March 2021 - openSUSE Security Announce

openSUSE-SU-2021:0387-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Mar '21

06 Mar '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0387-1 Rating: important References: #1182357 #1182614 Cross-References: CVE-2021-23968 CVE-2021-23969 CVE-2021-23973 CVE-2021-23978 CVSS scores: CVE-2021-23968 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-23968 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-23969 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-23969 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-23973 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-23973 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-23978 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23978 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.8 * fixed: Importing an address book from a CSV file always reported an error * fixed: Security information for S/MIME messages was not displayed correctly prior to a draft being saved * fixed: Calendar: FileLink UI fixes for Caldav calendars * fixed: Recurring tasks were always marked incomplete; unable to use filters * fixed: Various UI widgets not working * fixed: Dark theme improvements * fixed: Extension manager was missing link to addon support web page * fixed: Various security fixes MFSA 2021-09 (bsc#1182614) * CVE-2021-23969: Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23968: Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23973: MediaError message property could have leaked information about cross-origin resources * CVE-2021-23978: Memory safety bugs fixed in Thunderbird 78.8 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-387=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.8.0-lp152.2.35.1 MozillaThunderbird-debuginfo-78.8.0-lp152.2.35.1 MozillaThunderbird-debugsource-78.8.0-lp152.2.35.1 MozillaThunderbird-translations-common-78.8.0-lp152.2.35.1 MozillaThunderbird-translations-other-78.8.0-lp152.2.35.1 References: https://www.suse.com/security/cve/CVE-2021-23968.html https://www.suse.com/security/cve/CVE-2021-23969.html https://www.suse.com/security/cve/CVE-2021-23973.html https://www.suse.com/security/cve/CVE-2021-23978.html https://bugzilla.suse.com/1182357 https://bugzilla.suse.com/1182614

1 0

openSUSE-SU-2021:0384-1: moderate: Security update for mbedtls
by opensuse-security＠opensuse.org 05 Mar '21

05 Mar '21

openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0384-1 Rating: moderate References: #1181468 Cross-References: CVE-2020-10932 CVSS scores: CVE-2020-10932 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mbedtls fixes the following issues: - mbedtls was updated to version 2.16.9 - CVE-2020-10932: Fixed side channel in ECC code that allowed an adversary with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) to fully recover an ECDSA private key (boo#1181468). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-384=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmbedcrypto3-2.16.9-lp152.2.3.1 libmbedcrypto3-debuginfo-2.16.9-lp152.2.3.1 libmbedtls12-2.16.9-lp152.2.3.1 libmbedtls12-debuginfo-2.16.9-lp152.2.3.1 libmbedx509-0-2.16.9-lp152.2.3.1 libmbedx509-0-debuginfo-2.16.9-lp152.2.3.1 mbedtls-debugsource-2.16.9-lp152.2.3.1 mbedtls-devel-2.16.9-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libmbedcrypto3-32bit-2.16.9-lp152.2.3.1 libmbedcrypto3-32bit-debuginfo-2.16.9-lp152.2.3.1 libmbedtls12-32bit-2.16.9-lp152.2.3.1 libmbedtls12-32bit-debuginfo-2.16.9-lp152.2.3.1 libmbedx509-0-32bit-2.16.9-lp152.2.3.1 libmbedx509-0-32bit-debuginfo-2.16.9-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10932.html https://bugzilla.suse.com/1181468

