March 2021 - openSUSE Security Announce

openSUSE-SU-2021:0468-1: important: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0468-1 Rating: important References: #1172442 #1181358 Cross-References: CVE-2020-11080 CVSS scores: CVE-2020-11080 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-11080 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: - CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-468=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libnghttp2-14-1.40.0-lp152.2.6.1 libnghttp2-14-debuginfo-1.40.0-lp152.2.6.1 libnghttp2-devel-1.40.0-lp152.2.6.1 libnghttp2_asio-devel-1.40.0-lp152.2.6.1 libnghttp2_asio1-1.40.0-lp152.2.6.1 libnghttp2_asio1-debuginfo-1.40.0-lp152.2.6.1 nghttp2-1.40.0-lp152.2.6.1 nghttp2-debuginfo-1.40.0-lp152.2.6.1 nghttp2-debugsource-1.40.0-lp152.2.6.1 nghttp2-python-debugsource-1.40.0-lp152.2.6.1 python3-nghttp2-1.40.0-lp152.2.6.1 python3-nghttp2-debuginfo-1.40.0-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): libnghttp2-14-32bit-1.40.0-lp152.2.6.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp152.2.6.1 libnghttp2_asio1-32bit-1.40.0-lp152.2.6.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-11080.html https://bugzilla.suse.com/1172442 https://bugzilla.suse.com/1181358

1 0

openSUSE-SU-2021:0470-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0470-1 Rating: important References: #1183456 #1183457 Cross-References: CVE-2021-20231 CVE-2021-20232 CVSS scores: CVE-2021-20231 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20231 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-20232 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20232 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gnutls fixes the following issues: - CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183456). - CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183457). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-470=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnutls-3.6.7-lp152.9.9.1 gnutls-debuginfo-3.6.7-lp152.9.9.1 gnutls-debugsource-3.6.7-lp152.9.9.1 gnutls-guile-3.6.7-lp152.9.9.1 gnutls-guile-debuginfo-3.6.7-lp152.9.9.1 libgnutls-dane-devel-3.6.7-lp152.9.9.1 libgnutls-dane0-3.6.7-lp152.9.9.1 libgnutls-dane0-debuginfo-3.6.7-lp152.9.9.1 libgnutls-devel-3.6.7-lp152.9.9.1 libgnutls30-3.6.7-lp152.9.9.1 libgnutls30-debuginfo-3.6.7-lp152.9.9.1 libgnutls30-hmac-3.6.7-lp152.9.9.1 libgnutlsxx-devel-3.6.7-lp152.9.9.1 libgnutlsxx28-3.6.7-lp152.9.9.1 libgnutlsxx28-debuginfo-3.6.7-lp152.9.9.1 - openSUSE Leap 15.2 (x86_64): libgnutls-devel-32bit-3.6.7-lp152.9.9.1 libgnutls30-32bit-3.6.7-lp152.9.9.1 libgnutls30-32bit-debuginfo-3.6.7-lp152.9.9.1 libgnutls30-hmac-32bit-3.6.7-lp152.9.9.1 References: https://www.suse.com/security/cve/CVE-2021-20231.html https://www.suse.com/security/cve/CVE-2021-20232.html https://bugzilla.suse.com/1183456 https://bugzilla.suse.com/1183457

1 0

openSUSE-SU-2021:0469-1: important: Security update for ldb
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for ldb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0469-1 Rating: important References: #1183572 #1183574 Cross-References: CVE-2020-27840 CVE-2021-20277 CVSS scores: CVE-2020-27840 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20277 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ldb fixes the following issues: - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572). - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-469=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ldb-debugsource-2.0.12-lp152.2.9.1 ldb-tools-2.0.12-lp152.2.9.1 ldb-tools-debuginfo-2.0.12-lp152.2.9.1 libldb-devel-2.0.12-lp152.2.9.1 libldb2-2.0.12-lp152.2.9.1 libldb2-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-2.0.12-lp152.2.9.1 python3-ldb-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-devel-2.0.12-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): libldb2-32bit-2.0.12-lp152.2.9.1 libldb2-32bit-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-32bit-2.0.12-lp152.2.9.1 python3-ldb-32bit-debuginfo-2.0.12-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-27840.html https://www.suse.com/security/cve/CVE-2021-20277.html https://bugzilla.suse.com/1183572 https://bugzilla.suse.com/1183574

