December 2021

openSUSE-SU-2021:4070-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4070-1 Rating: important References: #1193030 Cross-References: CVE-2021-4008 CVSS scores: CVE-2021-4008 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 … [View More]

1 0

openSUSE-SU-2021:4058-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4058-1 Rating: important References: #1192516 Cross-References: CVE-2021-23214 CVE-2021-23222 CVSS scores: CVE-2021-23214 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-23222 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected … [View More]

1 0

openSUSE-SU-2021:4018-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4018-1 Rating: moderate References: #1152964 #1174075 #1181400 #1188875 #1190069 #1190896 SLE-17903 SLE-18059 SLE-18159 Cross-References: CVE-2021-36386 CVE-2021-39272 CVSS scores: CVE-2021-36386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H … [View More]

1 0

openSUSE-SU-2021:1583-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1583-1 Rating: moderate References: #1181836 Cross-References: CVE-2021-20176 CVSS scores: CVE-2021-20176 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20176 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: … [View More] openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20176: Fixed division by zero caused by processing crafted file (bsc#1181836). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1583=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ImageMagick-7.0.7.34-lp152.12.18.1 ImageMagick-config-7-SUSE-7.0.7.34-lp152.12.18.1 ImageMagick-config-7-upstream-7.0.7.34-lp152.12.18.1 ImageMagick-debuginfo-7.0.7.34-lp152.12.18.1 ImageMagick-debugsource-7.0.7.34-lp152.12.18.1 ImageMagick-devel-7.0.7.34-lp152.12.18.1 ImageMagick-extra-7.0.7.34-lp152.12.18.1 ImageMagick-extra-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-devel-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.18.1 perl-PerlMagick-7.0.7.34-lp152.12.18.1 perl-PerlMagick-debuginfo-7.0.7.34-lp152.12.18.1 - openSUSE Leap 15.2 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp152.12.18.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp152.12.18.1 libMagick++-devel-32bit-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.18.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.18.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.18.1 - openSUSE Leap 15.2 (noarch): ImageMagick-doc-7.0.7.34-lp152.12.18.1 References: https://www.suse.com/security/cve/CVE-2021-20176.html https://bugzilla.suse.com/1181836 [View Less]

1 0

openSUSE-SU-2021:1582-1: important: Security update for chromium
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1582-1 Rating: important References: #1192310 #1192734 #1193519 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-… [View More]

1 0

openSUSE-SU-2021:4001-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4001-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 … [View More]

1 0

openSUSE-SU-2021:1577-1: important: Security update for log4j
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1577-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 … [View More]

1 0

openSUSE-SU-2021:4002-1: moderate: Security update for python-pip
by opensuse-security＠opensuse.org 13 Dec '21

13 Dec '21

openSUSE Security Update: Security update for python-pip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4002-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 … [View More]

1 0

openSUSE-SU-2021:3999-1: important: Security update for log4j
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3999-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 … [View More]

1 0

openSUSE-SU-2021:1574-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1574-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: … [View More] CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1574=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs12-12.22.7-lp152.3.21.1 nodejs12-debuginfo-12.22.7-lp152.3.21.1 nodejs12-debugsource-12.22.7-lp152.3.21.1 nodejs12-devel-12.22.7-lp152.3.21.1 npm12-12.22.7-lp152.3.21.1 - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.22.7-lp152.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602 [View Less]

1 0

openSUSE-SU-2021:1575-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1575-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: … [View More] CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1575=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-91.4.0-lp152.2.74.1 MozillaFirefox-branding-upstream-91.4.0-lp152.2.74.1 MozillaFirefox-debuginfo-91.4.0-lp152.2.74.1 MozillaFirefox-debugsource-91.4.0-lp152.2.74.1 MozillaFirefox-devel-91.4.0-lp152.2.74.1 MozillaFirefox-translations-common-91.4.0-lp152.2.74.1 MozillaFirefox-translations-other-91.4.0-lp152.2.74.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485 [View Less]

1 0

openSUSE-SU-2021:1573-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1573-1 Rating: moderate References: #1188284 #1192346 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav fixes the … [View More]

1 0

openSUSE-SU-2021:1569-1: moderate: Security update for gmp
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for gmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1569-1 Rating: moderate References: #1192717 Cross-References: CVE-2021-43618 CVSS scores: CVE-2021-43618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43618 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: … [View More]

