December 2021 - openSUSE Security Announce

openSUSE-SU-2021:4209-1: important: Security update for gegl
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for gegl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4209-1 Rating: important References: #1194045 Cross-References: CVE-2021-45463 CVSS scores: CVE-2021-45463 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gegl fixes the following issues: - CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4209=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gegl-0.4.16-3.3.1 gegl-0_4-0.4.16-3.3.1 gegl-0_4-debuginfo-0.4.16-3.3.1 gegl-debuginfo-0.4.16-3.3.1 gegl-debugsource-0.4.16-3.3.1 gegl-devel-0.4.16-3.3.1 gegl-doc-0.4.16-3.3.1 libgegl-0_4-0-0.4.16-3.3.1 libgegl-0_4-0-debuginfo-0.4.16-3.3.1 typelib-1_0-Gegl-0_4-0.4.16-3.3.1 - openSUSE Leap 15.3 (x86_64): libgegl-0_4-0-32bit-0.4.16-3.3.1 libgegl-0_4-0-32bit-debuginfo-0.4.16-3.3.1 - openSUSE Leap 15.3 (noarch): gegl-0_4-lang-0.4.16-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-45463.html https://bugzilla.suse.com/1194045

1 0

openSUSE-SU-2021:4210-1: important: Security update for gegl
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for gegl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4210-1 Rating: important References: #1194045 Cross-References: CVE-2021-45463 CVSS scores: CVE-2021-45463 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gegl fixes the following issues: - CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4210=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gegl-0_3-0.3.34-3.3.1 gegl-0_3-debuginfo-0.3.34-3.3.1 libgegl-0_3-0-0.3.34-3.3.1 libgegl-0_3-0-debuginfo-0.3.34-3.3.1 typelib-1_0-Gegl-0_3-0.3.34-3.3.1 - openSUSE Leap 15.3 (noarch): gegl-0_3-lang-0.3.34-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-45463.html https://bugzilla.suse.com/1194045

1 0

openSUSE-SU-2021:1646-1: important: Security update for privoxy
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1646-1 Rating: important References: #1193584 Cross-References: CVE-2021-44540 CVE-2021-44541 CVE-2021-44542 CVE-2021-44543 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for privoxy fixes the following issues: privoxy was updated to 3.0.33 (boo#1193584): * CVE-2021-44543: Encode the template name to prevent XSS (cross-side scripting) when Privoxy is configured to servce the user-manual itself * CVE-2021-44540: Free memory of compiled pattern spec before bailing * CVE-2021-44541: Free header memory when failing to get the request destination. * CVE-2021-44542: Prevent memory leaks when handling errors * Disable fast-redirects for a number of domains * Update default block lists * Many bug fixes and minor enhancements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1646=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1646=1 Package List: - openSUSE Leap 15.2 (x86_64): privoxy-3.0.33-lp152.3.12.1 privoxy-debuginfo-3.0.33-lp152.3.12.1 privoxy-debugsource-3.0.33-lp152.3.12.1 - openSUSE Leap 15.2 (noarch): privoxy-doc-3.0.33-lp152.3.12.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): privoxy-3.0.33-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): privoxy-doc-3.0.33-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-44540.html https://www.suse.com/security/cve/CVE-2021-44541.html https://www.suse.com/security/cve/CVE-2021-44542.html https://www.suse.com/security/cve/CVE-2021-44543.html https://bugzilla.suse.com/1193584

1 0

openSUSE-SU-2021:1648-1: Security update for kernel-firmware
by opensuse-security＠opensuse.org 31 Dec '21

31 Dec '21

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1648-1 Rating: low References: #1167162 Cross-References: CVE-2019-15126 CVSS scores: CVE-2019-15126 (NVD) : 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-15126 (SUSE): 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kernel-firmware fixes the following issues: - CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1648=1 Package List: - openSUSE Leap 15.2 (noarch): kernel-firmware-20200107-lp152.2.9.1 ucode-amd-20200107-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-15126.html https://bugzilla.suse.com/1167162

