December 2021 - openSUSE Security Announce

openSUSE-SU-2021:1591-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 17 Dec '21

17 Dec '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1591-1 Rating: moderate References: #1152964 #1174075 #1181400 #1188875 #1190069 #1190896 SLE-17903 SLE-18059 SLE-18159 Cross-References: CVE-2021-36386 CVE-2021-39272 CVSS scores: CVE-2021-36386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36386 (SUSE): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-39272 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities, contains three features and has four fixes is now available. Description: This update for fetchmail fixes the following issues: - CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875). - CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069). - Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059) - Remove all python2 dependencies (bsc#1190896). - De-hardcode /usr/lib path for launch executable (bsc#1174075). - Added hardening to systemd service(s) (bsc#1181400). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1591=1 Package List: - openSUSE Leap 15.2 (x86_64): fetchmail-6.4.22-lp152.6.12.1 fetchmail-debuginfo-6.4.22-lp152.6.12.1 fetchmail-debugsource-6.4.22-lp152.6.12.1 fetchmailconf-6.4.22-lp152.6.12.1 References: https://www.suse.com/security/cve/CVE-2021-36386.html https://www.suse.com/security/cve/CVE-2021-39272.html https://bugzilla.suse.com/1152964 https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1188875 https://bugzilla.suse.com/1190069 https://bugzilla.suse.com/1190896

1 0

openSUSE-SU-2021:4107-1: important: Security update for log4j
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4107-1 Rating: important References: #1193743 Cross-References: CVE-2021-44228 CVE-2021-45046 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-45046 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-45046 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for log4j fixes the following issue: - Previously published fixes for log4jshell turned out to be incomplete. Upstream has followed up on the original patch for CVE-2021-44228 with several additional changes (LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and LOG4J2-3211) that are included in this update. Since the totality of those patches is pretty much equivalent to an update to the latest version of log4j, we did update the package's tarball from version 2.13.0 to 2.16.0 instead of trying to apply those patches to the old version. This change brings in a new dependency on "jakarta-servlet" and a version update of "disruptor". [bsc#1193743, CVE-2021-45046] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4107=1 Package List: - openSUSE Leap 15.3 (noarch): disruptor-3.4.4-3.3.1 disruptor-javadoc-3.4.4-3.3.1 jakarta-servlet-5.0.0-5.3.1 jakarta-servlet-javadoc-5.0.0-5.3.1 log4j-2.16.0-4.10.1 log4j-javadoc-2.16.0-4.10.1 log4j-jcl-2.16.0-4.10.1 log4j-slf4j-2.16.0-4.10.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://www.suse.com/security/cve/CVE-2021-45046.html https://bugzilla.suse.com/1193743

