March 2021 - openSUSE Security Announce

openSUSE-SU-2021:0487-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 30 Mar '21

30 Mar '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0487-1 Rating: important References: #1183942 Cross-References: CVE-2021-23981 CVE-2021-23982 CVE-2021-23984 CVE-2021-23987 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox was updated to 78.9.0 ESR (MFSA 2021-11, bsc#1183942) * CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read * CVE-2021-23982: Internal network hosts could have been probed by a malicious webpage * CVE-2021-23984: Malicious extensions could have spoofed popup information * CVE-2021-23987: Memory safety bugs This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-487=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.9.0-lp152.2.52.1 MozillaFirefox-branding-upstream-78.9.0-lp152.2.52.1 MozillaFirefox-buildsymbols-78.9.0-lp152.2.52.1 MozillaFirefox-debuginfo-78.9.0-lp152.2.52.1 MozillaFirefox-debugsource-78.9.0-lp152.2.52.1 MozillaFirefox-devel-78.9.0-lp152.2.52.1 MozillaFirefox-translations-common-78.9.0-lp152.2.52.1 MozillaFirefox-translations-other-78.9.0-lp152.2.52.1 References: https://www.suse.com/security/cve/CVE-2021-23981.html https://www.suse.com/security/cve/CVE-2021-23982.html https://www.suse.com/security/cve/CVE-2021-23984.html https://www.suse.com/security/cve/CVE-2021-23987.html https://bugzilla.suse.com/1183942

1 0

openSUSE-SU-2021:0485-1: important: Security update for eclipse
by opensuse-security＠opensuse.org 30 Mar '21

30 Mar '21

openSUSE Security Update: Security update for eclipse ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0485-1 Rating: important References: #1183728 Cross-References: CVE-2020-27225 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for eclipse fixes the following issues: - CVE-2020-27225: Authenticate active help requests to the local help web server (bsc#1183728). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-485=1 Package List: - openSUSE Leap 15.2 (x86_64): eclipse-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-bootstrap-debugsource-4.9.0-lp152.3.3.1 eclipse-contributor-tools-4.9.0-lp152.3.3.1 eclipse-contributor-tools-bootstrap-4.9.0-lp152.3.3.1 eclipse-debuginfo-4.9.0-lp152.3.3.1 eclipse-debugsource-4.9.0-lp152.3.3.1 eclipse-equinox-osgi-4.9.0-lp152.3.3.1 eclipse-equinox-osgi-bootstrap-4.9.0-lp152.3.3.1 eclipse-pde-4.9.0-lp152.3.3.1 eclipse-pde-bootstrap-4.9.0-lp152.3.3.1 eclipse-platform-4.9.0-lp152.3.3.1 eclipse-platform-bootstrap-4.9.0-lp152.3.3.1 eclipse-platform-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-platform-debuginfo-4.9.0-lp152.3.3.1 eclipse-swt-4.9.0-lp152.3.3.1 eclipse-swt-bootstrap-4.9.0-lp152.3.3.1 eclipse-swt-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-swt-debuginfo-4.9.0-lp152.3.3.1 eclipse-tests-4.9.0-lp152.3.3.1 eclipse-tests-bootstrap-4.9.0-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): eclipse-jdt-4.9.0-lp152.3.3.1 eclipse-jdt-bootstrap-4.9.0-lp152.3.3.1 eclipse-p2-discovery-4.9.0-lp152.3.3.1 eclipse-p2-discovery-bootstrap-4.9.0-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-27225.html https://bugzilla.suse.com/1183728

1 0

openSUSE-SU-2021:0481-1: moderate: Security update for zstd
by opensuse-security＠opensuse.org 27 Mar '21