1 0

openSUSE-SU-2021:1640-1: moderate: Security update for c-toxcore
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for c-toxcore ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1640-1 Rating: moderate References: #1193667 Cross-References: CVE-2021-44847 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: c-toxcore was updated fo fix a securiy issue: - CVE-2021-44847: Fixed a buffer overflow in handle_request in DHT.c which could lead to remote DoS and potential code execution (boo#1193667) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1640=1 Package List: - openSUSE Leap 15.2 (x86_64): c-toxcore-0.2.13-lp152.3.3.1 c-toxcore-daemon-0.2.13-lp152.3.3.1 c-toxcore-daemon-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-devel-0.2.13-lp152.3.3.1 libtoxcore2-0.2.13-lp152.3.3.1 libtoxcore2-debuginfo-0.2.13-lp152.3.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): c-toxcore-0.2.13-bp153.2.3.1 c-toxcore-daemon-0.2.13-bp153.2.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-devel-0.2.13-bp153.2.3.1 libtoxcore2-0.2.13-bp153.2.3.1 libtoxcore2-debuginfo-0.2.13-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp152.4.3.1 c-toxcore-daemon-0.2.13-bp152.4.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-devel-0.2.13-bp152.4.3.1 libtoxcore2-0.2.13-bp152.4.3.1 libtoxcore2-debuginfo-0.2.13-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp151.3.3.1 c-toxcore-daemon-0.2.13-bp151.3.3.1 c-toxcore-devel-0.2.13-bp151.3.3.1 libtoxcore2-0.2.13-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44847.html https://bugzilla.suse.com/1193667

1 0

openSUSE-SU-2021:1645-1: moderate: Security update for getdata
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for getdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1645-1 Rating: moderate References: #1186251 Cross-References: CVE-2021-20204 CVSS scores: CVE-2021-20204 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20204 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: getdata was updated to 0.11.0, fixing bugs and a security issue: - CVE-2021-20204: Fixed a use after free in _GD_Supports() in encoding.c (boo#1186251) for all relevant changes see: https://github.com/ketiltrout/getdata/releases/tag/v0.11.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1645=1 Package List: - openSUSE Leap 15.2 (x86_64): getdata-0.11.0-lp152.4.3.1 getdata-debuginfo-0.11.0-lp152.4.3.1 getdata-debugsource-0.11.0-lp152.4.3.1 getdata-devel-0.11.0-lp152.4.3.1 getdata-doc-0.11.0-lp152.4.3.1 libf95getdata7-0.11.0-lp152.4.3.1 libf95getdata7-debuginfo-0.11.0-lp152.4.3.1 libfgetdata6-0.11.0-lp152.4.3.1 libfgetdata6-debuginfo-0.11.0-lp152.4.3.1 libgetdata++7-0.11.0-lp152.4.3.1 libgetdata++7-debuginfo-0.11.0-lp152.4.3.1 libgetdata8-0.11.0-lp152.4.3.1 libgetdata8-debuginfo-0.11.0-lp152.4.3.1 perl-getdata-0.11.0-lp152.4.3.1 perl-getdata-debuginfo-0.11.0-lp152.4.3.1 python-getdata-0.11.0-lp152.4.3.1 python-getdata-debuginfo-0.11.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20204.html https://bugzilla.suse.com/1186251

1 0

openSUSE-SU-2021:1642-1: moderate: Security update for postrsd
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for postrsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1642-1 Rating: moderate References: #1180251 Cross-References: CVE-2020-35573 CVSS scores: CVE-2020-35573 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: postrsd was updated to release 1.11 [boo#1180251]: * Drop group privileges as well as user privileges * Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. [CVE-2020-35573] - Update to release 1.6 * Fix endianness issue with SHA-1 implementation * Add dual stack support * Make SRS separator configurable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1642=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): postsrsd-1.11-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-35573.html https://bugzilla.suse.com/1180251

1 0

openSUSE-SU-2021:4208-1: moderate: Security update for log4j
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4208-1 Rating: moderate References: #1194127 Cross-References: CVE-2021-44832 CVSS scores: CVE-2021-44832 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4208=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.17.0-4.16.1 log4j-javadoc-2.17.0-4.16.1 log4j-jcl-2.17.0-4.16.1 log4j-slf4j-2.17.0-4.16.1 References: https://www.suse.com/security/cve/CVE-2021-44832.html https://bugzilla.suse.com/1194127