1 0

openSUSE-SU-2021:1588-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1588-1 Rating: important References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for seamonkey fixes the following issues: update to SeaMonkey 2.53.10.1 * Security fix for NSS code bug 1737470. * Only use networks and servers in lower case in ChatZilla bug 1742502. * Change classic form icon in SeaMonkey composer bug 1710915. * Addition fixes for SeaMonkey 32x32 default icons on Windows and macOS bug 1729153. * SeaMonkey 2.53.10.1 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.10.1 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 91.4 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.10 * Minor fixes for testdisplay command in ChatZilla bug 1727976. * Show CTCP requests (excluding ACTION and DCC) bug 1722156. * IRCv3: Add support for server-time bug 1724586. * Add localization note for network editor dialog width in ChatZilla bug 1727977. * IRCv3: Add support for extended-join and account-notify bug 1722159. * Add ability to collapse message groups in ChatZilla bug 1724588. * Fix JS strict warnings in unescapeTagValue in ChatZilla bug 1727989. * IRCv3: Add support for invite-notify bug 1722161. * IRCv3: Add support for batch bug 1724589. * Fix JS strict warning in addHistory in cZ static.js bug 1727992. * IRCv3: Add support for cap-notify bug 1722162. * Stop using canonical name as collection keys in ChatZilla bug 1728025. * IRCv3: Add support for TLS and STS bug 1722166. * Helper function for renaming irc server properties in ChatZilla bug 1728027. * IRCv3: Add support for MONITOR bug 1722174. * Remove use of msg.commasp in ChatZilla bug 1726965. * Allow shiftKey to modify behaviour of link clicking in cZ bug 1713458. * IRCv3: Add support for echo-message bug 1722211. * In ChatZilla make /commands return all matches starting with pattern bug 1726966. * Use SeaMonkey prefs to determine how links behave in cZ bug 1713467. * Allow parameters to be localised in ChatZilla bug 1724105. * Add identify command to cZ and hook into password management bug 1713470. * IRCv3.1: Implement SASL with PLAIN mechanism bug 1717545. * IRCv3: Add support for message tags bug 1724584. * Add last read message divider to ChatZilla bug 1729159. * IRCv3: Add support for account-tag bug 1724585. * Missing option "text encoding Unicode/UTF-8" in preferences - Mailnews bug 1679260. * Detect Crashreporter using AppConstants in SeaMonkey bug 1735236. * Link about LEGACY extensions in Add-ons Manager is broken bug 1656797. * Update help for clear private data preferences and dialog bug 1728911. * Fix typo in cs_nav_prefs_appearance bug 1737473. * Drop leftover "Edit Menu" comment from messageWindow.xul and addressbook.xul bug 1725121. * Add dummy tab routines to SeaMonkey mailnews tab browser bug 1735243. * Folder pane and tab/window title not updated correctly when opening in new tab bug 1726940. * Allow mail tab bar to be controlled separately to browser tab bar bug 1724515. * Copy any user set values for new mail.tabs prefs bug 1729165. * Merge Master Passwords and Passwords pref panes into a single pref pane bug 1728099. * Move warning about redirection pref from Content to Privacy & Security pane bug 1728185. * Move website icons prefs from content pref pane to browser pref pane bug 1727425. * Move browser / mailnews system integration prefs into advanced pane bug 1727659. * Have separate opentabfor.middleclick for mailnews bug 1727948. * Add removeBrowser helper for tabbrowser bug 1730391. * Put <browser> in a <stack> so it's easy to overlay bug 1730392. * Allow browser focus to be avoided bug 1720003. * SeaMonkey 32x32 default icon has light stripe at the bottom bug 1729153. * Support <input type=time> and <input type=date> in SeaMonkey bug 1730408. * Middleclick on browser tab handled twice (closes tab and loads URL from primary or clipboard) bug 1734407. * Unable to create a new "Saved Search Folder" using "Save View as a Folder..." bug 1738669. * Enable compression for standard http connections bug 1728996. * Support VS2022 for compiling under Windows bug 1728988. * SeaMonkey 2.53.10 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.10 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.15 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.9.1 * Fix the lazy loading of images from some websites bug 1727967. * Move certain font family defaults from serif to sans serif bug 1727982. * SeaMonkey 2.53.9.1 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.9.1 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.14 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.9 * There is now an option to clear browser history during shutdown bug 1621445. * Uninstall plugin command for ChatZilla bug 541719. * Update icons used in ChatZilla status bar bug 1710238 and bug 1710249. * Make ChatZilla understand mIRC color code 99 bug 1710298. * Implement IRCv3 basic CAP negotiation bug 1717539 and CAP LIST and update CAP ACK and CAP LS bug 1710313. * Use Unicode instead of images for emojis in ChatZilla bug 1711375 and add some extra emojis bug 1711376. * Use SeaMonkey's configured web search rather than a separate one in ChatZilla bug 1712498. * Add a networks editor to ChatZilla bug 1716232. * Implement IRCv3 away-notify bug 1717543, chghost and userhost-in-names bug 1717544, self-messaging bug 1722212 and WHOX bug 1722214. * Link to SeaMonkey website in debugQA for verification sites and development section bug 1685606. * Send button should be disable until we have a recipient bug 104973. * Remove need to use a modifier for marking messages as unread bug 1719216. * SeaMonkey 2.53.9 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.9 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.13 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1588=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 x86_64): seamonkey-2.53.10.1-bp153.10.1 seamonkey-dom-inspector-2.53.10.1-bp153.10.1 seamonkey-irc-2.53.10.1-bp153.10.1 References:

1 0

openSUSE-SU-2021:4104-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 16 Dec '21

16 Dec '21

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4104-1 Rating: moderate References: #1180125 #1183374 #1183858 #1185588 #1187668 #1189241 #1189287 Cross-References: CVE-2021-3426 CVE-2021-3733 CVE-2021-3737 CVSS scores: CVE-2021-3426 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3426 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-3733 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3737 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This update for python3 fixes the following issues: - CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374). - CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241). - CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287). - We do not require python-rpm-macros package (bsc#1180125). - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858). - Stop providing "python" symbol, which means python2 currently (bsc#1185588). - Modify Lib/ensurepip/__init__.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4104=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-10.9.1 libpython3_6m1_0-debuginfo-3.6.15-10.9.1 python3-3.6.15-10.9.1 python3-base-3.6.15-10.9.1 python3-base-debuginfo-3.6.15-10.9.1 python3-core-debugsource-3.6.15-10.9.1 python3-curses-3.6.15-10.9.1 python3-curses-debuginfo-3.6.15-10.9.1 python3-dbm-3.6.15-10.9.1 python3-dbm-debuginfo-3.6.15-10.9.1 python3-debuginfo-3.6.15-10.9.1 python3-debugsource-3.6.15-10.9.1 python3-devel-3.6.15-10.9.1 python3-devel-debuginfo-3.6.15-10.9.1 python3-doc-3.6.15-10.9.1 python3-doc-devhelp-3.6.15-10.9.1 python3-idle-3.6.15-10.9.1 python3-testsuite-3.6.15-10.9.1 python3-testsuite-debuginfo-3.6.15-10.9.1 python3-tk-3.6.15-10.9.1 python3-tk-debuginfo-3.6.15-10.9.1 python3-tools-3.6.15-10.9.1 - openSUSE Leap 15.3 (x86_64): libpython3_6m1_0-32bit-3.6.15-10.9.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-10.9.1 References: https://www.suse.com/security/cve/CVE-2021-3426.html https://www.suse.com/security/cve/CVE-2021-3733.html https://www.suse.com/security/cve/CVE-2021-3737.html https://bugzilla.suse.com/1180125 https://bugzilla.suse.com/1183374 https://bugzilla.suse.com/1183858 https://bugzilla.suse.com/1185588 https://bugzilla.suse.com/1187668 https://bugzilla.suse.com/1189241 https://bugzilla.suse.com/1189287

1 0

openSUSE-SU-2021:1587-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1587-1 Rating: important References: #1193030 Cross-References: CVE-2021-4008 CVSS scores: CVE-2021-4008 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4008: Fixed Privilege Escalation Vulnerability via Out-Of-Bounds Access in SProcRenderCompositeGlyphs (bsc#1193030). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1587=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.33.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.33.1 xorg-x11-server-debugsource-1.20.3-lp152.8.33.1 xorg-x11-server-extra-1.20.3-lp152.8.33.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.33.1 xorg-x11-server-sdk-1.20.3-lp152.8.33.1 xorg-x11-server-source-1.20.3-lp152.8.33.1 xorg-x11-server-wayland-1.20.3-lp152.8.33.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.33.1 References: https://www.suse.com/security/cve/CVE-2021-4008.html https://bugzilla.suse.com/1193030