1 0

openSUSE-SU-2021:0377-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0377-1 Rating: moderate References: #1182325 #1182335 #1182336 #1182337 Cross-References: CVE-2021-20241 CVE-2021-20243 CVE-2021-20244 CVE-2021-20246 CVSS scores: CVE-2021-20241 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20243 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20244 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20246 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-20241 [bsc#1182335]: Division by zero in WriteJP2Image() in coders/jp2.c - CVE-2021-20243 [bsc#1182336]: Division by zero in GetResizeFilterWeight in MagickCore/resize.c - CVE-2021-20244 [bsc#1182325]: Division by zero in ImplodeImage in MagickCore/visual-effects.c - CVE-2021-20246 [bsc#1182337]: Division by zero in ScaleResampleFilter in MagickCore/resample.c This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-377=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ImageMagick-7.0.7.34-lp152.12.12.1 ImageMagick-config-7-SUSE-7.0.7.34-lp152.12.12.1 ImageMagick-config-7-upstream-7.0.7.34-lp152.12.12.1 ImageMagick-debuginfo-7.0.7.34-lp152.12.12.1 ImageMagick-debugsource-7.0.7.34-lp152.12.12.1 ImageMagick-devel-7.0.7.34-lp152.12.12.1 ImageMagick-extra-7.0.7.34-lp152.12.12.1 ImageMagick-extra-debuginfo-7.0.7.34-lp152.12.12.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp152.12.12.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp152.12.12.1 libMagick++-devel-7.0.7.34-lp152.12.12.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp152.12.12.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.12.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp152.12.12.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp152.12.12.1 perl-PerlMagick-7.0.7.34-lp152.12.12.1 perl-PerlMagick-debuginfo-7.0.7.34-lp152.12.12.1 - openSUSE Leap 15.2 (noarch): ImageMagick-doc-7.0.7.34-lp152.12.12.1 - openSUSE Leap 15.2 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp152.12.12.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp152.12.12.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp152.12.12.1 libMagick++-devel-32bit-7.0.7.34-lp152.12.12.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.12.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.12.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp152.12.12.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp152.12.12.1 References: https://www.suse.com/security/cve/CVE-2021-20241.html https://www.suse.com/security/cve/CVE-2021-20243.html https://www.suse.com/security/cve/CVE-2021-20244.html https://www.suse.com/security/cve/CVE-2021-20246.html https://bugzilla.suse.com/1182325 https://bugzilla.suse.com/1182335 https://bugzilla.suse.com/1182336 https://bugzilla.suse.com/1182337

1 0

openSUSE-SU-2021:0376-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0376-1 Rating: important References: #1182286 Cross-References: CVE-2020-13558 CVSS scores: CVE-2020-13558 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.30.5 (bsc#1182286): + Bring back the WebKitPluginProcess installation that was removed by mistake. + Fix RunLoop objects leaked in worker threads. + Fix aarch64 llint build with JIT disabled. + Use Internet Explorer quirk for Google Docs. + Security fixes: CVE-2020-13558. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-376=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.30.5-lp152.2.10.5 libjavascriptcoregtk-4_0-18-debuginfo-2.30.5-lp152.2.10.5 libwebkit2gtk-4_0-37-2.30.5-lp152.2.10.5 libwebkit2gtk-4_0-37-debuginfo-2.30.5-lp152.2.10.5 typelib-1_0-JavaScriptCore-4_0-2.30.5-lp152.2.10.5 typelib-1_0-WebKit2-4_0-2.30.5-lp152.2.10.5 typelib-1_0-WebKit2WebExtension-4_0-2.30.5-lp152.2.10.5 webkit-jsc-4-2.30.5-lp152.2.10.5 webkit-jsc-4-debuginfo-2.30.5-lp152.2.10.5 webkit2gtk-4_0-injected-bundles-2.30.5-lp152.2.10.5 webkit2gtk-4_0-injected-bundles-debuginfo-2.30.5-lp152.2.10.5 webkit2gtk3-debugsource-2.30.5-lp152.2.10.5 webkit2gtk3-devel-2.30.5-lp152.2.10.5 webkit2gtk3-minibrowser-2.30.5-lp152.2.10.5 webkit2gtk3-minibrowser-debuginfo-2.30.5-lp152.2.10.5 - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.30.5-lp152.2.10.5 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.30.5-lp152.2.10.5 libwebkit2gtk-4_0-37-32bit-2.30.5-lp152.2.10.5 libwebkit2gtk-4_0-37-32bit-debuginfo-2.30.5-lp152.2.10.5 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.30.5-lp152.2.10.5 References: https://www.suse.com/security/cve/CVE-2020-13558.html https://bugzilla.suse.com/1182286