1 0

openSUSE-SU-2021:1635-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1635-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1635=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-91.4.0-lp152.2.52.1 MozillaThunderbird-debuginfo-91.4.0-lp152.2.52.1 MozillaThunderbird-debugsource-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-common-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-other-91.4.0-lp152.2.52.1 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:4192-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4192-1 Rating: moderate References: #1174504 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Update to version 20181225: * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4192=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): permissions-20181225-23.9.1 permissions-debuginfo-20181225-23.9.1 permissions-debugsource-20181225-23.9.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20181225-23.9.1 References: https://bugzilla.suse.com/1174504

1 0

openSUSE-SU-2021:1632-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1632-1 Rating: important References: #1192310 #1192734 #1193519 #1193713 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 CVE-2021-4078 CVE-2021-4079 CVE-2021-4098 CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1632=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-96.0.4664.110-lp152.2.143.1 chromedriver-debuginfo-96.0.4664.110-lp152.2.143.1 chromium-96.0.4664.110-lp152.2.143.1 chromium-debuginfo-96.0.4664.110-lp152.2.143.1 References: https://www.suse.com/security/cve/CVE-2021-38005.html https://www.suse.com/security/cve/CVE-2021-38006.html https://www.suse.com/security/cve/CVE-2021-38007.html https://www.suse.com/security/cve/CVE-2021-38008.html https://www.suse.com/security/cve/CVE-2021-38009.html https://www.suse.com/security/cve/CVE-2021-38010.html https://www.suse.com/security/cve/CVE-2021-38011.html https://www.suse.com/security/cve/CVE-2021-38012.html https://www.suse.com/security/cve/CVE-2021-38013.html https://www.suse.com/security/cve/CVE-2021-38014.html https://www.suse.com/security/cve/CVE-2021-38015.html https://www.suse.com/security/cve/CVE-2021-38016.html https://www.suse.com/security/cve/CVE-2021-38017.html https://www.suse.com/security/cve/CVE-2021-38018.html https://www.suse.com/security/cve/CVE-2021-38019.html https://www.suse.com/security/cve/CVE-2021-38020.html https://www.suse.com/security/cve/CVE-2021-38021.html https://www.suse.com/security/cve/CVE-2021-38022.html https://www.suse.com/security/cve/CVE-2021-4052.html https://www.suse.com/security/cve/CVE-2021-4053.html https://www.suse.com/security/cve/CVE-2021-4054.html https://www.suse.com/security/cve/CVE-2021-4055.html https://www.suse.com/security/cve/CVE-2021-4056.html https://www.suse.com/security/cve/CVE-2021-4057.html https://www.suse.com/security/cve/CVE-2021-4058.html https://www.suse.com/security/cve/CVE-2021-4059.html https://www.suse.com/security/cve/CVE-2021-4061.html https://www.suse.com/security/cve/CVE-2021-4062.html https://www.suse.com/security/cve/CVE-2021-4063.html https://www.suse.com/security/cve/CVE-2021-4064.html https://www.suse.com/security/cve/CVE-2021-4065.html https://www.suse.com/security/cve/CVE-2021-4066.html https://www.suse.com/security/cve/CVE-2021-4067.html https://www.suse.com/security/cve/CVE-2021-4068.html https://www.suse.com/security/cve/CVE-2021-4078.html https://www.suse.com/security/cve/CVE-2021-4079.html https://www.suse.com/security/cve/CVE-2021-4098.html https://www.suse.com/security/cve/CVE-2021-4099.html https://www.suse.com/security/cve/CVE-2021-4100.html https://www.suse.com/security/cve/CVE-2021-4101.html https://www.suse.com/security/cve/CVE-2021-4102.html https://bugzilla.suse.com/1192310 https://bugzilla.suse.com/1192734 https://bugzilla.suse.com/1193519 https://bugzilla.suse.com/1193713

1 0

openSUSE-SU-2021:1631-1: important: Security update for kafka
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for kafka ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1631-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update of kafka fixes the following issue: - CVE-2021-4104: Remove JMSAppender from log4j jars during build to prevent bsc#1193662, Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1631=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): kafka-source-2.1.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (x86_64): kafka-kit-2.1.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1625-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1625-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1625=1 Package List: - openSUSE Leap 15.2 (x86_64): runc-1.0.3-lp152.2.12.1 runc-debuginfo-1.0.3-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:1626-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1626-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1626=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.16-1.16.12-lp152.20.1 go1.16-doc-1.16.12-lp152.20.1 go1.16-race-1.16.12-lp152.20.1 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:1624-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 26 Dec '21