1 0

openSUSE-SU-2021:1586-1: important: Security update for log4j
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1586-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issue: CVE-2021-44228: The previously published fix by upstream turned out to be incomplete. Therefore, upstream has recommended disabling JNDI support in log4j by default to be completely sure that this vulnerability cannot be exploited. This update implements that recommendation and disables JNDI support by default. [bsc#1193611, CVE-2021-44228] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1586=1 Package List: - openSUSE Leap 15.2 (noarch): log4j-2.13.0-lp152.3.6.1 log4j-javadoc-2.13.0-lp152.3.6.1 log4j-jcl-2.13.0-lp152.3.6.1 log4j-slf4j-2.13.0-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:1585-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1585-1 Rating: moderate References: #1192712 Cross-References: CVE-2021-41259 CVSS scores: CVE-2021-41259 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nim fixes the following issues: - CVE-2021-41259: Fixed vulnerability in URL parser that allowed a null byte bypass (boo#1192712) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1585=1 Package List: - openSUSE Leap 15.2 (x86_64): nim-1.2.12-lp152.2.6.1 nim-debuginfo-1.2.12-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-41259.html https://bugzilla.suse.com/1192712

1 0

openSUSE-SU-2021:1584-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 15 Dec '21

15 Dec '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1584-1 Rating: important References: #1192516 Cross-References: CVE-2021-23214 CVE-2021-23222 CVSS scores: CVE-2021-23214 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-23222 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1584=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): postgresql10-10.19-lp152.2.27.1 postgresql10-contrib-10.19-lp152.2.27.1 postgresql10-contrib-debuginfo-10.19-lp152.2.27.1 postgresql10-debuginfo-10.19-lp152.2.27.1 postgresql10-debugsource-10.19-lp152.2.27.1 postgresql10-devel-10.19-lp152.2.27.1 postgresql10-devel-debuginfo-10.19-lp152.2.27.1 postgresql10-plperl-10.19-lp152.2.27.1 postgresql10-plperl-debuginfo-10.19-lp152.2.27.1 postgresql10-plpython-10.19-lp152.2.27.1 postgresql10-plpython-debuginfo-10.19-lp152.2.27.1 postgresql10-pltcl-10.19-lp152.2.27.1 postgresql10-pltcl-debuginfo-10.19-lp152.2.27.1 postgresql10-server-10.19-lp152.2.27.1 postgresql10-server-debuginfo-10.19-lp152.2.27.1 postgresql10-test-10.19-lp152.2.27.1 - openSUSE Leap 15.2 (noarch): postgresql10-docs-10.19-lp152.2.27.1 References: https://www.suse.com/security/cve/CVE-2021-23214.html https://www.suse.com/security/cve/CVE-2021-23222.html https://bugzilla.suse.com/1192516

1 0

openSUSE-SU-2021:4094-1: important: Security update for log4j
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4094-1 Rating: important References: #1193611 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issue: CVE-2021-44228: The previously published fix by upstream turned out to be incomplete. Therefore, upstream has recommended disabling JNDI support in log4j by default to be completely sure that this vulnerability cannot be exploited. This update implements that recommendation and disables JNDI support by default. [bsc#1193611, CVE-2021-44228] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4094=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.13.0-4.6.1 log4j-javadoc-2.13.0-4.6.1 log4j-jcl-2.13.0-4.6.1 log4j-slf4j-2.13.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2021-44228.html https://bugzilla.suse.com/1193611

1 0

openSUSE-SU-2021:4063-1: important: Security update for icu.691
by opensuse-security＠opensuse.org 14 Dec '21