27 Mar '21

openSUSE Security Update: Security update for zstd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0481-1 Rating: moderate References: #1183370 #1183371 Cross-References: CVE-2021-24031 CVE-2021-24032 CVSS scores: CVE-2021-24031 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-24031 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-24032 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-24032 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zstd fixes the following issues: - CVE-2021-24031: Added read permissions to files while being compressed or uncompressed (bsc#1183371). - CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file (bsc#1183370). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-481=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libzstd-devel-1.4.4-lp152.2.3.1 libzstd-devel-static-1.4.4-lp152.2.3.1 libzstd1-1.4.4-lp152.2.3.1 libzstd1-debuginfo-1.4.4-lp152.2.3.1 zstd-1.4.4-lp152.2.3.1 zstd-debuginfo-1.4.4-lp152.2.3.1 zstd-debugsource-1.4.4-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libzstd1-32bit-1.4.4-lp152.2.3.1 libzstd1-32bit-debuginfo-1.4.4-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-24031.html https://www.suse.com/security/cve/CVE-2021-24032.html https://bugzilla.suse.com/1183370 https://bugzilla.suse.com/1183371

1 0

openSUSE-SU-2021:0482-1: moderate: Security update for evolution-data-server
by opensuse-security＠opensuse.org 27 Mar '21

27 Mar '21

openSUSE Security Update: Security update for evolution-data-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0482-1 Rating: moderate References: #1173910 #1174712 #1182882 Cross-References: CVE-2020-14928 CVE-2020-16117 CVSS scores: CVE-2020-14928 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-14928 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2020-16117 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-16117 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for evolution-data-server fixes the following issues: - CVE-2020-16117: Fix crash on malformed server response with minimal capabilities (bsc#1174712). - CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 (bsc#1173910). - Fix buffer overrun when parsing base64 data (bsc#1182882). This update for evolution-ews fixes the following issue: - Fix buffer overrun when parsing base64 data (bsc#1182882). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-482=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): evolution-data-server-3.34.4-lp152.2.3.1 evolution-data-server-debuginfo-3.34.4-lp152.2.3.1 evolution-data-server-debugsource-3.34.4-lp152.2.3.1 evolution-data-server-devel-3.34.4-lp152.2.3.1 libcamel-1_2-62-3.34.4-lp152.2.3.1 libcamel-1_2-62-debuginfo-3.34.4-lp152.2.3.1 libebackend-1_2-10-3.34.4-lp152.2.3.1 libebackend-1_2-10-debuginfo-3.34.4-lp152.2.3.1 libebook-1_2-20-3.34.4-lp152.2.3.1 libebook-1_2-20-debuginfo-3.34.4-lp152.2.3.1 libebook-contacts-1_2-3-3.34.4-lp152.2.3.1 libebook-contacts-1_2-3-debuginfo-3.34.4-lp152.2.3.1 libecal-2_0-1-3.34.4-lp152.2.3.1 libecal-2_0-1-debuginfo-3.34.4-lp152.2.3.1 libedata-book-1_2-26-3.34.4-lp152.2.3.1 libedata-book-1_2-26-debuginfo-3.34.4-lp152.2.3.1 libedata-cal-2_0-1-3.34.4-lp152.2.3.1 libedata-cal-2_0-1-debuginfo-3.34.4-lp152.2.3.1 libedataserver-1_2-24-3.34.4-lp152.2.3.1 libedataserver-1_2-24-debuginfo-3.34.4-lp152.2.3.1 libedataserverui-1_2-2-3.34.4-lp152.2.3.1 libedataserverui-1_2-2-debuginfo-3.34.4-lp152.2.3.1 typelib-1_0-Camel-1_2-3.34.4-lp152.2.3.1 typelib-1_0-EBackend-1_2-3.34.4-lp152.2.3.1 typelib-1_0-EBook-1_2-3.34.4-lp152.2.3.1 typelib-1_0-EBookContacts-1_2-3.34.4-lp152.2.3.1 typelib-1_0-ECal-2_0-3.34.4-lp152.2.3.1 typelib-1_0-EDataBook-1_2-3.34.4-lp152.2.3.1 typelib-1_0-EDataCal-2_0-3.34.4-lp152.2.3.1 typelib-1_0-EDataServer-1_2-3.34.4-lp152.2.3.1 typelib-1_0-EDataServerUI-1_2-3.34.4-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): evolution-data-server-lang-3.34.4-lp152.2.3.1 evolution-ews-lang-3.34.4-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): evolution-data-server-32bit-3.34.4-lp152.2.3.1 evolution-data-server-32bit-debuginfo-3.34.4-lp152.2.3.1 evolution-ews-3.34.4-lp152.2.3.1 evolution-ews-debuginfo-3.34.4-lp152.2.3.1 evolution-ews-debugsource-3.34.4-lp152.2.3.1 libcamel-1_2-62-32bit-3.34.4-lp152.2.3.1 libcamel-1_2-62-32bit-debuginfo-3.34.4-lp152.2.3.1 libebackend-1_2-10-32bit-3.34.4-lp152.2.3.1 libebackend-1_2-10-32bit-debuginfo-3.34.4-lp152.2.3.1 libebook-1_2-20-32bit-3.34.4-lp152.2.3.1 libebook-1_2-20-32bit-debuginfo-3.34.4-lp152.2.3.1 libebook-contacts-1_2-3-32bit-3.34.4-lp152.2.3.1 libebook-contacts-1_2-3-32bit-debuginfo-3.34.4-lp152.2.3.1 libecal-2_0-1-32bit-3.34.4-lp152.2.3.1 libecal-2_0-1-32bit-debuginfo-3.34.4-lp152.2.3.1 libedata-book-1_2-26-32bit-3.34.4-lp152.2.3.1 libedata-book-1_2-26-32bit-debuginfo-3.34.4-lp152.2.3.1 libedata-cal-2_0-1-32bit-3.34.4-lp152.2.3.1 libedata-cal-2_0-1-32bit-debuginfo-3.34.4-lp152.2.3.1 libedataserver-1_2-24-32bit-3.34.4-lp152.2.3.1 libedataserver-1_2-24-32bit-debuginfo-3.34.4-lp152.2.3.1 libedataserverui-1_2-2-32bit-3.34.4-lp152.2.3.1 libedataserverui-1_2-2-32bit-debuginfo-3.34.4-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14928.html https://www.suse.com/security/cve/CVE-2020-16117.html https://bugzilla.suse.com/1173910 https://bugzilla.suse.com/1174712 https://bugzilla.suse.com/1182882