1 0

openSUSE-SU-2021:0375-1: important: Security update for bind
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0375-1 Rating: important References: #1182246 Cross-References: CVE-2020-8625 CVSS scores: CVE-2020-8625 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-8625 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack [bsc#1182246] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-375=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bind-9.16.6-lp152.14.12.1 bind-chrootenv-9.16.6-lp152.14.12.1 bind-debuginfo-9.16.6-lp152.14.12.1 bind-debugsource-9.16.6-lp152.14.12.1 bind-devel-9.16.6-lp152.14.12.1 bind-utils-9.16.6-lp152.14.12.1 bind-utils-debuginfo-9.16.6-lp152.14.12.1 libbind9-1600-9.16.6-lp152.14.12.1 libbind9-1600-debuginfo-9.16.6-lp152.14.12.1 libdns1605-9.16.6-lp152.14.12.1 libdns1605-debuginfo-9.16.6-lp152.14.12.1 libirs-devel-9.16.6-lp152.14.12.1 libirs1601-9.16.6-lp152.14.12.1 libirs1601-debuginfo-9.16.6-lp152.14.12.1 libisc1606-9.16.6-lp152.14.12.1 libisc1606-debuginfo-9.16.6-lp152.14.12.1 libisccc1600-9.16.6-lp152.14.12.1 libisccc1600-debuginfo-9.16.6-lp152.14.12.1 libisccfg1600-9.16.6-lp152.14.12.1 libisccfg1600-debuginfo-9.16.6-lp152.14.12.1 libns1604-9.16.6-lp152.14.12.1 libns1604-debuginfo-9.16.6-lp152.14.12.1 - openSUSE Leap 15.2 (noarch): bind-doc-9.16.6-lp152.14.12.1 python3-bind-9.16.6-lp152.14.12.1 - openSUSE Leap 15.2 (x86_64): bind-devel-32bit-9.16.6-lp152.14.12.1 libbind9-1600-32bit-9.16.6-lp152.14.12.1 libbind9-1600-32bit-debuginfo-9.16.6-lp152.14.12.1 libdns1605-32bit-9.16.6-lp152.14.12.1 libdns1605-32bit-debuginfo-9.16.6-lp152.14.12.1 libirs1601-32bit-9.16.6-lp152.14.12.1 libirs1601-32bit-debuginfo-9.16.6-lp152.14.12.1 libisc1606-32bit-9.16.6-lp152.14.12.1 libisc1606-32bit-debuginfo-9.16.6-lp152.14.12.1 libisccc1600-32bit-9.16.6-lp152.14.12.1 libisccc1600-32bit-debuginfo-9.16.6-lp152.14.12.1 libisccfg1600-32bit-9.16.6-lp152.14.12.1 libisccfg1600-32bit-debuginfo-9.16.6-lp152.14.12.1 libns1604-32bit-9.16.6-lp152.14.12.1 libns1604-32bit-debuginfo-9.16.6-lp152.14.12.1 References: https://www.suse.com/security/cve/CVE-2020-8625.html https://bugzilla.suse.com/1182246

