December 2021 - openSUSE Security Announce

openSUSE-SU-2021:1575-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Dec '21

12 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1575-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1575=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-91.4.0-lp152.2.74.1 MozillaFirefox-branding-upstream-91.4.0-lp152.2.74.1 MozillaFirefox-debuginfo-91.4.0-lp152.2.74.1 MozillaFirefox-debugsource-91.4.0-lp152.2.74.1 MozillaFirefox-devel-91.4.0-lp152.2.74.1 MozillaFirefox-translations-common-91.4.0-lp152.2.74.1 MozillaFirefox-translations-other-91.4.0-lp152.2.74.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:1573-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1573-1 Rating: moderate References: #1188284 #1192346 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav fixes the following issues: - Update to 0.103.4 (bsc#1192346). - Update to 0.103.3 (bsc#1188284). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1573=1 Package List: - openSUSE Leap 15.2 (x86_64): clamav-0.103.4-lp152.6.12.1 clamav-debuginfo-0.103.4-lp152.6.12.1 clamav-debugsource-0.103.4-lp152.6.12.1 clamav-devel-0.103.4-lp152.6.12.1 libclamav9-0.103.4-lp152.6.12.1 libclamav9-debuginfo-0.103.4-lp152.6.12.1 libfreshclam2-0.103.4-lp152.6.12.1 libfreshclam2-debuginfo-0.103.4-lp152.6.12.1 References: https://bugzilla.suse.com/1188284 https://bugzilla.suse.com/1192346

1 0

openSUSE-SU-2021:1569-1: moderate: Security update for gmp
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for gmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1569-1 Rating: moderate References: #1192717 Cross-References: CVE-2021-43618 CVSS scores: CVE-2021-43618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43618 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gmp fixes the following issues: - CVE-2021-43618: Fixed buffer overflow via crafted input in mpz/inp_raw.c (bsc#1192717). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1569=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gmp-debugsource-6.1.2-lp152.6.6.1 gmp-devel-6.1.2-lp152.6.6.1 libgmp10-6.1.2-lp152.6.6.1 libgmp10-debuginfo-6.1.2-lp152.6.6.1 libgmpxx4-6.1.2-lp152.6.6.1 libgmpxx4-debuginfo-6.1.2-lp152.6.6.1 - openSUSE Leap 15.2 (x86_64): gmp-devel-32bit-6.1.2-lp152.6.6.1 libgmp10-32bit-6.1.2-lp152.6.6.1 libgmp10-32bit-debuginfo-6.1.2-lp152.6.6.1 libgmpxx4-32bit-6.1.2-lp152.6.6.1 libgmpxx4-32bit-debuginfo-6.1.2-lp152.6.6.1 References: https://www.suse.com/security/cve/CVE-2021-43618.html https://bugzilla.suse.com/1192717