26 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1624-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1624=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aom-tools-1.0.0-lp152.3.9.1 aom-tools-debuginfo-1.0.0-lp152.3.9.1 libaom-debugsource-1.0.0-lp152.3.9.1 libaom-devel-1.0.0-lp152.3.9.1 libaom0-1.0.0-lp152.3.9.1 libaom0-debuginfo-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): libaom-devel-doc-1.0.0-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): libaom0-32bit-1.0.0-lp152.3.9.1 libaom0-32bit-debuginfo-1.0.0-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:1612-1: important: Security update for log4j12
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for log4j12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1612-1 Rating: important References: #1193662 Cross-References: CVE-2021-4104 CVSS scores: CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j12 fixes the following issues: - CVE-2021-4104: Disable the JMSAppender class from log4j to protect against the log4jshell vulnerability. [bsc#1193662] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1612=1 Package List: - openSUSE Leap 15.2 (noarch): log4j12-1.2.17-lp152.3.3.2 log4j12-javadoc-1.2.17-lp152.3.3.2 log4j12-manual-1.2.17-lp152.3.3.2 log4j12-mini-1.2.17-lp152.3.3.2 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://bugzilla.suse.com/1193662

1 0

openSUSE-SU-2021:1613-1: important: Security update for logback
by opensuse-security＠opensuse.org 24 Dec '21

24 Dec '21

openSUSE Security Update: Security update for logback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1613-1 Rating: important References: #1193795 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan="true" set prior to attack This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1613=1 Package List: - openSUSE Leap 15.2 (noarch): logback-1.2.8-lp152.2.3.2 logback-access-1.2.8-lp152.2.3.2 logback-examples-1.2.8-lp152.2.3.2 logback-javadoc-1.2.8-lp152.2.3.2 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193795

1 0

openSUSE-SU-2021:1611-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1611-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1611=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libp11-kit0-0.23.2-lp152.7.3.1 libp11-kit0-debuginfo-0.23.2-lp152.7.3.1 p11-kit-0.23.2-lp152.7.3.1 p11-kit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-debugsource-0.23.2-lp152.7.3.1 p11-kit-devel-0.23.2-lp152.7.3.1 p11-kit-nss-trust-0.23.2-lp152.7.3.1 p11-kit-tools-0.23.2-lp152.7.3.1 p11-kit-tools-debuginfo-0.23.2-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): libp11-kit0-32bit-0.23.2-lp152.7.3.1 libp11-kit0-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-32bit-0.23.2-lp152.7.3.1 p11-kit-32bit-debuginfo-0.23.2-lp152.7.3.1 p11-kit-nss-trust-32bit-0.23.2-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4170-1: moderate: Security update for libaom
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4170-1 Rating: moderate References: #1193356 #1193365 #1193366 #1193369 Cross-References: CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36135 CVSS scores: CVE-2020-36129 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36135 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libaom fixes the following issues: - CVE-2020-36129: Fixed stack buffer overflow via the component src/aom_image.c (bsc#1193356). - CVE-2020-36131: Fixed stack buffer overflow via the component stats/rate_hist.c (bsc#1193365). - CVE-2020-36135: Fixed NULL pointer dereference via the component rate_hist.c (bsc#1193366). - CVE-2020-36130: Fixed NULL pointer dereference via the component av1/av1_dx_iface.c (bsc#1193369). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4170=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-3.9.1 aom-tools-debuginfo-1.0.0-3.9.1 libaom-debugsource-1.0.0-3.9.1 libaom-devel-1.0.0-3.9.1 libaom0-1.0.0-3.9.1 libaom0-debuginfo-1.0.0-3.9.1 - openSUSE Leap 15.3 (noarch): libaom-devel-doc-1.0.0-3.9.1 - openSUSE Leap 15.3 (x86_64): libaom0-32bit-1.0.0-3.9.1 libaom0-32bit-debuginfo-1.0.0-3.9.1 References: https://www.suse.com/security/cve/CVE-2020-36129.html https://www.suse.com/security/cve/CVE-2020-36130.html https://www.suse.com/security/cve/CVE-2020-36131.html https://www.suse.com/security/cve/CVE-2020-36135.html https://bugzilla.suse.com/1193356 https://bugzilla.suse.com/1193365 https://bugzilla.suse.com/1193366 https://bugzilla.suse.com/1193369

