg accounting for sops objects in do_semtimedop() (bsc#1190115). - iwlwifi: fix spectre issue in iwl_dbgfs_update_pm (bsc#1192802). - kernel-binary.spec: Exctract s390 decompression code (jsc#SLE-17042). - kernel-binary.spec: Fix up usrmerge for non-modular kernels. - kernel-binary.spec.in: build-id check requires elfutils. - kernel-binary.spec.in: Regenerate makefile when not using mkmakefile. - kernel-binary.spec: Only use mkmakefile when it exists Linux 5.13 no longer had a mkmakefile script - kernel-binary.spec: Remove obsolete and wrong comment mkmakefile is repleced by echo on newer kernel - kernel-docs.spec.in: Build using an utf-8 locale. Sphinx cannot handle UTF-8 input in non-UTF-8 locale. - media: dvb_ca_en50221: prevent using slot_info for Spectre attacs (bsc#1192802). - media: dvb_ca_en50221: sanity check slot number from userspace (bsc#1192802). - media: wl128x: get rid of a potential spectre issue (bsc#1192802). - memcg: enable accounting for file lock caches (bsc#1190115). - mm/memory.c: do_fault: avoid usage of stale vm_area_struct (bsc#1136513). - mpt3sas: fix spectre issues (bsc#1192802). - net: mana: Add a driver for Microsoft Azure Network Adapter (MANA) (jsc#SLE-18779, bsc#1185726). - net: mana: Add support for EQ sharing (jsc#SLE-18779, bsc#1185726). - net: mana: Add WARN_ON_ONCE in case of CQE read overflow (jsc#SLE-18779, bsc#1185726). - net: mana: Fix a memory leak in an error handling path in (jsc#SLE-18779, bsc#1185726). - net: mana: Fix error handling in mana_create_rxq() (git-fixes, bsc#1191800). - net: mana: fix PCI_HYPERV dependency (jsc#SLE-18779, bsc#1185726). - net: mana: Move NAPI from EQ to CQ (jsc#SLE-18779, bsc#1185726). - net: mana: Prefer struct_size over open coded arithmetic (jsc#SLE-18779, bsc#1185726). - net: mana: remove redundant initialization of variable err (jsc#SLE-18779, bsc#1185726). - net: mana: Use int to check the return value of mana_gd_poll_cq() (jsc#SLE-18779, bsc#1185726). - net: mana: Use struct_size() in kzalloc() (jsc#SLE-18779, bsc#1185726). - net_sched: cls_route: remove the right filter from hashtable (networking-stable-20_03_28). - net: sched: sch_teql: fix null-pointer dereference (bsc#1190717). - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() (bsc#1192802). - NFS: Do uncached readdir when we're seeking a cookie in an empty page cache (bsc#1191628). - objtool: Do not fail on missing symbol table (bsc#1192379). - osst: fix spectre issue in osst_verify_frame (bsc#1192802). - ovl: check whiteout in ovl_create_over_whiteout() (bsc#1189846). - ovl: filter of trusted xattr results in audit (bsc#1189846). - ovl: fix dentry leak in ovl_get_redirect (bsc#1189846). - ovl: initialize error in ovl_copy_xattr (bsc#1189846). - ovl: relax WARN_ON() on rename to self (bsc#1189846). - PCI: hv: Use expected affinity when unmasking IRQ (bsc#1185973). - Revert "memcg: enable accounting for file lock caches (bsc#1190115)." This reverts commit 912b4421a3e9bb9f0ef1aadc64a436666259bd4d. It's effectively upstream commit 3754707bcc3e190e5dadc978d172b61e809cb3bd applied to kernel-source (to avoid proliferation of patches). Make a note in blacklist.conf too. - s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant (bsc#1190601). - s390/bpf: Fix branch shortening during codegen pass (bsc#1190601). - s390/bpf: Fix optimizing out zero-extensions (bsc#1190601). - s390: bpf: implement jitting of BPF_ALU | BPF_ARSH | BPF_* (bsc#1190601). - s390/bpf: Wrap JIT macro parameter usages in parentheses (bsc#1190601). - scripts/git_sort/git_sort.py: add bpf git repo - scripts/git_sort/git_sort.py: Update nvme repositories - scsi: libfc: Fix array index out of bound exception (bsc#1188616). - scsi: lpfc: Fix FLOGI failure due to accessing a freed node (bsc#1191349). - scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling (bsc#1191349 bsc#1191457). - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (bsc#1191349 bsc#1191457). - scsi: target: avoid using lun_tg_pt_gp after unlock (bsc#1186078). - sctp: check asoc peer.asconf_capable before processing asconf (bsc#1190351). - sctp: fully initialize v4 addr in some functions (bsc#1188563). - sysvipc/sem: mitigate semnum index against spectre v1 (bsc#1192802). - target: core: Fix sense key for invalid XCOPY request (bsc#1186078). - Update config files: Add CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set - Use /usr/lib/modules as module dir when usermerge is active in the target distro. - UsrMerge the kernel (boo#1184804) - x86/CPU: Add more Icelake model numbers (bsc#1185758,bsc#1192400). - xfrm: xfrm_state_mtu should return at least 1280 for ipv6 (bsc#1185377). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3876=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-197.102.2 kernel-vanilla-4.12.14-197.102.2 kernel-vanilla-base-4.12.14-197.102.2 kernel-vanilla-base-debuginfo-4.12.14-197.102.2 kernel-vanilla-debuginfo-4.12.14-197.102.2 kernel-vanilla-debugsource-4.12.14-197.102.2 kernel-vanilla-devel-4.12.14-197.102.2 kernel-vanilla-devel-debuginfo-4.12.14-197.102.2 kernel-vanilla-livepatch-devel-4.12.14-197.102.2 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-197.102.2 kernel-debug-base-debuginfo-4.12.14-197.102.2 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-197.102.2 kernel-kvmsmall-base-debuginfo-4.12.14-197.102.2 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-197.102.2 kernel-zfcpdump-man-4.12.14-197.102.2 References: https://www.suse.com/security/cve/CVE-2018-13405.html https://www.suse.com/security/cve/CVE-2018-9517.html https://www.suse.com/security/cve/CVE-2019-3874.html https://www.suse.com/security/cve/CVE-2019-3900.html https://www.suse.com/security/cve/CVE-2020-0429.html https://www.suse.com/security/cve/CVE-2020-12770.html https://www.suse.com/security/cve/CVE-2020-3702.html https://www.suse.com/security/cve/CVE-2020-4788.html https://www.suse.com/security/cve/CVE-2021-0941.html https://www.suse.com/security/cve/CVE-2021-20322.html https://www.suse.com/security/cve/CVE-2021-22543.html https://www.suse.com/security/cve/CVE-2021-31916.html https://www.suse.com/security/cve/CVE-2021-33033.html https://www.suse.com/security/cve/CVE-2021-33909.html https://www.suse.com/security/cve/CVE-2021-34556.html https://www.suse.com/security/cve/CVE-2021-34981.html https://www.suse.com/security/cve/CVE-2021-3542.html https://www.suse.com/security/cve/CVE-2021-35477.html https://www.suse.com/security/cve/CVE-2021-3640.html https://www.suse.com/security/cve/CVE-2021-3653.html https://www.suse.com/security/cve/CVE-2021-3655.html https://www.suse.com/security/cve/CVE-2021-3656.html https://www.suse.com/security/cve/CVE-2021-3659.html https://www.suse.com/security/cve/CVE-2021-3679.html https://www.suse.com/security/cve/CVE-2021-3715.html https://www.suse.com/security/cve/CVE-2021-37159.html https://www.suse.com/security/cve/CVE-2021-3732.html https://www.suse.com/security/cve/CVE-2021-3744.html https://www.suse.com/security/cve/CVE-2021-3752.html https://www.suse.com/security/cve/CVE-2021-3753.html https://www.suse.com/security/cve/CVE-2021-37576.html https://www.suse.com/security/cve/CVE-2021-3759.html https://www.suse.com/security/cve/CVE-2021-3760.html https://www.suse.com/security/cve/CVE-2021-3764.html https://www.suse.com/security/cve/CVE-2021-3772.html https://www.suse.com/security/cve/CVE-2021-38160.html https://www.suse.com/security/cve/CVE-2021-38198.html https://www.suse.com/security/cve/CVE-2021-38204.html https://www.suse.com/security/cve/CVE-2021-40490.html https://www.suse.com/security/cve/CVE-2021-41864.html https://www.suse.com/security/cve/CVE-2021-42008.html https://www.suse.com/security/cve/CVE-2021-42252.html https://www.suse.com/security/cve/CVE-2021-42739.html https://bugzilla.suse.com/1100416 https://bugzilla.suse.com/1108488 https://bugzilla.suse.com/1129735 https://bugzilla.suse.com/1129898 https://bugzilla.suse.com/1133374 https://bugzilla.suse.com/1136513 https://bugzilla.suse.com/1171420 https://bugzilla.suse.com/1176724 https://bugzilla.suse.com/1177666 https://bugzilla.suse.com/1181158 https://bugzilla.suse.com/1184673 https://bugzilla.suse.com/1184804 https://bugzilla.suse.com/1185377 https://bugzilla.suse.com/1185726 https://bugzilla.suse.com/1185758 https://bugzilla.suse.com/1185973 https://bugzilla.suse.com/1186078 https://bugzilla.suse.com/1186109 https://bugzilla.suse.com/1186390 https://bugzilla.suse.com/1186482 https://bugzilla.suse.com/1186672 https://bugzilla.suse.com/1188062 https://bugzilla.suse.com/1188063 https://bugzilla.suse.com/1188172 https://bugzilla.suse.com/1188563 https://bugzilla.suse.com/1188601 https://bugzilla.suse.com/1188616 https://bugzilla.suse.com/1188838 https://bugzilla.suse.com/1188876 https://bugzilla.suse.com/1188983 https://bugzilla.suse.com/1188985 https://bugzilla.suse.com/1189057 https://bugzilla.suse.com/1189262 https://bugzilla.suse.com/1189291 https://bugzilla.suse.com/1189399 https://bugzilla.suse.com/1189400 https://bugzilla.suse.com/1189706 https://bugzilla.suse.com/1189846 https://bugzilla.suse.com/1189884 https://bugzilla.suse.com/1190023 https://bugzilla.suse.com/1190025 https://bugzilla.suse.com/1190067 https://bugzilla.suse.com/1190115 https://bugzilla.suse.com/1190117 https://bugzilla.suse.com/1190159 https://bugzilla.suse.com/1190276 https://bugzilla.suse.com/1190349 https://bugzilla.suse.com/1190351 https://bugzilla.suse.com/1190479 https://bugzilla.suse.com/1190534 https://bugzilla.suse.com/1190601 https://bugzilla.suse.com/1190717 https://bugzilla.suse.com/1191193 https://bugzilla.suse.com/1191315 https://bugzilla.suse.com/1191317 https://bugzilla.suse.com/1191349 https://bugzilla.suse.com/1191457 https://bugzilla.suse.com/1191628 https://bugzilla.suse.com/1191790 https://bugzilla.suse.com/1191800 https://bugzilla.suse.com/1191888 https://bugzilla.suse.com/1191961 https://bugzilla.suse.com/1192045 https://bugzilla.suse.com/1192267 https://bugzilla.suse.com/1192379 https://bugzilla.suse.com/1192400 https://bugzilla.suse.com/1192775 https://bugzilla.suse.com/1192781 https://bugzilla.suse.com/1192802