1 0

openSUSE-SU-2021:0374-1: moderate: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0374-1 Rating: moderate References: #1181239 Cross-References: CVE-2020-14803 CVSS scores: CVE-2020-14803 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2020-14803 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u282 (icedtea 3.18.0) * January 2021 CPU (bsc#1181239) * Security fixes + JDK-8247619: Improve Direct Buffering of Characters (CVE-2020-14803) * Import of OpenJDK 8 u282 build 01 + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/ /bug6738668.java fails under Linux + JDK-8025936: Windows .pdb and .map files does not have proper dependencies setup + JDK-8030350: Enable additional compiler warnings for GCC + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/ /DisposeFrameOnDragTest.java fails by Timeout on Windows + JDK-8036122: Fix warning 'format not a string literal' + JDK-8051853: new URI("x/").resolve("..").getSchemeSpecificPart() returns null! + JDK-8132664: closed/javax/swing/DataTransfer/DefaultNoDrop/ /DefaultNoDrop.java locks on Windows + JDK-8134632: Mark javax/sound/midi/Devices/ /InitializationHang.java as headful + JDK-8148854: Class names "SomeClass" and "LSomeClass;" treated by JVM as an equivalent + JDK-8148916: Mark bug6400879.java as intermittently failing + JDK-8148983: Fix extra comma in changes for JDK-8148916 + JDK-8160438: javax/swing/plaf/nimbus/8057791/bug8057791.java fails + JDK-8165808: Add release barriers when allocating objects with concurrent collection + JDK-8185003: JMX: Add a version of ThreadMXBean.dumpAllThreads with a maxDepth argument + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java on windows with VS2017 + JDK-8207766: [testbug] Adapt tests for Aix. + JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash + JDK-8215727: Restore JFR thread sampler loop to old / previous behavior + JDK-8220657: JFR.dump does not work when filename is set + JDK-8221342: [TESTBUG] Generate Dockerfile for docker testing + JDK-8224502: [TESTBUG] JDK docker test TestSystemMetrics.java fails with access issues and OOM + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread + JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes + JDK-8232114: JVM crashed at imjpapi.dll in native code + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area + JDK-8234339: replace JLI_StrTok in java_md_solinux.c + JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes + JDK-8242335: Additional Tests for RSASSA-PSS + JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in + JDK-8245400: Upgrade to LittleCMS 2.11 + JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention + JDK-8249176: Update GlobalSignR6CA test certificates + JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY + JDK-8250928: JFR: Improve hash algorithm for stack traces + JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java + JDK-8251840: Java_sun_awt_X11_XToolkit_getDefaultScreenData should not be in make/mapfiles/libawt_xawt/mapfile-vers + JDK-8252384: [TESTBUG] Some tests refer to COMPAT provider rather than JRE + JDK-8252395: [8u] --with-native-debug-symbols=external doesn't include debuginfo files for binaries + JDK-8252497: Incorrect numeric currency code for ROL + JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent + JDK-8252904: VM crashes when JFR is used and JFR event class is transformed + JDK-8252975: [8u] JDK-8252395 breaks the build for --with-native-debug-symbols=internal + JDK-8253284: Zero OrderAccess barrier mappings are incorrect + JDK-8253550: [8u] JDK-8252395 breaks the build for make STRIP_POLICY=no_strip + JDK-8253752: test/sun/management/jmxremote/bootstrap/ /RmiBootstrapTest.java fails randomly + JDK-8254081: java/security/cert/PolicyNode/ /GetPolicyQualifiers.java fails due to an expired certificate + JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp + JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/ /WorkerDeadlockTest.java fails + JDK-8255003: Build failures on Solaris This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-374=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-accessibility-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-debuginfo-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-debugsource-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-demo-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-devel-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-headless-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-lp152.2.9.1 java-1_8_0-openjdk-src-1.8.0.282-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.282-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-14803.html https://bugzilla.suse.com/1181239