1 0

openSUSE-SU-2021:1570-1: moderate: Recommended update for php7
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Recommended update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1570-1 Rating: moderate References: #1175508 #1192050 #1193041 Cross-References: CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1570=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-mod_php7-7.4.6-lp152.2.21.1 apache2-mod_php7-debuginfo-7.4.6-lp152.2.21.1 php7-7.4.6-lp152.2.21.1 php7-bcmath-7.4.6-lp152.2.21.1 php7-bcmath-debuginfo-7.4.6-lp152.2.21.1 php7-bz2-7.4.6-lp152.2.21.1 php7-bz2-debuginfo-7.4.6-lp152.2.21.1 php7-calendar-7.4.6-lp152.2.21.1 php7-calendar-debuginfo-7.4.6-lp152.2.21.1 php7-ctype-7.4.6-lp152.2.21.1 php7-ctype-debuginfo-7.4.6-lp152.2.21.1 php7-curl-7.4.6-lp152.2.21.1 php7-curl-debuginfo-7.4.6-lp152.2.21.1 php7-dba-7.4.6-lp152.2.21.1 php7-dba-debuginfo-7.4.6-lp152.2.21.1 php7-debuginfo-7.4.6-lp152.2.21.1 php7-debugsource-7.4.6-lp152.2.21.1 php7-devel-7.4.6-lp152.2.21.1 php7-dom-7.4.6-lp152.2.21.1 php7-dom-debuginfo-7.4.6-lp152.2.21.1 php7-embed-7.4.6-lp152.2.21.1 php7-embed-debuginfo-7.4.6-lp152.2.21.1 php7-enchant-7.4.6-lp152.2.21.1 php7-enchant-debuginfo-7.4.6-lp152.2.21.1 php7-exif-7.4.6-lp152.2.21.1 php7-exif-debuginfo-7.4.6-lp152.2.21.1 php7-fastcgi-7.4.6-lp152.2.21.1 php7-fastcgi-debuginfo-7.4.6-lp152.2.21.1 php7-fileinfo-7.4.6-lp152.2.21.1 php7-fileinfo-debuginfo-7.4.6-lp152.2.21.1 php7-firebird-7.4.6-lp152.2.21.1 php7-firebird-debuginfo-7.4.6-lp152.2.21.1 php7-fpm-7.4.6-lp152.2.21.1 php7-fpm-debuginfo-7.4.6-lp152.2.21.1 php7-ftp-7.4.6-lp152.2.21.1 php7-ftp-debuginfo-7.4.6-lp152.2.21.1 php7-gd-7.4.6-lp152.2.21.1 php7-gd-debuginfo-7.4.6-lp152.2.21.1 php7-gettext-7.4.6-lp152.2.21.1 php7-gettext-debuginfo-7.4.6-lp152.2.21.1 php7-gmp-7.4.6-lp152.2.21.1 php7-gmp-debuginfo-7.4.6-lp152.2.21.1 php7-iconv-7.4.6-lp152.2.21.1 php7-iconv-debuginfo-7.4.6-lp152.2.21.1 php7-intl-7.4.6-lp152.2.21.1 php7-intl-debuginfo-7.4.6-lp152.2.21.1 php7-json-7.4.6-lp152.2.21.1 php7-json-debuginfo-7.4.6-lp152.2.21.1 php7-ldap-7.4.6-lp152.2.21.1 php7-ldap-debuginfo-7.4.6-lp152.2.21.1 php7-mbstring-7.4.6-lp152.2.21.1 php7-mbstring-debuginfo-7.4.6-lp152.2.21.1 php7-mysql-7.4.6-lp152.2.21.1 php7-mysql-debuginfo-7.4.6-lp152.2.21.1 php7-odbc-7.4.6-lp152.2.21.1 php7-odbc-debuginfo-7.4.6-lp152.2.21.1 php7-opcache-7.4.6-lp152.2.21.1 php7-opcache-debuginfo-7.4.6-lp152.2.21.1 php7-openssl-7.4.6-lp152.2.21.1 php7-openssl-debuginfo-7.4.6-lp152.2.21.1 php7-pcntl-7.4.6-lp152.2.21.1 php7-pcntl-debuginfo-7.4.6-lp152.2.21.1 php7-pdo-7.4.6-lp152.2.21.1 php7-pdo-debuginfo-7.4.6-lp152.2.21.1 php7-pgsql-7.4.6-lp152.2.21.1 php7-pgsql-debuginfo-7.4.6-lp152.2.21.1 php7-phar-7.4.6-lp152.2.21.1 php7-phar-debuginfo-7.4.6-lp152.2.21.1 php7-posix-7.4.6-lp152.2.21.1 php7-posix-debuginfo-7.4.6-lp152.2.21.1 php7-readline-7.4.6-lp152.2.21.1 php7-readline-debuginfo-7.4.6-lp152.2.21.1 php7-shmop-7.4.6-lp152.2.21.1 php7-shmop-debuginfo-7.4.6-lp152.2.21.1 php7-snmp-7.4.6-lp152.2.21.1 php7-snmp-debuginfo-7.4.6-lp152.2.21.1 php7-soap-7.4.6-lp152.2.21.1 php7-soap-debuginfo-7.4.6-lp152.2.21.1 php7-sockets-7.4.6-lp152.2.21.1 php7-sockets-debuginfo-7.4.6-lp152.2.21.1 php7-sodium-7.4.6-lp152.2.21.1 php7-sodium-debuginfo-7.4.6-lp152.2.21.1 php7-sqlite-7.4.6-lp152.2.21.1 php7-sqlite-debuginfo-7.4.6-lp152.2.21.1 php7-sysvmsg-7.4.6-lp152.2.21.1 php7-sysvmsg-debuginfo-7.4.6-lp152.2.21.1 php7-sysvsem-7.4.6-lp152.2.21.1 php7-sysvsem-debuginfo-7.4.6-lp152.2.21.1 php7-sysvshm-7.4.6-lp152.2.21.1 php7-sysvshm-debuginfo-7.4.6-lp152.2.21.1 php7-test-7.4.6-lp152.2.21.1 php7-tidy-7.4.6-lp152.2.21.1 php7-tidy-debuginfo-7.4.6-lp152.2.21.1 php7-tokenizer-7.4.6-lp152.2.21.1 php7-tokenizer-debuginfo-7.4.6-lp152.2.21.1 php7-xmlreader-7.4.6-lp152.2.21.1 php7-xmlreader-debuginfo-7.4.6-lp152.2.21.1 php7-xmlrpc-7.4.6-lp152.2.21.1 php7-xmlrpc-debuginfo-7.4.6-lp152.2.21.1 php7-xmlwriter-7.4.6-lp152.2.21.1 php7-xmlwriter-debuginfo-7.4.6-lp152.2.21.1 php7-xsl-7.4.6-lp152.2.21.1 php7-xsl-debuginfo-7.4.6-lp152.2.21.1 php7-zip-7.4.6-lp152.2.21.1 php7-zip-debuginfo-7.4.6-lp152.2.21.1 php7-zlib-7.4.6-lp152.2.21.1 php7-zlib-debuginfo-7.4.6-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1175508 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041