1 0

openSUSE-SU-2021:3834-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3834-1 Rating: moderate References: #1182345 #1192377 #1192378 Cross-References: CVE-2021-41771 CVE-2021-41772 CVSS scores: CVE-2021-41772 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Security update go1.16.10 (released 2021-11-04) (bsc#1182345). - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377). - CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3834=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.10-1.32.1 go1.16-doc-1.16.10-1.32.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.10-1.32.1 References: https://www.suse.com/security/cve/CVE-2021-41771.html https://www.suse.com/security/cve/CVE-2021-41772.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1192377 https://bugzilla.suse.com/1192378

1 0

openSUSE-SU-2021:3857-1: moderate: Security update for python-sqlparse
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for python-sqlparse ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3857-1 Rating: moderate References: #1190741 Cross-References: CVE-2021-32839 CVSS scores: CVE-2021-32839 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32839 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-sqlparse fixes the following issues: - CVE-2021-32839: Fixed ReDoS via regular expression in StripComments filter (bsc#1190741). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3857=1 Package List: - openSUSE Leap 15.3 (noarch): python3-sqlparse-0.4.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-32839.html https://bugzilla.suse.com/1190741

1 0

openSUSE-SU-2021:3854-1: important: Security update for poppler
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for poppler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3854-1 Rating: important References: #1092945 #1102531 #1107597 #1114966 #1115185 #1115186 #1115187 #1115626 #1120495 #1120496 #1120939 #1120956 #1124150 #1127329 #1129202 #1130229 #1131696 #1131722 #1142465 #1143950 #1179163 Cross-References: CVE-2017-18267 CVE-2018-13988 CVE-2018-16646 CVE-2018-18897 CVE-2018-19058 CVE-2018-19059 CVE-2018-19060 CVE-2018-19149 CVE-2018-20481 CVE-2018-20551 CVE-2018-20650 CVE-2018-20662 CVE-2019-10871 CVE-2019-10872 CVE-2019-14494 CVE-2019-7310 CVE-2019-9200 CVE-2019-9631 CVE-2019-9903 CVE-2019-9959 CVE-2020-27778 CVSS scores: CVE-2017-18267 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-18267 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-13988 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-13988 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2018-16646 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-16646 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18897 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18897 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19058 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19058 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19059 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19059 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19060 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19060 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19149 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19149 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-20481 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20481 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-20551 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20551 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-20650 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20650 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-20662 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20662 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-10871 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-10871 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVE-2019-10872 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-10872 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-14494 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-14494 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2019-7310 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-9200 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-9200 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-9631 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-9631 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-9903 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-9903 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-9959 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-9959 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-27778 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-27778 