1 0

openSUSE-SU-2021:0372-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0372-1 Rating: important References: #1182333 #1182619 #1182620 Cross-References: CVE-2021-22883 CVE-2021-22884 CVE-2021-23840 CVSS scores: CVE-2021-22883 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22884 (SUSE): 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-23840 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23840 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs10 fixes the following issues: New upstream LTS version 10.24.0: - CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (bsc#1182619) - CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620) - CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate (bsc#1182333) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-372=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs10-10.24.0-lp152.2.12.1 nodejs10-debuginfo-10.24.0-lp152.2.12.1 nodejs10-debugsource-10.24.0-lp152.2.12.1 nodejs10-devel-10.24.0-lp152.2.12.1 npm10-10.24.0-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): nodejs10-docs-10.24.0-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-22883.html https://www.suse.com/security/cve/CVE-2021-22884.html https://www.suse.com/security/cve/CVE-2021-23840.html https://bugzilla.suse.com/1182333 https://bugzilla.suse.com/1182619 https://bugzilla.suse.com/1182620

1 0

openSUSE-SU-2021:0373-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 03 Mar '21

03 Mar '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0373-1 Rating: important References: #1182357 #1182614 Cross-References: CVE-2021-23968 CVE-2021-23969 CVE-2021-23973 CVE-2021-23978 CVSS scores: CVE-2021-23968 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-23969 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-23973 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-23978 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.8.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-08 (bsc#1182614) * CVE-2021-23969: Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23968: Content Security Policy violation report could have contained the destination of a redirect * CVE-2021-23973: MediaError message property could have leaked information about cross-origin resources * CVE-2021-23978: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-373=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.8.0-lp152.2.49.1 MozillaFirefox-branding-upstream-78.8.0-lp152.2.49.1 MozillaFirefox-buildsymbols-78.8.0-lp152.2.49.1 MozillaFirefox-debuginfo-78.8.0-lp152.2.49.1 MozillaFirefox-debugsource-78.8.0-lp152.2.49.1 MozillaFirefox-devel-78.8.0-lp152.2.49.1 MozillaFirefox-translations-common-78.8.0-lp152.2.49.1 MozillaFirefox-translations-other-78.8.0-lp152.2.49.1 References: https://www.suse.com/security/cve/CVE-2021-23968.html https://www.suse.com/security/cve/CVE-2021-23969.html https://www.suse.com/security/cve/CVE-2021-23973.html https://www.suse.com/security/cve/CVE-2021-23978.html https://bugzilla.suse.com/1182357 https://bugzilla.suse.com/1182614