1 0

openSUSE-SU-2021:0462-1: important: Security update for grub2
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0462-1 Rating: important References: #1175970 #1176711 #1177883 #1179264 #1179265 #1182057 #1182262 #1182263 #1183073 Cross-References: CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 CVSS scores: CVE-2020-14372 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-14372 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25632 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25632 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25647 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-25647 (SUSE): 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-27749 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-27749 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-27779 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-27779 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20225 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20225 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20233 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20233 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for grub2 fixes the following issues: grub2 implements the new "SBAT" method for SHIM based secure boot revocation. (bsc#1182057) - CVE-2020-25632: Fixed a use-after-free in rmmod command (bsc#1176711) - CVE-2020-25647: Fixed an out-of-bound write in grub_usb_device_initialize() (bsc#1177883) - CVE-2020-27749: Fixed a stack buffer overflow in grub_parser_split_cmdline (bsc#1179264) - CVE-2020-27779, CVE-2020-14372: Disallow cutmem and acpi commands in secure boot mode (bsc#1179265 bsc#1175970) - CVE-2021-20225: Fixed a heap out-of-bounds write in short form option parser (bsc#1182262) - CVE-2021-20233: Fixed a heap out-of-bound write due to mis-calculation of space required for quoting (bsc#1182263) - Fixed chainloading windows on dual boot machine (bsc#1183073) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-462=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): grub2-2.04-lp152.7.22.7 grub2-branding-upstream-2.04-lp152.7.22.7 grub2-debuginfo-2.04-lp152.7.22.7 grub2-debugsource-2.04-lp152.7.22.7 - openSUSE Leap 15.2 (noarch): grub2-i386-efi-2.04-lp152.7.22.7 grub2-i386-efi-debug-2.04-lp152.7.22.7 grub2-i386-pc-2.04-lp152.7.22.7 grub2-i386-pc-debug-2.04-lp152.7.22.7 grub2-i386-xen-2.04-lp152.7.22.7 grub2-snapper-plugin-2.04-lp152.7.22.7 grub2-systemd-sleep-plugin-2.04-lp152.7.22.7 grub2-x86_64-efi-2.04-lp152.7.22.7 grub2-x86_64-efi-debug-2.04-lp152.7.22.7 grub2-x86_64-xen-2.04-lp152.7.22.7 References: https://www.suse.com/security/cve/CVE-2020-14372.html https://www.suse.com/security/cve/CVE-2020-25632.html https://www.suse.com/security/cve/CVE-2020-25647.html https://www.suse.com/security/cve/CVE-2020-27749.html https://www.suse.com/security/cve/CVE-2020-27779.html https://www.suse.com/security/cve/CVE-2021-20225.html https://www.suse.com/security/cve/CVE-2021-20233.html https://bugzilla.suse.com/1175970 https://bugzilla.suse.com/1176711 https://bugzilla.suse.com/1177883 https://bugzilla.suse.com/1179264 https://bugzilla.suse.com/1179265 https://bugzilla.suse.com/1182057 https://bugzilla.suse.com/1182262 https://bugzilla.suse.com/1182263 https://bugzilla.suse.com/1183073

1 0

openSUSE-SU-2021:0460-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0460-1 Rating: moderate References: #1183129 Cross-References: CVE-2021-20272 CVE-2021-20273 CVE-2021-20274 CVE-2021-20275 CVE-2021-20276 CVSS scores: CVE-2021-20272 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20273 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20274 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20275 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20276 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for privoxy fixes the following issues: Update to version 3.0.32: - Security/Reliability (boo#1183129) - ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera) - cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera) - socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera) - chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera) - Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera) - Bug fixes: - Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera) - decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera). - decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment. - decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera) - gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera). - buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour "applying zero offset to null pointer". Reported by: Joshua Rogers (Opera) - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera). - Respect DESTDIR when considering whether or not to install config files with ".new" extension. - OpenSSL ssl_store_cert(): Fix two error messages. - Fix a couple of format specifiers. - Silence compiler warnings when compiling with NDEBUG. - fuzz_server_header(): Fix compiler warning. - fuzz_client_header(): Fix compiler warning. - cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file. - General improvements: - Log the TLS version and the the cipher when debug 2 is enabled. - ssl_send_certificate_error(): Respect HEAD requests by not sending a body. - ssl_send_certificate_error(): End the body with a single new line. - serve(): Increase the chances that the host is logged when closing a server socket. - handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera). - decompress_iob(): Add periods to a couple of log messages - Terminate the body of the HTTP snipplets with a single new line instead of "\r\n". - configure: Add --with-assertions option and only enable assertions when it is used - windows build: Use --with-brotli and --with-mbedtls by default and enable dynamic error checking. - gif_deanimate(): Confirm we've got an image before trying to write it Saves a pointless buf_copy() call. - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number. - Action file improvements: - Disable fast-redirects for .golem.de/ - Unblock requests to adri*. - Block requests for trc*.taboola.com/ - Disable fast-redirects for .linkedin.com/ - Filter file improvements: - Make the second pcrs job of the img-reorder filter greedy again. The ungreedy version broke the img tags on: https://bulk.fefe.de/scalability/. - Privoxy-Log-Parser: - Highlight a few more messages. - Clarify the --statistics output. The shown "Reused connections" are server connections so name them appropriately. - Bump version to 0.9.3. - Privoxy-Regression-Test: - Add the --check-bad-ssl option to the --help output. - Bump version to 0.7.3. - Documentation: - Add pushing the created tag to the release steps in the developer manual. - Clarify that 'debug 32768' should be used in addition to the other debug directives when reporting problems. - Add a 'Third-party licenses and copyrights' section to the user manual. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-460=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): privoxy-3.0.32-bp152.4.9.1 - openSUSE Backports SLE-15-SP2 (noarch): privoxy-doc-3.0.32-bp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2021-20272.html https://www.suse.com/security/cve/CVE-2021-20273.html https://www.suse.com/security/cve/CVE-2021-20274.html https://www.suse.com/security/cve/CVE-2021-20275.html https://www.suse.com/security/cve/CVE-2021-20276.html https://bugzilla.suse.com/1183129