1 0

openSUSE-SU-2021:0480-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 27 Mar '21

27 Mar '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0480-1 Rating: moderate References: #1175132 #1183333 Cross-References: CVE-2021-27918 CVSS scores: CVE-2021-27918 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.15 fixes the following issues: - go1.15.10 (released 2021-03-11) (bsc#1175132) - go1.15.9 (released 2021-03-10) (bsc#1175132) - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader (bsc#1183333). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-480=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.10-lp152.14.1 go1.15-doc-1.15.10-lp152.14.1 go1.15-race-1.15.10-lp152.14.1 References: https://www.suse.com/security/cve/CVE-2021-27918.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1183333

1 0

openSUSE-SU-2021:0476-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 26 Mar '21

26 Mar '21

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0476-1 Rating: important References: #1183852 Cross-References: CVE-2021-3449 CVSS scores: CVE-2021-3449 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_1 fixes the security issue: * CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension but includes a signature_algorithms_cert extension, then a NULL pointer dereference will result, leading to a crash and a denial of service attack. OpenSSL TLS clients are not impacted by this issue. [bsc#1183852] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-476=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_1-devel-1.1.1d-lp152.7.15.1 libopenssl1_1-1.1.1d-lp152.7.15.1 libopenssl1_1-debuginfo-1.1.1d-lp152.7.15.1 libopenssl1_1-hmac-1.1.1d-lp152.7.15.1 openssl-1_1-1.1.1d-lp152.7.15.1 openssl-1_1-debuginfo-1.1.1d-lp152.7.15.1 openssl-1_1-debugsource-1.1.1d-lp152.7.15.1 - openSUSE Leap 15.2 (noarch): openssl-1_1-doc-1.1.1d-lp152.7.15.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-lp152.7.15.1 libopenssl1_1-32bit-1.1.1d-lp152.7.15.1 libopenssl1_1-32bit-debuginfo-1.1.1d-lp152.7.15.1 libopenssl1_1-hmac-32bit-1.1.1d-lp152.7.15.1 References: https://www.suse.com/security/cve/CVE-2021-3449.html https://bugzilla.suse.com/1183852

1 0

openSUSE-SU-2021:0474-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0474-1 Rating: moderate References: #1183726 Cross-References: CVE-2021-28089 CVE-2021-28090 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.7 * https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html * Fix 2 denial of service security issues (boo#1183726) + Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089) + Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090) * Ship geoip files based on the IPFire Location Database This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-474=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.5.7-bp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-28089.html https://www.suse.com/security/cve/CVE-2021-28090.html https://bugzilla.suse.com/1183726

1 0

openSUSE-SU-2021:0471-1: important: Security update for ruby2.5
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0471-1 Rating: important References: #1177125 #1177222 Cross-References: CVE-2020-25613 CVSS scores: CVE-2020-25613 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-25613 (SUSE): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ruby2.5 fixes the following issues: - CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick (bsc#1177125). - Enable optimizations also on ARM64 (bsc#1177222) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-471=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libruby2_5-2_5-2.5.8-lp152.2.3.1 libruby2_5-2_5-debuginfo-2.5.8-lp152.2.3.1 ruby2.5-2.5.8-lp152.2.3.1 ruby2.5-debuginfo-2.5.8-lp152.2.3.1 ruby2.5-debugsource-2.5.8-lp152.2.3.1 ruby2.5-devel-2.5.8-lp152.2.3.1 ruby2.5-devel-extra-2.5.8-lp152.2.3.1 ruby2.5-doc-2.5.8-lp152.2.3.1 ruby2.5-stdlib-2.5.8-lp152.2.3.1 ruby2.5-stdlib-debuginfo-2.5.8-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): ruby2.5-doc-ri-2.5.8-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25613.html https://bugzilla.suse.com/1177125 https://bugzilla.suse.com/1177222

1 0

openSUSE-SU-2021:0472-1: important: Security update for libass
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0472-1 Rating: important References: #1177862 Cross-References: CVE-2020-26682 CVSS scores: CVE-2020-26682 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-26682 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-26682: Fixed a signed integer overflow in the call to outline_stroke() (bsc#1177862). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-472=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libass-debugsource-0.14.0-lp152.4.3.1 libass-devel-0.14.0-lp152.4.3.1 libass9-0.14.0-lp152.4.3.1 libass9-debuginfo-0.14.0-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libass9-32bit-0.14.0-lp152.4.3.1 libass9-32bit-debuginfo-0.14.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-26682.html https://bugzilla.suse.com/1177862

1 0

openSUSE-SU-2021:0473-1: important: Security update for hawk2
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0473-1 Rating: important References: #1179999 #1182165 #1182166 Cross-References: CVE-2020-35459 CVE-2021-25314 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25314 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for hawk2 fixes the following issues: - Update to version 2.6.3: * Remove hawk_invoke and use capture3 instead of runas (bsc#1179999)(CVE-2020-35459) * Remove unnecessary chmod (bsc#1182166)(CVE-2021-25314) * Sanitize filename to contains whitelist of alphanumeric (bsc#1182165) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-473=1 Package List: - openSUSE Leap 15.2 (x86_64): hawk2-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 hawk2-debuginfo-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 hawk2-debugsource-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-25314.html https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1182165 https://bugzilla.suse.com/1182166

1 0