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for poppler fixes the following issues: - CVE-2017-18267: Fixed an infinite recursion that would allow remote attackers to cause a denial of service (bsc#1092945). - CVE-2018-13988: Added an improper implementation check which otherwise could allow buffer overflows, memory corruption, and denial of service (bsc#1102531). - CVE-2018-16646: Fixed an infinite recursion which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1107597). - CVE-2018-18897: Fixed a memory leak (bsc#1114966). - CVE-2018-19058: Fixed a bug which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1115187). - CVE-2018-19059: Fixed an out-of-bounds read access which could allow a denial-of-service attack (bsc#1115186). - CVE-2018-19060: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115185). - CVE-2018-19149: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115626). - CVE-2018-20481: Fixed a NULL pointer dereference while handling unallocated XRef entries which could allow a denial-of-service attack (bsc#1120495). - CVE-2018-20551: Fixed a reachable assertion which could allow a denial-of-service attack through specially crafted PDF files (bsc#1120496). - CVE-2018-20650: Fixed a reachable assertion which could allow denial-of-service through specially crafted PDF files (bsc#1120939). - CVE-2018-20662: Fixed a bug which could potentially crash the running process by SIGABRT resulting in a denial-of-service attack through a specially crafted PDF file (bsc#1120956). - CVE-2019-10871: Fixed a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc (bsc#1131696). - CVE-2019-10872: Fixed a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc (bsc#1131722). - CVE-2019-14494: Fixed a divide-by-zero error in the function SplashOutputDev::tilingPatternFill (bsc#1143950). - CVE-2019-7310: Fixed a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document (bsc#1124150). - CVE-2019-9200: Fixed a heap-based buffer underwrite which could allow denial-of-service attack through a specially crafted PDF file (bsc#1127329) - CVE-2019-9631: Fixed a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function (bsc#1129202). - CVE-2019-9903: Fixed excessive stack consumption in the Dict::find() method, which can be triggered by passing a crafted pdf file to the pdfunite binary (bsc#1130229). - CVE-2019-9959: Fixed integer overflow that made it possible to allocate a large memory chunk on the heap with a size controlled by an attacker (bsc#1142465). - CVE-2020-27778: Fixed buffer overflow vulnerability in pdftohtml (bsc#1179163). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3854=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpoppler73-0.62.0-4.6.1 libpoppler73-debuginfo-0.62.0-4.6.1 - openSUSE Leap 15.3 (x86_64): libpoppler73-32bit-0.62.0-4.6.1 libpoppler73-32bit-debuginfo-0.62.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2017-18267.html https://www.suse.com/security/cve/CVE-2018-13988.html https://www.suse.com/security/cve/CVE-2018-16646.html https://www.suse.com/security/cve/CVE-2018-18897.html https://www.suse.com/security/cve/CVE-2018-19058.html https://www.suse.com/security/cve/CVE-2018-19059.html https://www.suse.com/security/cve/CVE-2018-19060.html https://www.suse.com/security/cve/CVE-2018-19149.html https://www.suse.com/security/cve/CVE-2018-20481.html https://www.suse.com/security/cve/CVE-2018-20551.html https://www.suse.com/security/cve/CVE-2018-20650.html https://www.suse.com/security/cve/CVE-2018-20662.html https://www.suse.com/security/cve/CVE-2019-10871.html https://www.suse.com/security/cve/CVE-2019-10872.html https://www.suse.com/security/cve/CVE-2019-14494.html https://www.suse.com/security/cve/CVE-2019-7310.html https://www.suse.com/security/cve/CVE-2019-9200.html https://www.suse.com/security/cve/CVE-2019-9631.html https://www.suse.com/security/cve/CVE-2019-9903.html https://www.suse.com/security/cve/CVE-2019-9959.html https://www.suse.com/security/cve/CVE-2020-27778.html https://bugzilla.suse.com/1092945 https://bugzilla.suse.com/1102531 https://bugzilla.suse.com/1107597 https://bugzilla.suse.com/1114966 https://bugzilla.suse.com/1115185 https://bugzilla.suse.com/1115186 https://bugzilla.suse.com/1115187 https://bugzilla.suse.com/1115626 https://bugzilla.suse.com/1120495 https://bugzilla.suse.com/1120496 https://bugzilla.suse.com/1120939 https://bugzilla.suse.com/1120956 https://bugzilla.suse.com/1124150 https://bugzilla.suse.com/1127329 https://bugzilla.suse.com/1129202 https://bugzilla.suse.com/1130229 https://bugzilla.suse.com/1131696 https://bugzilla.suse.com/1131722 https://bugzilla.suse.com/1142465 https://bugzilla.suse.com/1143950 https://bugzilla.suse.com/1179163