1 0

openSUSE-SU-2021:0370-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 02 Mar '21

02 Mar '21

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0370-1 Rating: moderate References: #1180827 Cross-References: CVE-2021-26720 CVSS scores: CVE-2021-26720 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-26720 (SUSE): 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827) - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-370=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): avahi-0.7-lp152.3.6.1 avahi-autoipd-0.7-lp152.3.6.1 avahi-autoipd-debuginfo-0.7-lp152.3.6.1 avahi-compat-howl-devel-0.7-lp152.3.6.1 avahi-compat-mDNSResponder-devel-0.7-lp152.3.6.1 avahi-debuginfo-0.7-lp152.3.6.1 avahi-debugsource-0.7-lp152.3.6.1 avahi-glib2-debugsource-0.7-lp152.3.6.1 avahi-utils-0.7-lp152.3.6.1 avahi-utils-debuginfo-0.7-lp152.3.6.1 avahi-utils-gtk-0.7-lp152.3.6.1 avahi-utils-gtk-debuginfo-0.7-lp152.3.6.1 libavahi-client3-0.7-lp152.3.6.1 libavahi-client3-debuginfo-0.7-lp152.3.6.1 libavahi-common3-0.7-lp152.3.6.1 libavahi-common3-debuginfo-0.7-lp152.3.6.1 libavahi-core7-0.7-lp152.3.6.1 libavahi-core7-debuginfo-0.7-lp152.3.6.1 libavahi-devel-0.7-lp152.3.6.1 libavahi-glib-devel-0.7-lp152.3.6.1 libavahi-glib1-0.7-lp152.3.6.1 libavahi-glib1-debuginfo-0.7-lp152.3.6.1 libavahi-gobject-devel-0.7-lp152.3.6.1 libavahi-gobject0-0.7-lp152.3.6.1 libavahi-gobject0-debuginfo-0.7-lp152.3.6.1 libavahi-ui-gtk3-0-0.7-lp152.3.6.1 libavahi-ui-gtk3-0-debuginfo-0.7-lp152.3.6.1 libavahi-ui0-0.7-lp152.3.6.1 libavahi-ui0-debuginfo-0.7-lp152.3.6.1 libdns_sd-0.7-lp152.3.6.1 libdns_sd-debuginfo-0.7-lp152.3.6.1 libhowl0-0.7-lp152.3.6.1 libhowl0-debuginfo-0.7-lp152.3.6.1 python3-avahi-0.7-lp152.3.6.1 python3-avahi-gtk-0.7-lp152.3.6.1 typelib-1_0-Avahi-0_6-0.7-lp152.3.6.1 - openSUSE Leap 15.2 (noarch): avahi-lang-0.7-lp152.3.6.1 - openSUSE Leap 15.2 (x86_64): avahi-32bit-debuginfo-0.7-lp152.3.6.1 avahi-mono-0.7-lp152.3.6.1 avahi-qt4-debugsource-0.7-lp152.3.6.1 libavahi-client3-32bit-0.7-lp152.3.6.1 libavahi-client3-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-common3-32bit-0.7-lp152.3.6.1 libavahi-common3-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-glib1-32bit-0.7-lp152.3.6.1 libavahi-glib1-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-qt4-1-0.7-lp152.3.6.1 libavahi-qt4-1-debuginfo-0.7-lp152.3.6.1 libavahi-qt4-devel-0.7-lp152.3.6.1 libdns_sd-32bit-0.7-lp152.3.6.1 libdns_sd-32bit-debuginfo-0.7-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-26720.html https://bugzilla.suse.com/1180827