1 0

openSUSE-SU-2021:1570-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1570-1 Rating: moderate References: #1175508 #1192050 #1193041 Cross-References: CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H … [View More] CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1570=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.21.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.21.1 php7-7.4.6-lp152.2.21.1 php7-bcmath-7.4.6-lp152.2.21.1 php7-bcmath-debuginfo-7.4.6-lp152.2.21.1 php7-bz2-7.4.6-lp152.2.21.1 php7-bz2-debuginfo-7.4.6-lp152.2.21.1 php7-calendar-7.4.6-lp152.2.21.1 php7-calendar-debuginfo-7.4.6-lp152.2.21.1 php7-ctype-7.4.6-lp152.2.21.1 php7-ctype-debuginfo-7.4.6-lp152.2.21.1 php7-curl-7.4.6-lp152.2.21.1 php7-curl-debuginfo-7.4.6-lp152.2.21.1 php7-dba-7.4.6-lp152.2.21.1 php7-dba-debuginfo-7.4.6-lp152.2.21.1 php7-debuginfo-7.4.6-lp152.2.21.1 php7-debugsource-7.4.6-lp152.2.21.1 php7-devel-7.4.6-lp152.2.21.1 php7-dom-7.4.6-lp152.2.21.1 php7-dom-debuginfo-7.4.6-lp152.2.21.1 php7-embed-7.4.6-lp152.2.21.1 php7-embed-debuginfo-7.4.6-lp152.2.21.1 php7-enchant-7.4.6-lp152.2.21.1 php7-enchant-debuginfo-7.4.6-lp152.2.21.1 php7-exif-7.4.6-lp152.2.21.1 php7-exif-debuginfo-7.4.6-lp152.2.21.1 php7-fastcgi-7.4.6-lp152.2.21.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.21.1 php7-fileinfo-7.4.6-lp152.2.21.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.21.1 php7-firebird-7.4.6-lp152.2.21.1 php7-firebird-debuginfo-7.4.6-lp152.2.21.1 php7-fpm-7.4.6-lp152.2.21.1 php7-fpm-debuginfo-7.4.6-lp152.2.21.1 php7-ftp-7.4.6-lp152.2.21.1 php7-ftp-debuginfo-7.4.6-lp152.2.21.1 php7-gd-7.4.6-lp152.2.21.1 php7-gd-debuginfo-7.4.6-lp152.2.21.1 php7-gettext-7.4.6-lp152.2.21.1 php7-gettext-debuginfo-7.4.6-lp152.2.21.1 php7-gmp-7.4.6-lp152.2.21.1 php7-gmp-debuginfo-7.4.6-lp152.2.21.1 php7-iconv-7.4.6-lp152.2.21.1 php7-iconv-debuginfo-7.4.6-lp152.2.21.1 php7-intl-7.4.6-lp152.2.21.1 php7-intl-debuginfo-7.4.6-lp152.2.21.1 php7-json-7.4.6-lp152.2.21.1 php7-json-debuginfo-7.4.6-lp152.2.21.1 php7-ldap-7.4.6-lp152.2.21.1 php7-ldap-debuginfo-7.4.6-lp152.2.21.1 php7-mbstring-7.4.6-lp152.2.21.1 php7-mbstring-debuginfo-7.4.6-lp152.2.21.1 php7-mysql-7.4.6-lp152.2.21.1 php7-mysql-debuginfo-7.4.6-lp152.2.21.1 php7-odbc-7.4.6-lp152.2.21.1 php7-odbc-debuginfo-7.4.6-lp152.2.21.1 php7-opcache-7.4.6-lp152.2.21.1 php7-opcache-debuginfo-7.4.6-lp152.2.21.1 php7-openssl-7.4.6-lp152.2.21.1 php7-openssl-debuginfo-7.4.6-lp152.2.21.1 php7-pcntl-7.4.6-lp152.2.21.1 php7-pcntl-debuginfo-7.4.6-lp152.2.21.1 php7-pdo-7.4.6-lp152.2.21.1 php7-pdo-debuginfo-7.4.6-lp152.2.21.1 php7-pgsql-7.4.6-lp152.2.21.1 php7-pgsql-debuginfo-7.4.6-lp152.2.21.1 php7-phar-7.4.6-lp152.2.21.1 php7-phar-debuginfo-7.4.6-lp152.2.21.1 php7-posix-7.4.6-lp152.2.21.1 php7-posix-debuginfo-7.4.6-lp152.2.21.1 php7-readline-7.4.6-lp152.2.21.1 php7-readline-debuginfo-7.4.6-lp152.2.21.1 php7-shmop-7.4.6-lp152.2.21.1 php7-shmop-debuginfo-7.4.6-lp152.2.21.1 php7-snmp-7.4.6-lp152.2.21.1 php7-snmp-debuginfo-7.4.6-lp152.2.21.1 php7-soap-7.4.6-lp152.2.21.1 php7-soap-debuginfo-7.4.6-lp152.2.21.1 php7-sockets-7.4.6-lp152.2.21.1 php7-sockets-debuginfo-7.4.6-lp152.2.21.1 php7-sodium-7.4.6-lp152.2.21.1 php7-sodium-debuginfo-7.4.6-lp152.2.21.1 php7-sqlite-7.4.6-lp152.2.21.1 php7-sqlite-debuginfo-7.4.6-lp152.2.21.1 php7-sysvmsg-7.4.6-lp152.2.21.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.21.1 php7-sysvsem-7.4.6-lp152.2.21.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.21.1 php7-sysvshm-7.4.6-lp152.2.21.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.21.1 php7-test-7.4.6-lp152.2.21.1 php7-tidy-7.4.6-lp152.2.21.1 php7-tidy-debuginfo-7.4.6-lp152.2.21.1 php7-tokenizer-7.4.6-lp152.2.21.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.21.1 php7-xmlreader-7.4.6-lp152.2.21.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.21.1 php7-xmlrpc-7.4.6-lp152.2.21.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.21.1 php7-xmlwriter-7.4.6-lp152.2.21.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.21.1 php7-xsl-7.4.6-lp152.2.21.1 php7-xsl-debuginfo-7.4.6-lp152.2.21.1 php7-zip-7.4.6-lp152.2.21.1 php7-zip-debuginfo-7.4.6-lp152.2.21.1 php7-zlib-7.4.6-lp152.2.21.1 php7-zlib-debuginfo-7.4.6-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1175508 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041 [View Less]