1 0

openSUSE-SU-2021:3841-1: important: Security update for python-Pygments
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for python-Pygments ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3841-1 Rating: important References: #1184812 Cross-References: CVE-2021-27291 CVSS scores: CVE-2021-27291 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27291 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Pygments fixes the following issues: - CVE-2021-27291: Fixed ReDoS via crafted malicious input (bsc#1184812). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3841=1 Package List: - openSUSE Leap 15.3 (noarch): python2-Pygments-2.2.0-4.9.1 References: https://www.suse.com/security/cve/CVE-2021-27291.html https://bugzilla.suse.com/1184812

1 0

openSUSE-SU-2021:3839-1: important: Security update for python-Pygments
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for python-Pygments ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3839-1 Rating: important References: #1184812 Cross-References: CVE-2021-27291 CVSS scores: CVE-2021-27291 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27291 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Pygments fixes the following issues: - CVE-2021-27291: Fixed ReDoS via crafted malicious input (bsc#1184812). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3839=1 Package List: - openSUSE Leap 15.3 (noarch): python3-Pygments-2.6.1-4.3.1 References: https://www.suse.com/security/cve/CVE-2021-27291.html https://bugzilla.suse.com/1184812

1 0

openSUSE-SU-2021:3844-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3844-1 Rating: moderate References: #1192498 #1192556 Cross-References: CVE-2021-3933 CVE-2021-3941 CVSS scores: CVE-2021-3933 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3941 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2021-3941: Fixed divide-by-zero in Imf_3_1:RGBtoXYZ (bsc#1192556). - CVE-2021-3933: Fixed integer-overflow in Imf_3_1:bytesPerDeepLineTable (bsc#1192498). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3844=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libIlmImf-2_2-23-2.2.1-3.38.1 libIlmImf-2_2-23-debuginfo-2.2.1-3.38.1 libIlmImfUtil-2_2-23-2.2.1-3.38.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-3.38.1 openexr-2.2.1-3.38.1 openexr-debuginfo-2.2.1-3.38.1 openexr-debugsource-2.2.1-3.38.1 openexr-devel-2.2.1-3.38.1 openexr-doc-2.2.1-3.38.1 - openSUSE Leap 15.3 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-3.38.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-3.38.1 libIlmImfUtil-2_2-23-32bit-2.2.1-3.38.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-3.38.1 References: https://www.suse.com/security/cve/CVE-2021-3933.html https://www.suse.com/security/cve/CVE-2021-3941.html https://bugzilla.suse.com/1192498 https://bugzilla.suse.com/1192556

