April 2021 - openSUSE Security Announce

openSUSE-SU-2021:0602-1: important: Security update for sudo
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0602-1 Rating: important References: #1183936 Cross-References: CVE-2021-3156 CVSS scores: CVE-2021-3156 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3156 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - L3: Tenable Scan reports sudo is vulnerable to CVE-2021-3156 (bsc#1183936) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-602=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): sudo-1.8.22-lp152.8.9.1 sudo-debuginfo-1.8.22-lp152.8.9.1 sudo-debugsource-1.8.22-lp152.8.9.1 sudo-devel-1.8.22-lp152.8.9.1 sudo-test-1.8.22-lp152.8.9.1 References: https://www.suse.com/security/cve/CVE-2021-3156.html https://bugzilla.suse.com/1183936

1 0

openSUSE-SU-2021:0598-1: important: Security update for shim
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for shim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0598-1 Rating: important References: #1173411 #1174512 #1175509 #1177315 #1177404 #1177789 #1182057 #1184454 Cross-References: CVE-2019-14584 CVSS scores: CVE-2019-14584 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for shim fixes the following issues: - Updated openSUSE x86 signature - Avoid the error message during linux system boot (boo#1184454) - Prevent the build id being added to the binary. That can cause issues with the signature Update to 15.4 (boo#1182057) + Rename the SBAT variable and fix the self-check of SBAT + sbat: add more dprint() + arm/aa64: Swizzle some sections to make old sbsign happier + arm/aa64 targets: put .rel* and .dyn* in .rodata - Change the SBAT variable name and enhance the handling of SBAT (boo#1182057) Update to 15.3 for SBAT support (boo#1182057) + Drop gnu-efi from BuildRequires since upstream pull it into the - Generate vender-specific SBAT metadata + Add dos2unix to BuildRequires since Makefile requires it for vendor SBAT - Update dbx-cert.tar.xz and vendor-dbx.bin to block the following sign keys: + SLES-UEFI-SIGN-Certificate-2020-07.crt + openSUSE-UEFI-SIGN-Certificate-2020-07.crt - Check CodeSign in the signer's EKU (boo#1177315) - Fixed NULL pointer dereference in AuthenticodeVerify() (boo#1177789, CVE-2019-14584) - All newly released openSUSE kernels enable kernel lockdown and signature verification, so there is no need to add the prompt anymore. - shim-install: Support changing default shim efi binary in /usr/etc/default/shim and /etc/default/shim (boo#1177315) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-598=1 Package List: - openSUSE Leap 15.2 (x86_64): shim-15.4-lp152.4.8.1 shim-debuginfo-15.4-lp152.4.8.1 shim-debugsource-15.4-lp152.4.8.1 References: https://www.suse.com/security/cve/CVE-2019-14584.html https://bugzilla.suse.com/1173411 https://bugzilla.suse.com/1174512 https://bugzilla.suse.com/1175509 https://bugzilla.suse.com/1177315 https://bugzilla.suse.com/1177404 https://bugzilla.suse.com/1177789 https://bugzilla.suse.com/1182057 https://bugzilla.suse.com/1184454

1 0

openSUSE-SU-2021:0595-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0595-1 Rating: moderate References: #1184848 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for irssi fixes the following issues: irssi was updated to 1.2.3 (boo#1184848) - Fix the compilation of utf8proc (#1021) - Fix wrong call to free. By Zero King (#1076) - Fix a colour reset in true colour themes when encountering mIRC colours (#1059) - Fix memory leak on malformed CAP requests (#1120) - Fix an erroneous free of SASL data. Credit to Oss-Fuzz (#1128, #1130) - Re-set the TLS flag when reconnecting (#1027, #1134) - Fix the scrollback getting stuck after /clear (#1115, #1136) - Fix the input of Ctrl+C as the first character (#1153, #1154) - Fix crash on quit during unloading of modules on certain platforms (#1167) - Fix Irssi freezing input after Ctrl+Space on GLib >2.62 (#1180, #1183) - Fix layout of IDCHANs. By Lauri Tirkkonen (#1197) - Fix crash when server got reconnected before it was properly connected (#1210, #1211) - Fix multiple identical active caps (#1249) - Minor help corrections (#1156, #1213, #1214, #1255) - Remove erroneous colour in the colorless theme. Reported and fixed by Nutchanon Wetchasit (#1220, #1221) - Fix invalid bounds calculation when editing the text entry. Found and fixed by Sergey Valentey (#1269) - Fix passing of negative size in buffer writes. Found and fixed by Sergey Valentey (#1270) - Fix Irssi freezing on slow hardware and fast DCC transfers (#159, #1271) - Fix compilation on Solaris (#1291) - Fix null pointer dereference when receiving broken JOIN record. Credit to Oss-Fuzz (#1292) - Fix crash on /connect to some sockets (#1239, #1298) - Fix Irssi rendering on Apple ARM. By Misty De M��o (#1267, #1268, #1290) - Fix crash on /lastlog with broken lines (#1281, #1299) - Fix memory leak when receiving bogus SASL authentication data. Found and fixed by Sergey Valentey (#1293) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-595=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): irssi-1.2.3-bp152.5.4.1 irssi-devel-1.2.3-bp152.5.4.1 References: https://bugzilla.suse.com/1184848