1 0

openSUSE-SU-2021:0363-1: important: Security update for qemu
by opensuse-security＠opensuse.org 01 Mar '21

01 Mar '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0363-1 Rating: important References: #1178049 #1178565 #1179717 #1179719 #1180523 #1181639 #1181933 #1182137 Cross-References: CVE-2020-11947 CVE-2021-20181 CVE-2021-20203 CVE-2021-20221 CVSS scores: CVE-2020-11947 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2020-11947 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-20181 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20203 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-20221 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has four fixes is now available. Description: This update for qemu fixes the following issues: - Fixed potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137) - Fixed out-of-bound access in iscsi (CVE-2020-11947 bsc#1180523) - Fixed out-of-bound access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639) - Fixed out-of-bound access in ARM interrupt handling (CVE-2021-20221 bsc#1181933) - Fixed vfio-pci device on s390 enters error state (bsc#1179717 bsc#1179719) - Fixed "Failed to try-restart qemu-ga@.service" error while updating the qemu-guest-agent. (bsc#1178565) - Apply fixes to qemu scsi passthrough with respect to timeout and error conditions, including using more correct status codes. Add more qemu tracing which helped track down these issues (bsc#1178049) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-363=1 Package List: - openSUSE Leap 15.2 (noarch): qemu-ipxe-1.0.0+-lp152.9.9.2 qemu-microvm-4.2.1-lp152.9.9.2 qemu-seabios-1.12.1+-lp152.9.9.2 qemu-sgabios-8-lp152.9.9.2 qemu-vgabios-1.12.1+-lp152.9.9.2 - openSUSE Leap 15.2 (x86_64): qemu-4.2.1-lp152.9.9.2 qemu-arm-4.2.1-lp152.9.9.2 qemu-arm-debuginfo-4.2.1-lp152.9.9.2 qemu-audio-alsa-4.2.1-lp152.9.9.2 qemu-audio-alsa-debuginfo-4.2.1-lp152.9.9.2 qemu-audio-pa-4.2.1-lp152.9.9.2 qemu-audio-pa-debuginfo-4.2.1-lp152.9.9.2 qemu-audio-sdl-4.2.1-lp152.9.9.2 qemu-audio-sdl-debuginfo-4.2.1-lp152.9.9.2 qemu-block-curl-4.2.1-lp152.9.9.2 qemu-block-curl-debuginfo-4.2.1-lp152.9.9.2 qemu-block-dmg-4.2.1-lp152.9.9.2 qemu-block-dmg-debuginfo-4.2.1-lp152.9.9.2 qemu-block-gluster-4.2.1-lp152.9.9.2 qemu-block-gluster-debuginfo-4.2.1-lp152.9.9.2 qemu-block-iscsi-4.2.1-lp152.9.9.2 qemu-block-iscsi-debuginfo-4.2.1-lp152.9.9.2 qemu-block-nfs-4.2.1-lp152.9.9.2 qemu-block-nfs-debuginfo-4.2.1-lp152.9.9.2 qemu-block-rbd-4.2.1-lp152.9.9.2 qemu-block-rbd-debuginfo-4.2.1-lp152.9.9.2 qemu-block-ssh-4.2.1-lp152.9.9.2 qemu-block-ssh-debuginfo-4.2.1-lp152.9.9.2 qemu-debuginfo-4.2.1-lp152.9.9.2 qemu-debugsource-4.2.1-lp152.9.9.2 qemu-extra-4.2.1-lp152.9.9.2 qemu-extra-debuginfo-4.2.1-lp152.9.9.2 qemu-guest-agent-4.2.1-lp152.9.9.2 qemu-guest-agent-debuginfo-4.2.1-lp152.9.9.2 qemu-ksm-4.2.1-lp152.9.9.2 qemu-kvm-4.2.1-lp152.9.9.2 qemu-lang-4.2.1-lp152.9.9.2 qemu-linux-user-4.2.1-lp152.9.9.3 qemu-linux-user-debuginfo-4.2.1-lp152.9.9.3 qemu-linux-user-debugsource-4.2.1-lp152.9.9.3 qemu-ppc-4.2.1-lp152.9.9.2 qemu-ppc-debuginfo-4.2.1-lp152.9.9.2 qemu-s390-4.2.1-lp152.9.9.2 qemu-s390-debuginfo-4.2.1-lp152.9.9.2 qemu-testsuite-4.2.1-lp152.9.9.5 qemu-tools-4.2.1-lp152.9.9.2 qemu-tools-debuginfo-4.2.1-lp152.9.9.2 qemu-ui-curses-4.2.1-lp152.9.9.2 qemu-ui-curses-debuginfo-4.2.1-lp152.9.9.2 qemu-ui-gtk-4.2.1-lp152.9.9.2 qemu-ui-gtk-debuginfo-4.2.1-lp152.9.9.2 qemu-ui-sdl-4.2.1-lp152.9.9.2 qemu-ui-sdl-debuginfo-4.2.1-lp152.9.9.2 qemu-ui-spice-app-4.2.1-lp152.9.9.2 qemu-ui-spice-app-debuginfo-4.2.1-lp152.9.9.2 qemu-vhost-user-gpu-4.2.1-lp152.9.9.2 qemu-vhost-user-gpu-debuginfo-4.2.1-lp152.9.9.2 qemu-x86-4.2.1-lp152.9.9.2 qemu-x86-debuginfo-4.2.1-lp152.9.9.2 References: https://www.suse.com/security/cve/CVE-2020-11947.html https://www.suse.com/security/cve/CVE-2021-20181.html https://www.suse.com/security/cve/CVE-2021-20203.html https://www.suse.com/security/cve/CVE-2021-20221.html https://bugzilla.suse.com/1178049 https://bugzilla.suse.com/1178565 https://bugzilla.suse.com/1179717 https://bugzilla.suse.com/1179719 https://bugzilla.suse.com/1180523 https://bugzilla.suse.com/1181639 https://bugzilla.suse.com/1181933 https://bugzilla.suse.com/1182137

1 0