1 0

openSUSE-SU-2021:3996-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3996-1 Rating: moderate References: #1181836 Cross-References: CVE-2021-20176 CVSS scores: CVE-2021-20176 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20176 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: … [View More] openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20176: Fixed division by zero caused by processing crafted file (bsc#1181836). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3996=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ImageMagick-7.0.7.34-10.18.1 ImageMagick-config-7-SUSE-7.0.7.34-10.18.1 ImageMagick-config-7-upstream-7.0.7.34-10.18.1 ImageMagick-debuginfo-7.0.7.34-10.18.1 ImageMagick-debugsource-7.0.7.34-10.18.1 ImageMagick-devel-7.0.7.34-10.18.1 ImageMagick-extra-7.0.7.34-10.18.1 ImageMagick-extra-debuginfo-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 perl-PerlMagick-7.0.7.34-10.18.1 perl-PerlMagick-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (x86_64): ImageMagick-devel-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (noarch): ImageMagick-doc-7.0.7.34-10.18.1 References: https://www.suse.com/security/cve/CVE-2021-20176.html https://bugzilla.suse.com/1181836 [View Less]

1 0

openSUSE-SU-2021:3993-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3993-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: … [View More] CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3993=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.4.0-152.9.1 MozillaFirefox-branding-upstream-91.4.0-152.9.1 MozillaFirefox-debuginfo-91.4.0-152.9.1 MozillaFirefox-debugsource-91.4.0-152.9.1 MozillaFirefox-devel-91.4.0-152.9.1 MozillaFirefox-translations-common-91.4.0-152.9.1 MozillaFirefox-translations-other-91.4.0-152.9.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485 [View Less]