1 0

openSUSE-SU-2021:0597-1: moderate: Security update for python-django-registration
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for python-django-registration ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0597-1 Rating: moderate References: #1184427 Cross-References: CVE-2021-21416 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-django-registration fixes the following issues: Update to 3.1.2 (boo#1184427, CVE-2021-21416) * Filter sensitive POST parameters in error reports * Fix RemovedInDjango40Warning from Signal arguments This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-597=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python3-django-registration-3.1.2-bp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-21416.html https://bugzilla.suse.com/1184427

1 0

openSUSE-SU-2021:0594-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 23 Apr '21

23 Apr '21

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0594-1 Rating: moderate References: #1184756 Cross-References: CVE-2021-3496 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jhead fixes the following issues: - CVE-2021-3496: Fixed heap-based buffer overflow in Get16u() in exif.c (bsc#1184756) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-594=1 Package List: - openSUSE Leap 15.2 (x86_64): jhead-3.00-lp152.7.3.1 jhead-debuginfo-3.00-lp152.7.3.1 jhead-debugsource-3.00-lp152.7.3.1 References: https://www.suse.com/security/cve/CVE-2021-3496.html https://bugzilla.suse.com/1184756

1 0

openSUSE-SU-2021:0592-1: important: Security update for opera
by opensuse-security＠opensuse.org 22 Apr '21

22 Apr '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0592-1 Rating: important References: #1184256 Cross-References: CVE-2021-21191 CVE-2021-21192 CVE-2021-21193 CVE-2021-21194 CVE-2021-21195 CVE-2021-21196 CVE-2021-21197 CVE-2021-21198 CVE-2021-21199 CVSS scores: CVE-2021-21191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21192 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21193 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21194 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21195 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21196 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21197 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21198 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-21199 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for opera fixes the following issues: - Opera was updated to version 75.0.3969.171 (boo#1184256) CVE-2021-21194, CVE-2021-21195, CVE-2021-21196, CVE-2021-21197, CVE-2021-21198, CVE-2021-21199, CVE-2021-21191, CVE-2021-21192, CVE-2021-21193 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-592=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-75.0.3969.171-lp152.2.40.1 References: https://www.suse.com/security/cve/CVE-2021-21191.html https://www.suse.com/security/cve/CVE-2021-21192.html https://www.suse.com/security/cve/CVE-2021-21193.html https://www.suse.com/security/cve/CVE-2021-21194.html https://www.suse.com/security/cve/CVE-2021-21195.html https://www.suse.com/security/cve/CVE-2021-21196.html https://www.suse.com/security/cve/CVE-2021-21197.html https://www.suse.com/security/cve/CVE-2021-21198.html https://www.suse.com/security/cve/CVE-2021-21199.html https://bugzilla.suse.com/1184256

1 0

openSUSE-SU-2021:0588-1: moderate: Security update for python-django-registration
by opensuse-security＠opensuse.org 19 Apr '21

19 Apr '21

openSUSE Security Update: Security update for python-django-registration ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0588-1 Rating: moderate References: #1184427 Cross-References: CVE-2021-21416 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-django-registration fixes the following issues: Update to 3.1.2 (boo#1184427, CVE-2021-21416) * Filter sensitive POST parameters in error reports * Fix RemovedInDjango40Warning from Signal arguments Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-588=1 Package List: - openSUSE Leap 15.2 (noarch): python3-django-registration-3.1.2-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-21416.html https://bugzilla.suse.com/1184427

1 0

openSUSE-SU-2021:0587-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 19 Apr '21

19 Apr '21

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0587-1 Rating: moderate References: #1184848 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for irssi fixes the following issues: irssi was updated to 1.2.3 (boo#1184848) - Fix the compilation of utf8proc (#1021) - Fix wrong call to free. By Zero King (#1076) - Fix a colour reset in true colour themes when encountering mIRC colours (#1059) - Fix memory leak on malformed CAP requests (#1120) - Fix an erroneous free of SASL data. Credit to Oss-Fuzz (#1128, #1130) - Re-set the TLS flag when reconnecting (#1027, #1134) - Fix the scrollback getting stuck after /clear (#1115, #1136) - Fix the input of Ctrl+C as the first character (#1153, #1154) - Fix crash on quit during unloading of modules on certain platforms (#1167) - Fix Irssi freezing input after Ctrl+Space on GLib >2.62 (#1180, #1183) - Fix layout of IDCHANs. By Lauri Tirkkonen (#1197) - Fix crash when server got reconnected before it was properly connected (#1210, #1211) - Fix multiple identical active caps (#1249) - Minor help corrections (#1156, #1213, #1214, #1255) - Remove erroneous colour in the colorless theme. Reported and fixed by Nutchanon Wetchasit (#1220, #1221) - Fix invalid bounds calculation when editing the text entry. Found and fixed by Sergey Valentey (#1269) - Fix passing of negative size in buffer writes. Found and fixed by Sergey Valentey (#1270) - Fix Irssi freezing on slow hardware and fast DCC transfers (#159, #1271) - Fix compilation on Solaris (#1291) - Fix null pointer dereference when receiving broken JOIN record. Credit to Oss-Fuzz (#1292) - Fix crash on /connect to some sockets (#1239, #1298) - Fix Irssi rendering on Apple ARM. By Misty De M��o (#1267, #1268, #1290) - Fix crash on /lastlog with broken lines (#1281, #1299) - Fix memory leak when receiving bogus SASL authentication data. Found and fixed by Sergey Valentey (#1293) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-587=1 Package List: - openSUSE Leap 15.2 (x86_64): irssi-1.2.3-lp152.3.3.1 irssi-debuginfo-1.2.3-lp152.3.3.1 irssi-debugsource-1.2.3-lp152.3.3.1 irssi-devel-1.2.3-lp152.3.3.1 References: https://bugzilla.suse.com/1184848