1 0

openSUSE-SU-2021:0459-1: moderate: Security update for libmysofa
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for libmysofa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0459-1 Rating: moderate References: #1149919 #1149920 #1149922 #1149924 #1149926 #1159839 #1160040 #1181977 #1181978 #1181979 #1181980 #1181981 #1182883 Cross-References: CVE-2019-16091 CVE-2019-16092 CVE-2019-16093 CVE-2019-16094 CVE-2019-16095 CVE-2019-20016 CVE-2019-20063 CVE-2020-36148 CVE-2020-36149 CVE-2020-36150 CVE-2020-36151 CVE-2020-36152 CVE-2020-6860 CVSS scores: CVE-2019-16091 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-16092 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16093 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16094 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-16095 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-20016 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20063 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-36148 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36149 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36150 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36151 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36152 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-6860 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for libmysofa fixes the following issues: - Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883 Update to version 0.9.1 * Extended angular neighbor search to 'close the sphere' * Added and exposed mysofa_getfilter_float_nointerp method * Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-459=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libmysofa-devel-0.9.1-bp152.4.3.1 libmysofa0-0.9.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libmysofa0-64bit-0.9.1-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16091.html https://www.suse.com/security/cve/CVE-2019-16092.html https://www.suse.com/security/cve/CVE-2019-16093.html https://www.suse.com/security/cve/CVE-2019-16094.html https://www.suse.com/security/cve/CVE-2019-16095.html https://www.suse.com/security/cve/CVE-2019-20016.html https://www.suse.com/security/cve/CVE-2019-20063.html https://www.suse.com/security/cve/CVE-2020-36148.html https://www.suse.com/security/cve/CVE-2020-36149.html https://www.suse.com/security/cve/CVE-2020-36150.html https://www.suse.com/security/cve/CVE-2020-36151.html https://www.suse.com/security/cve/CVE-2020-36152.html https://www.suse.com/security/cve/CVE-2020-6860.html https://bugzilla.suse.com/1149919 https://bugzilla.suse.com/1149920 https://bugzilla.suse.com/1149922 https://bugzilla.suse.com/1149924 https://bugzilla.suse.com/1149926 https://bugzilla.suse.com/1159839 https://bugzilla.suse.com/1160040 https://bugzilla.suse.com/1181977 https://bugzilla.suse.com/1181978 https://bugzilla.suse.com/1181979 https://bugzilla.suse.com/1181980 https://bugzilla.suse.com/1181981 https://bugzilla.suse.com/1182883

1 0

openSUSE-SU-2021:0461-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0461-1 Rating: moderate References: #1183726 Cross-References: CVE-2021-28089 CVE-2021-28090 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.7 * https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html * Fix 2 denial of service security issues (boo#1183726) + Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089) + Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090) * Ship geoip files based on the IPFire Location Database Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-461=1 Package List: - openSUSE Leap 15.2 (x86_64): tor-0.4.5.7-lp152.2.9.1 tor-debuginfo-0.4.5.7-lp152.2.9.1 tor-debugsource-0.4.5.7-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-28089.html https://www.suse.com/security/cve/CVE-2021-28090.html https://bugzilla.suse.com/1183726