1 0

openSUSE-SU-2021:3833-1: moderate: Security update for go1.17
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3833-1 Rating: moderate References: #1190649 #1192377 #1192378 Cross-References: CVE-2021-41771 CVE-2021-41772 CVSS scores: CVE-2021-41772 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: Security update go1.17.3 (released 2021-11-04) (bsc#1190649). - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377). - CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3833=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.3-1.9.1 go1.17-doc-1.17.3-1.9.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.3-1.9.1 References: https://www.suse.com/security/cve/CVE-2021-41771.html https://www.suse.com/security/cve/CVE-2021-41772.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1192377 https://bugzilla.suse.com/1192378

1 0

openSUSE-SU-2021:3838-1: important: Security update for ruby2.5
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3838-1 Rating: important References: #1188160 #1188161 #1190375 Cross-References: CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 CVSS scores: CVE-2021-31799 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-31810 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-32066 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ruby2.5 fixes the following issues: - CVE-2021-31799: Fixed Command injection vulnerability in RDoc (bsc#1190375). - CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161). - CVE-2021-32066: Fixed StartTLS stripping vulnerability in Net:IMAP (bsc#1188160). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3838=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libruby2_5-2_5-2.5.9-4.20.1 libruby2_5-2_5-debuginfo-2.5.9-4.20.1 ruby2.5-2.5.9-4.20.1 ruby2.5-debuginfo-2.5.9-4.20.1 ruby2.5-debugsource-2.5.9-4.20.1 ruby2.5-devel-2.5.9-4.20.1 ruby2.5-devel-extra-2.5.9-4.20.1 ruby2.5-doc-2.5.9-4.20.1 ruby2.5-stdlib-2.5.9-4.20.1 ruby2.5-stdlib-debuginfo-2.5.9-4.20.1 - openSUSE Leap 15.3 (noarch): ruby2.5-doc-ri-2.5.9-4.20.1 References: https://www.suse.com/security/cve/CVE-2021-31799.html https://www.suse.com/security/cve/CVE-2021-31810.html https://www.suse.com/security/cve/CVE-2021-32066.html https://bugzilla.suse.com/1188160 https://bugzilla.suse.com/1188161 https://bugzilla.suse.com/1190375

1 0

openSUSE-SU-2021:3835-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3835-1 Rating: moderate References: #1192497 Cross-References: CVE-2021-35604 CVSS scores: CVE-2021-35604 (NVD) : 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CVE-2021-35604 (SUSE): 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mariadb fixes the following issues: - Update to 10.5.13: - CVE-2021-35604: Fixed InnoDB vulnerability that allowed an high privileged attacker with network access via multiple protocols to compromise MySQL (bsc#1192497). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3835=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.13-3.12.1 libmariadbd19-10.5.13-3.12.1 libmariadbd19-debuginfo-10.5.13-3.12.1 mariadb-10.5.13-3.12.1 mariadb-bench-10.5.13-3.12.1 mariadb-bench-debuginfo-10.5.13-3.12.1 mariadb-client-10.5.13-3.12.1 mariadb-client-debuginfo-10.5.13-3.12.1 mariadb-debuginfo-10.5.13-3.12.1 mariadb-debugsource-10.5.13-3.12.1 mariadb-rpm-macros-10.5.13-3.12.1 mariadb-test-10.5.13-3.12.1 mariadb-test-debuginfo-10.5.13-3.12.1 mariadb-tools-10.5.13-3.12.1 mariadb-tools-debuginfo-10.5.13-3.12.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.13-3.12.1 References: https://www.suse.com/security/cve/CVE-2021-35604.html https://bugzilla.suse.com/1192497

1 0

openSUSE-SU-2021:3860-1: moderate: Security update for speex
by opensuse-security＠opensuse.org 01 Dec '21

01 Dec '21

openSUSE Security Update: Security update for speex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3860-1 Rating: moderate References: #1192580 Cross-References: CVE-2020-23903 CVSS scores: CVE-2020-23903 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for speex fixes the following issues: - CVE-2020-23903: Fixed zero division error in read_samples (bsc#1192580). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3860=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libspeex1-1.2-3.3.1 libspeex1-debuginfo-1.2-3.3.1 speex-1.2-3.3.1 speex-debuginfo-1.2-3.3.1 speex-debugsource-1.2-3.3.1 speex-devel-1.2-3.3.1 - openSUSE Leap 15.3 (x86_64): libspeex1-32bit-1.2-3.3.1 libspeex1-32bit-debuginfo-1.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-23903.html https://bugzilla.suse.com/1192580

1 0