1 0

openSUSE-SU-2021:0577-1: important: Security update for nextcloud-desktop
by opensuse-security＠opensuse.org 19 Apr '21

19 Apr '21

openSUSE Security Update: Security update for nextcloud-desktop ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0577-1 Rating: important References: #1184770 Cross-References: CVE-2021-22879 CVSS scores: CVE-2021-22879 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud-desktop fixes the following issues: nextcloud-desktop was updated to 3.1.3: - desktop#2884 [stable-3.1] Add support for Hirsute - desktop#2920 [stable-3.1] Validate sensitive URLs to onle allow http(s) schemes. - desktop#2926 [stable-3.1] Validate the providers ssl certificate - desktop#2939 Bump release to 3.1.3 This also fix security issues: - (boo#1184770, CVE-2021-22879, NC-SA-2021-008 , CWE-99) Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-577=1 Package List: - openSUSE Leap 15.2 (x86_64): libnextcloudsync-devel-3.1.3-lp152.2.6.1 libnextcloudsync0-3.1.3-lp152.2.6.1 libnextcloudsync0-debuginfo-3.1.3-lp152.2.6.1 nextcloud-desktop-3.1.3-lp152.2.6.1 nextcloud-desktop-debuginfo-3.1.3-lp152.2.6.1 nextcloud-desktop-debugsource-3.1.3-lp152.2.6.1 nextcloud-desktop-dolphin-3.1.3-lp152.2.6.1 nextcloud-desktop-dolphin-debuginfo-3.1.3-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): caja-extension-nextcloud-3.1.3-lp152.2.6.1 nautilus-extension-nextcloud-3.1.3-lp152.2.6.1 nemo-extension-nextcloud-3.1.3-lp152.2.6.1 nextcloud-desktop-doc-3.1.3-lp152.2.6.1 nextcloud-desktop-lang-3.1.3-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-22879.html https://bugzilla.suse.com/1184770

1 0

openSUSE-SU-2021:0580-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 19 Apr '21

19 Apr '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0580-1 Rating: important References: #1177542 #1183942 #1184536 Cross-References: CVE-2021-23981 CVE-2021-23982 CVE-2021-23984 CVE-2021-23987 CVE-2021-23991 CVE-2021-23992 CVE-2021-23993 CVSS scores: CVE-2021-23981 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2021-23981 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23982 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-23982 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23984 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-23984 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23987 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23987 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23991 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-23992 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-23993 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird was updated to version 78.9.1 (MFSA 2021-12,MFSA 2021-13, bsc#1183942, bsc#1184536) * CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read * CVE-2021-23982: Internal network hosts could have been probed by a malicious webpage * CVE-2021-23984: Malicious extensions could have spoofed popup information * CVE-2021-23987: Memory safety bugs * CVE-2021-23991: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key * CVE-2021-23992: A crafted OpenPGP key with an invalid user ID could be used to confuse the user * CVE-2021-23993: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key - cleaned up and fixed mozilla.sh.in for wayland (bsc#1177542) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-580=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.9.1-lp152.2.38.1 MozillaThunderbird-debuginfo-78.9.1-lp152.2.38.1 MozillaThunderbird-debugsource-78.9.1-lp152.2.38.1 MozillaThunderbird-translations-common-78.9.1-lp152.2.38.1 MozillaThunderbird-translations-other-78.9.1-lp152.2.38.1 References: https://www.suse.com/security/cve/CVE-2021-23981.html https://www.suse.com/security/cve/CVE-2021-23982.html https://www.suse.com/security/cve/CVE-2021-23984.html https://www.suse.com/security/cve/CVE-2021-23987.html https://www.suse.com/security/cve/CVE-2021-23991.html https://www.suse.com/security/cve/CVE-2021-23992.html https://www.suse.com/security/cve/CVE-2021-23993.html https://bugzilla.suse.com/1177542 https://bugzilla.suse.com/1183942 https://bugzilla.suse.com/1184536

1 0