14 Dec '21

openSUSE Security Update: Security update for icu.691 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4063-1 Rating: important References: #1158955 #1159131 #1161007 #1162882 #1167603 #1182252 #1182645 SLE-17893 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes and contains one feature can now be installed. Description: This update for icu.691 fixes the following issues: - Renamed package from icu 69.1 for SUSE:SLE-15-SP3:Update. (jsc#SLE-17893) - Fix undefined behaviour in 'ComplexUnitsConverter::applyRounder' - Update to release 69.1 - For Norwegian, "no" is back to being the canonical code, with "nb" treated as equivalent. This aligns handling of Norwegian with other macro language codes. - Binary prefixes in measurement units (KiB, MiB, etc.) - Time zone offsets from local time with new APIs. - Don't disable testsuite under 'qemu-linux-user' - Fixed an issue when ICU test on 'aarch64 fails. (bsc#1182645) - Drop 'SUSE_ASNEEDED' as the issue was in binutils. (bsc#1182252) - Fix 'pthread' dependency issue. (bsc#1182252) - Update to release 68.2 - Fix memory problem in 'FormattedStringBuilder' - Fix assertion when 'setKeywordValue w/' long value. - Fix UBSan breakage on 8bit of rbbi - fix int32_t overflow in listFormat - Fix memory handling in MemoryPool::operator=() - Fix memory leak in AliasReplacer - Add back icu.keyring. - Update to release 68.1 - PluralRules selection for ranges of numbers - Locale ID canonicalization now conforms to the CLDR spec including edge cases - DateIntervalFormat supports output options such as capitalization - Measurement units are normalized in skeleton string output - Time zone data (tzdata) version 2020d - Add the provides for libicu to Make .Net core can install successfully. (bsc#1167603, bsc#1161007) - Update to version 67.1 - Unicode 13 (ICU-20893, same as in ICU 66) - Total of 5930 new characters - 4 new scripts - 55 new emoji characters, plus additional new sequences - New CJK extension, first characters in plane 3: U+30000..U+3134A - New language at Modern coverage: Nigerian Pidgin - New languages at Basic coverage: Fulah (Adlam), Maithili, Manipuri, Santali, Sindhi (Devanagari), Sundanese - Region containment: EU no longer includes GB - Unicode 13 root collation data and Chinese data for collation and transliteration - DateTimePatternGenerator now obeys the "hc" preference in the locale identifier - Various other improvements for ECMA-402 conformance - Number skeletons have a new "concise" form that can be used in MessageFormat strings - Currency formatting options for formal and other currency display name variants - ListFormatter: new public API to select the style & type - ListFormatter now selects the proper ��and��/��or�� form for Spanish & Hebrew. - Locale ID canonicalization upgraded to implement the complete CLDR spec. - LocaleMatcher: New option to ignore one-way matches - acceptLanguage() reimplemented via LocaleMatcher - Data build tool: tzdbNames.res moved from the "zone_tree" category to the "zone_supplemental" category - Fixed uses of u8"literals" broken by the C++20 introduction of the incompatible char8_t type - and added a few API overloads to reduce the need for reinterpret_cast. - Support for manipulating CLDR 37 unit identifiers in MeasureUnit. - Drop icu-versioning. (bsc#1159131) - Update to version 66.1 - Unicode 13 support - Fix uses of u8"literals" broken by C++20 introduction of incompatible char8_t type. - Fixed an issue when Qt apps can't handle non-ASCII filesystem path. ([bsc#1162882) - Remove '/usr/lib(64)/icu/current'. (bsc#1158955) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4063=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): icu.691-69.1-7.3.2 icu.691-debuginfo-69.1-7.3.2 icu.691-debugsource-69.1-7.3.2 icu.691-devel-69.1-7.3.2 icu.691-doc-69.1-7.3.2 libicu69-69.1-7.3.2 libicu69-debuginfo-69.1-7.3.2 - openSUSE Leap 15.3 (noarch): libicu69-bedata-69.1-7.3.2 libicu69-ledata-69.1-7.3.2 References: https://bugzilla.suse.com/1158955 https://bugzilla.suse.com/1159131 https://bugzilla.suse.com/1161007 https://bugzilla.suse.com/1162882 https://bugzilla.suse.com/1167603 https://bugzilla.suse.com/1182252 https://bugzilla.suse.com/1182645

1 0