1 0

openSUSE-SU-2021:4169-1: moderate: Security update for go1.16
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4169-1 Rating: moderate References: #1182345 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4169=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.12-1.37.2 go1.16-doc-1.16.12-1.37.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.12-1.37.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:4186-1: moderate: Security update for go1.17
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4186-1 Rating: moderate References: #1190649 #1193597 #1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649) - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598). - CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4186=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.5-1.14.2 go1.17-doc-1.17.5-1.14.2 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.5-1.14.2 References: https://www.suse.com/security/cve/CVE-2021-44716.html https://www.suse.com/security/cve/CVE-2021-44717.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1193597 https://bugzilla.suse.com/1193598

1 0

openSUSE-SU-2021:4171-1: moderate: Security update for runc
by opensuse-security＠opensuse.org 23 Dec '21

23 Dec '21

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4171-1 Rating: moderate References: #1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 (NVD) : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for runc fixes the following issues: Update to runc v1.0.3. * CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436) * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4171=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): runc-1.0.3-27.1 runc-debuginfo-1.0.3-27.1 References: https://www.suse.com/security/cve/CVE-2021-43784.html https://bugzilla.suse.com/1193436

1 0

openSUSE-SU-2021:4150-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4150-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4150=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.4.0-8.45.2 MozillaThunderbird-debuginfo-91.4.0-8.45.2 MozillaThunderbird-debugsource-91.4.0-8.45.2 MozillaThunderbird-translations-common-91.4.0-8.45.2 MozillaThunderbird-translations-other-91.4.0-8.45.2 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:4154-1: important: Security update for p11-kit
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for p11-kit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4154-1 Rating: important References: #1180064 #1187993 Cross-References: CVE-2020-29361 CVSS scores: CVE-2020-29361 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29361 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4154=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libp11-kit0-0.23.2-4.13.1 libp11-kit0-debuginfo-0.23.2-4.13.1 p11-kit-0.23.2-4.13.1 p11-kit-debuginfo-0.23.2-4.13.1 p11-kit-debugsource-0.23.2-4.13.1 p11-kit-devel-0.23.2-4.13.1 p11-kit-nss-trust-0.23.2-4.13.1 p11-kit-tools-0.23.2-4.13.1 p11-kit-tools-debuginfo-0.23.2-4.13.1 - openSUSE Leap 15.3 (x86_64): libp11-kit0-32bit-0.23.2-4.13.1 libp11-kit0-32bit-debuginfo-0.23.2-4.13.1 p11-kit-32bit-0.23.2-4.13.1 p11-kit-32bit-debuginfo-0.23.2-4.13.1 p11-kit-nss-trust-32bit-0.23.2-4.13.1 References: https://www.suse.com/security/cve/CVE-2020-29361.html https://bugzilla.suse.com/1180064 https://bugzilla.suse.com/1187993

1 0

openSUSE-SU-2021:4153-1: important: Security update for openssh
by opensuse-security＠opensuse.org 22 Dec '21

22 Dec '21

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4153-1 Rating: important References: #1183137 Cross-References: CVE-2021-28041 CVSS scores: CVE-2021-28041 (NVD) : 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-28041 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssh fixes the following issues: - CVE-2021-28041: Fixed double free in ssh-agent (bsc#1183137). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4153=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openssh-8.4p1-3.9.1 openssh-askpass-gnome-8.4p1-3.9.1 openssh-askpass-gnome-debuginfo-8.4p1-3.9.1 openssh-askpass-gnome-debugsource-8.4p1-3.9.1 openssh-cavs-8.4p1-3.9.1 openssh-cavs-debuginfo-8.4p1-3.9.1 openssh-clients-8.4p1-3.9.1 openssh-clients-debuginfo-8.4p1-3.9.1 openssh-common-8.4p1-3.9.1 openssh-common-debuginfo-8.4p1-3.9.1 openssh-debuginfo-8.4p1-3.9.1 openssh-debugsource-8.4p1-3.9.1 openssh-fips-8.4p1-3.9.1 openssh-helpers-8.4p1-3.9.1 openssh-helpers-debuginfo-8.4p1-3.9.1 openssh-server-8.4p1-3.9.1 openssh-server-debuginfo-8.4p1-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-28041.html https://bugzilla.suse.com/1183137

1 0