1 0

openSUSE-SU-2021:3996-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3996-1 Rating: moderate References: #1181836 Cross-References: CVE-2021-20176 CVSS scores: CVE-2021-20176 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20176 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20176: Fixed division by zero caused by processing crafted file (bsc#1181836). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3996=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ImageMagick-7.0.7.34-10.18.1 ImageMagick-config-7-SUSE-7.0.7.34-10.18.1 ImageMagick-config-7-upstream-7.0.7.34-10.18.1 ImageMagick-debuginfo-7.0.7.34-10.18.1 ImageMagick-debugsource-7.0.7.34-10.18.1 ImageMagick-devel-7.0.7.34-10.18.1 ImageMagick-extra-7.0.7.34-10.18.1 ImageMagick-extra-debuginfo-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-10.18.1 perl-PerlMagick-7.0.7.34-10.18.1 perl-PerlMagick-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (x86_64): ImageMagick-devel-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-10.18.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-10.18.1 libMagick++-devel-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-10.18.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-10.18.1 - openSUSE Leap 15.3 (noarch): ImageMagick-doc-7.0.7.34-10.18.1 References: https://www.suse.com/security/cve/CVE-2021-20176.html https://bugzilla.suse.com/1181836

1 0

openSUSE-SU-2021:3993-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3993-1 Rating: important References: #1193321 #1193485 Cross-References: CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 (bsc#1193485): - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3993=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.4.0-152.9.1 MozillaFirefox-branding-upstream-91.4.0-152.9.1 MozillaFirefox-debuginfo-91.4.0-152.9.1 MozillaFirefox-debugsource-91.4.0-152.9.1 MozillaFirefox-devel-91.4.0-152.9.1 MozillaFirefox-translations-common-91.4.0-152.9.1 MozillaFirefox-translations-other-91.4.0-152.9.1 References: https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1193321 https://bugzilla.suse.com/1193485

1 0

openSUSE-SU-2021:1566-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1566-1 Rating: moderate References: #1192830 Cross-References: CVE-2021-39920 CVE-2021-39921 CVE-2021-39922 CVE-2021-39924 CVE-2021-39925 CVE-2021-39926 CVE-2021-39928 CVE-2021-39929 CVSS scores: CVE-2021-39920 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39921 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39922 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39924 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39924 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39925 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39926 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39926 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39928 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-39929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-39929 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: - Update to Wireshark 3.4.10: - CVE-2021-39920: IPPUSB dissector crash (bsc#1192830). - CVE-2021-39921: Modbus dissector crash (bsc#1192830). - CVE-2021-39922: C12.22 dissector crash (bsc#1192830). - CVE-2021-39924: Bluetooth DHT dissector large loop (bsc#1192830). - CVE-2021-39925: Bluetooth SDP dissector crash (bsc#1192830). - CVE-2021-39926: Bluetooth HCI_ISO dissector crash (bsc#1192830). - CVE-2021-39928: IEEE 802.11 dissector crash (bsc#1192830). - CVE-2021-39929: Bluetooth DHT dissector crash (bsc#1192830). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1566=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark14-3.4.10-lp152.2.21.1 libwireshark14-debuginfo-3.4.10-lp152.2.21.1 libwiretap11-3.4.10-lp152.2.21.1 libwiretap11-debuginfo-3.4.10-lp152.2.21.1 libwsutil12-3.4.10-lp152.2.21.1 libwsutil12-debuginfo-3.4.10-lp152.2.21.1 wireshark-3.4.10-lp152.2.21.1 wireshark-debuginfo-3.4.10-lp152.2.21.1 wireshark-debugsource-3.4.10-lp152.2.21.1 wireshark-devel-3.4.10-lp152.2.21.1 wireshark-ui-qt-3.4.10-lp152.2.21.1 wireshark-ui-qt-debuginfo-3.4.10-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-39920.html https://www.suse.com/security/cve/CVE-2021-39921.html https://www.suse.com/security/cve/CVE-2021-39922.html https://www.suse.com/security/cve/CVE-2021-39924.html https://www.suse.com/security/cve/CVE-2021-39925.html https://www.suse.com/security/cve/CVE-2021-39926.html https://www.suse.com/security/cve/CVE-2021-39928.html https://www.suse.com/security/cve/CVE-2021-39929.html https://bugzilla.suse.com/1192830