1 0

openSUSE-SU-2021:0452-1: moderate: Security update for connman
by opensuse-security＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Security Update: Security update for connman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: #1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for connman fixes the following issues: Update to 1.39 (boo#1181751): * Fix issue with scanning state synchronization and iwd. * Fix issue with invalid key with 4-way handshake offloading. * Fix issue with DNS proxy length checks to prevent buffer overflow. (CVE-2021-26675) * Fix issue with DHCP leaking stack data via uninitialized variable. (CVE-2021-26676) Update to 1.38: * Fix issue with online check on IP address update. * Fix issue with OpenVPN and encrypted private keys. * Fix issue with finishing of VPN connections. * Add support for updated stable iwd APIs. * Add support for WireGuard networks. Update to 1.37: * Fix issue with handling invalid gateway addresses. * Fix issue with handling updates of default gateway. * Fix issue with DHCP servers that require broadcast flag. * Add support for option to use gateways as time servers. * Add support for option to select default technology. * Add support for Address Conflict Detection (ACD). * Add support for IPv6 iptables management. Change in 1.36: * Fix issue with DNS short response on error handling. * Fix issue with handling incoming DNS requests. * Fix issue with handling empty timeserver list. * Fix issue with incorrect DHCP byte order. * Fix issue with AllowDomainnameUpdates handling. * Fix issue with IPv4 link-local IP conflict error. * Fix issue with handling WISPr over TLS connections. * Fix issue with WiFi background scanning handling. * Fix issue with WiFi disconnect+connect race condition. * Fix issue with WiFi scanning and tethering operation. * Fix issue with WiFi security change handling. * Fix issue with missing signal for WPS changes. * Fix issue with online check retry handling. * Add support for systemd-resolved backend. * Add support for mDNS configuration setup. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-452=1 Package List: - openSUSE Backports SLE-15-SP2 (x86_64): connman-1.39-bp152.4.3.1 connman-client-1.39-bp152.4.3.1 connman-devel-1.39-bp152.4.3.1 connman-doc-1.39-bp152.4.3.1 connman-nmcompat-1.39-bp152.4.3.1 connman-plugin-hh2serial-gps-1.39-bp152.4.3.1 connman-plugin-iospm-1.39-bp152.4.3.1 connman-plugin-l2tp-1.39-bp152.4.3.1 connman-plugin-openconnect-1.39-bp152.4.3.1 connman-plugin-openvpn-1.39-bp152.4.3.1 connman-plugin-polkit-1.39-bp152.4.3.1 connman-plugin-pptp-1.39-bp152.4.3.1 connman-plugin-tist-1.39-bp152.4.3.1 connman-plugin-vpnc-1.39-bp152.4.3.1 connman-plugin-wireguard-1.39-bp152.4.3.1 connman-test-1.39-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-26675.html https://www.suse.com/security/cve/CVE-2021-26676.html https://bugzilla.suse.com/1181751

1 0

openSUSE-SU-2021:0451-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0451-1 Rating: moderate References: #1171379 #1181270 #1183171 Cross-References: CVE-2021-26813 CVSS scores: CVE-2021-26813 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for python-markdown2 fixes the following issues: Update to 2.4.0 (boo#1181270): - [pull #377] Fixed bug breaking strings elements in metadata lists - [pull #380] When rendering fenced code blocks, also add the language-LANG class - [pull #387] Regex DoS fixes (CVE-2021-26813, boo#1183171) - Switch off failing tests (gh#trentm/python-markdown2#388), ignore failing test suite. update to 2.3.9: - [pull #335] Added header support for wiki tables - [pull #336] Reset _toc when convert is run - [pull #353] XSS fix - [pull #350] XSS fix - Add patch to fix unsanitized input for cross-site scripting (boo#1171379) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-451=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python2-markdown2-2.4.0-bp152.2.4.1 python3-markdown2-2.4.0-bp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2021-26813.html https://bugzilla.suse.com/1171379 https://bugzilla.suse.com/1181270 https://bugzilla.suse.com/1183171

1 0

openSUSE-SU-2021:0450-1: moderate: Security update for froxlor
by opensuse-security＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Security Update: Security update for froxlor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0450-1 Rating: moderate References: #1025193 #1082318 #846355 #958100 Cross-References: CVE-2016-5100 CVSS scores: CVE-2016-5100 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 (boo#846355) - Upstream upgrade to version 0.10.22 (boo#846355) - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc [boo#1082318] Upstream upgrade to version 0.9.40.1 (boo#846355) new features besides API that found their way in: - 2FA / TwoFactor Authentication for accounts - MySQL8 compatibility - new implementation of Let's Encrypt (acme.sh) - customizable error/access log handling for webserver (format, level, pipe-to-script, etc.) - lots and lots of bugfixes and small enhancements Upstream upgrade to version 0.9.39.5 (boo#846355) - PHP rand function for random number generation fixed in previous version (boo#1025193) CVE-2016-5100 - upstream upgrade to version 0.9.39 (boo#846355) - Add and change of froxlor config files and manual - Change Requires to enable use with php7 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-450=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): froxlor-0.10.23-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-5100.html https://bugzilla.suse.com/1025193 https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/846355 https://bugzilla.suse.com/958100

1 0