1 0

openSUSE-SU-2021:1566-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1566-1 Rating: moderate References: #1192830 Cross-References: CVE-2021-39920 CVE-2021-39921 CVE-2021-39922 CVE-2021-39924 CVE-2021-39925 CVE-2021-39926 CVE-2021-39928 CVE-2021-39929 CVSS scores: CVE-2021-39920 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/… [View More]PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39921 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39922 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39924 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39924 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39925 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39926 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39926 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39928 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39929 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Update to Wireshark 3.4.10: - CVE-2021-39920: IPPUSB dissector crash (bsc#1192830). - CVE-2021-39921: Modbus dissector crash (bsc#1192830). - CVE-2021-39922: C12.22 dissector crash (bsc#1192830). - CVE-2021-39924: Bluetooth DHT dissector large loop (bsc#1192830). - CVE-2021-39925: Bluetooth SDP dissector crash (bsc#1192830). - CVE-2021-39926: Bluetooth HCI_ISO dissector crash (bsc#1192830). - CVE-2021-39928: IEEE 802.11 dissector crash (bsc#1192830). - CVE-2021-39929: Bluetooth DHT dissector crash (bsc#1192830). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1566=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark14-3.4.10-lp152.2.21.1 libwireshark14-debuginfo-3.4.10-lp152.2.21.1 libwiretap11-3.4.10-lp152.2.21.1 libwiretap11-debuginfo-3.4.10-lp152.2.21.1 libwsutil12-3.4.10-lp152.2.21.1 libwsutil12-debuginfo-3.4.10-lp152.2.21.1 wireshark-3.4.10-lp152.2.21.1 wireshark-debuginfo-3.4.10-lp152.2.21.1 wireshark-debugsource-3.4.10-lp152.2.21.1 wireshark-devel-3.4.10-lp152.2.21.1 wireshark-ui-qt-3.4.10-lp152.2.21.1 wireshark-ui-qt-debuginfo-3.4.10-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-39920.html https://www.suse.com/security/cve/CVE-2021-39921.html https://www.suse.com/security/cve/CVE-2021-39922.html https://www.suse.com/security/cve/CVE-2021-39924.html https://www.suse.com/security/cve/CVE-2021-39925.html https://www.suse.com/security/cve/CVE-2021-39926.html https://www.suse.com/security/cve/CVE-2021-39928.html https://www.suse.com/security/cve/CVE-2021-39929.html https://bugzilla.suse.com/1192830 [View Less]

1 0

openSUSE-SU-2021:1560-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1560-1 Rating: moderate References: #1027496 #1183085 Cross-References: CVE-2016-10228 CVSS scores: CVE-2016-10228 (NVD) : 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2016-10228 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: … [View More] openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - libio: do not attempt to free wide buffers of legacy streams (bsc#1183085) - CVE-2016-10228: Rewrite iconv option parsing to fix security issue (bsc#1027496) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1560=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.12.1 glibc-debuginfo-2.26-lp152.26.12.1 glibc-debugsource-2.26-lp152.26.12.1 glibc-devel-2.26-lp152.26.12.1 glibc-devel-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-2.26-lp152.26.12.1 glibc-locale-2.26-lp152.26.12.1 glibc-locale-base-2.26-lp152.26.12.1 glibc-locale-base-debuginfo-2.26-lp152.26.12.1 glibc-profile-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.12.1 glibc-extra-debuginfo-2.26-lp152.26.12.1 glibc-utils-2.26-lp152.26.12.1 glibc-utils-debuginfo-2.26-lp152.26.12.1 glibc-utils-src-debugsource-2.26-lp152.26.12.1 nscd-2.26-lp152.26.12.1 nscd-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.12.1 glibc-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-32bit-2.26-lp152.26.12.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.12.1 glibc-profile-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.12.1 glibc-i18ndata-2.26-lp152.26.12.1 glibc-info-2.26-lp152.26.12.1 References: https://www.suse.com/security/cve/CVE-2016-10228.html https://bugzilla.suse.com/1027496 https://bugzilla.suse.com/1183085 [View Less]

1 0

openSUSE-SU-2021:1552-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1552-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: … [View More] CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1552=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.18.1-lp152.17.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.18.1-lp152.17.1 nodejs14-debuginfo-14.18.1-lp152.17.1 nodejs14-debugsource-14.18.1-lp152.17.1 nodejs14-devel-14.18.1-lp152.17.1 npm14-14.18.1-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602 [View Less]

1 0

openSUSE-SU-2021:1553-1: important: Security update for python-Babel
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for python-Babel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: #1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 … [View More]