1 0

openSUSE-SU-2021:1560-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1560-1 Rating: moderate References: #1027496 #1183085 Cross-References: CVE-2016-10228 CVSS scores: CVE-2016-10228 (NVD) : 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2016-10228 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - libio: do not attempt to free wide buffers of legacy streams (bsc#1183085) - CVE-2016-10228: Rewrite iconv option parsing to fix security issue (bsc#1027496) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1560=1 Package List: - openSUSE Leap 15.2 (i586 i686 x86_64): glibc-2.26-lp152.26.12.1 glibc-debuginfo-2.26-lp152.26.12.1 glibc-debugsource-2.26-lp152.26.12.1 glibc-devel-2.26-lp152.26.12.1 glibc-devel-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-2.26-lp152.26.12.1 glibc-locale-2.26-lp152.26.12.1 glibc-locale-base-2.26-lp152.26.12.1 glibc-locale-base-debuginfo-2.26-lp152.26.12.1 glibc-profile-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (i586 x86_64): glibc-extra-2.26-lp152.26.12.1 glibc-extra-debuginfo-2.26-lp152.26.12.1 glibc-utils-2.26-lp152.26.12.1 glibc-utils-debuginfo-2.26-lp152.26.12.1 glibc-utils-src-debugsource-2.26-lp152.26.12.1 nscd-2.26-lp152.26.12.1 nscd-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (x86_64): glibc-32bit-2.26-lp152.26.12.1 glibc-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-32bit-2.26-lp152.26.12.1 glibc-devel-32bit-debuginfo-2.26-lp152.26.12.1 glibc-devel-static-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-2.26-lp152.26.12.1 glibc-locale-base-32bit-debuginfo-2.26-lp152.26.12.1 glibc-profile-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-2.26-lp152.26.12.1 glibc-utils-32bit-debuginfo-2.26-lp152.26.12.1 - openSUSE Leap 15.2 (noarch): glibc-html-2.26-lp152.26.12.1 glibc-i18ndata-2.26-lp152.26.12.1 glibc-info-2.26-lp152.26.12.1 References: https://www.suse.com/security/cve/CVE-2016-10228.html https://bugzilla.suse.com/1027496 https://bugzilla.suse.com/1183085

1 0

openSUSE-SU-2021:1552-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1552-1 Rating: important References: #1190053 #1190054 #1190055 #1190056 #1190057 #1191601 #1191602 Cross-References: CVE-2021-22959 CVE-2021-22960 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135 CVSS scores: CVE-2021-22959 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-22959 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-22960 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-37701 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37701 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-37712 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-37712 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39134 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE-2021-39134 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-39135 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: * deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959) - HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960) Changes in 14.18.0: * buffer: + introduce Blob + add base64url encoding option * child_process: + allow options.cwd receive a URL + add timeout to spawn and fork + allow promisified exec to be cancel + add 'overlapped' stdio flag * dns: add "tries" option to Resolve options * fs: + allow empty string for temp directory prefix + allow no-params fsPromises fileHandle read + add support for async iterators to fsPromises.writeFile * http2: add support for sensitive headers * process: add 'worker' event * tls: allow reading data into a static buffer * worker: add setEnvironmentData/getEnvironmentData Changes in 14.17.6 * deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1552=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.18.1-lp152.17.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.18.1-lp152.17.1 nodejs14-debuginfo-14.18.1-lp152.17.1 nodejs14-debugsource-14.18.1-lp152.17.1 nodejs14-devel-14.18.1-lp152.17.1 npm14-14.18.1-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-22959.html https://www.suse.com/security/cve/CVE-2021-22960.html https://www.suse.com/security/cve/CVE-2021-37701.html https://www.suse.com/security/cve/CVE-2021-37712.html https://www.suse.com/security/cve/CVE-2021-37713.html https://www.suse.com/security/cve/CVE-2021-39134.html https://www.suse.com/security/cve/CVE-2021-39135.html https://bugzilla.suse.com/1190053 https://bugzilla.suse.com/1190054 https://bugzilla.suse.com/1190055 https://bugzilla.suse.com/1190056 https://bugzilla.suse.com/1190057 https://bugzilla.suse.com/1191601 https://bugzilla.suse.com/1191602

1 0

openSUSE-SU-2021:1553-1: important: Security update for python-Babel
by opensuse-security＠opensuse.org 10 Dec '21

10 Dec '21

openSUSE Security Update: Security update for python-Babel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: #1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution (bsc#1185768). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1553=1 Package List: - openSUSE Leap 15.2 (noarch): python-Babel-doc-2.8.0-lp152.2.3.1 python2-Babel-2.8.0-lp152.2.3.1 python3-Babel-2.8.0-lp152.2.3.1 python3-Babel-doc-2.8.0-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-42771.html https://bugzilla.suse.com/1185768

1 0