1 0

openSUSE-SU-2021:1554-1: important: Security update for glib-networking
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glib-networking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1554-1 Rating: important References: #1172460 Cross-References: CVE-2020-13645 CVSS scores: CVE-2020-13645 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-13645 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: … [View More]

1 0

openSUSE-SU-2021:1557-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1557-1 Rating: important References: #1192063 Cross-References: CVE-2021-30846 CVE-2021-30851 CVSS scores: CVE-2021-30846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30846 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H … [View More] CVE-2021-30851 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). - CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1557=1 Package List: - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-2.34.1-lp152.2.25.3 libjavascriptcoregtk-4_0-18-debuginfo-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-2.34.1-lp152.2.25.3 libwebkit2gtk-4_0-37-debuginfo-2.34.1-lp152.2.25.3 typelib-1_0-JavaScriptCore-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2-4_0-2.34.1-lp152.2.25.3 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-lp152.2.25.3 webkit-jsc-4-2.34.1-lp152.2.25.3 webkit-jsc-4-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-2.34.1-lp152.2.25.3 webkit2gtk-4_0-injected-bundles-debuginfo-2.34.1-lp152.2.25.3 webkit2gtk3-debugsource-2.34.1-lp152.2.25.3 webkit2gtk3-devel-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-2.34.1-lp152.2.25.3 webkit2gtk3-minibrowser-debuginfo-2.34.1-lp152.2.25.3 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.34.1-lp152.2.25.3 References: https://www.suse.com/security/cve/CVE-2021-30846.html https://www.suse.com/security/cve/CVE-2021-30851.html https://bugzilla.suse.com/1192063 [View Less]

1 0

openSUSE-SU-2021:1550-1: moderate: Security update for hiredis
by opensuse-security＠opensuse.org 09 Dec '21

09 Dec '21

openSUSE Security Update: Security update for hiredis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1550-1 Rating: moderate References: #1191331 Cross-References: CVE-2021-32765 CVSS scores: CVE-2021-32765 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 … [View More]

1 0

openSUSE-SU-2021:3968-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3968-1 Rating: moderate References: #1027519 #1191363 #1192554 #1192557 #1192559 Cross-References: CVE-2021-28702 CVE-2021-28704 CVE-2021-28705 CVE-2021-28706 CVE-2021-28707 CVE-2021-28708 CVE-2021-28709 CVSS scores: CVE-2021-… [View More]28702 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-28704 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28705 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28705 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28706 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-28706 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28707 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28708 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28709 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363). - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557). - CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559). - CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554). - Update to Xen 4.14.3 bug fix release (bsc#1027519). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3968=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.3_04-3.15.1 xen-debugsource-4.14.3_04-3.15.1 xen-devel-4.14.3_04-3.15.1 xen-doc-html-4.14.3_04-3.15.1 xen-libs-4.14.3_04-3.15.1 xen-libs-debuginfo-4.14.3_04-3.15.1 xen-tools-4.14.3_04-3.15.1 xen-tools-debuginfo-4.14.3_04-3.15.1 xen-tools-domU-4.14.3_04-3.15.1 xen-tools-domU-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.3_04-3.15.1 xen-libs-32bit-debuginfo-4.14.3_04-3.15.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.3_04-3.15.1 References: https://www.suse.com/security/cve/CVE-2021-28702.html https://www.suse.com/security/cve/CVE-2021-28704.html https://www.suse.com/security/cve/CVE-2021-28705.html https://www.suse.com/security/cve/CVE-2021-28706.html https://www.suse.com/security/cve/CVE-2021-28707.html https://www.suse.com/security/cve/CVE-2021-28708.html https://www.suse.com/security/cve/CVE-2021-28709.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191363 https://bugzilla.suse.com/1192554 https://bugzilla.suse.com/1192557 https://bugzilla.suse.com/1192559 [View Less]

1 0

openSUSE-SU-2021:3964-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 07 Dec '21

07 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3964-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: … [View More] CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3964=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.18.1-15.21.2 nodejs14-debuginfo-14.18.1-15.21.2 nodejs14-debugsource-14.18.1-15.21.2 nodejs14-devel-14.18.1-15.21.2 npm14-14.18.1-15.21.2 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.18.1-15.21.2 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602 [View Less]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Security Announce