April 2021 - openSUSE Security Announce

openSUSE-SU-2021:0551-1: important: Security update for spamassassin
by opensuse-security＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Security Update: Security update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0551-1 Rating: important References: #1159133 #1184221 Cross-References: CVE-2019-12420 CVE-2020-1946 CVSS scores: CVE-2019-12420 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12420 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-1946 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for spamassassin fixes the following issues: - CVE-2019-12420: memory leak via crafted messages (bsc#1159133) - CVE-2020-1946: security update (bsc#1184221) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-551=1 Package List: - openSUSE Leap 15.2 (x86_64): perl-Mail-SpamAssassin-3.4.5-lp152.10.3.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp152.10.3.1 spamassassin-3.4.5-lp152.10.3.1 spamassassin-debuginfo-3.4.5-lp152.10.3.1 spamassassin-debugsource-3.4.5-lp152.10.3.1 References: https://www.suse.com/security/cve/CVE-2019-12420.html https://www.suse.com/security/cve/CVE-2020-1946.html https://bugzilla.suse.com/1159133 https://bugzilla.suse.com/1184221

1 0

openSUSE-SU-2021:0552-1: important: Security update for python-bleach
by opensuse-security＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Security Update: Security update for python-bleach ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0552-1 Rating: important References: #1167379 #1168280 #1184547 Cross-References: CVE-2020-6816 CVE-2020-6817 CVE-2021-23980 CVSS scores: CVE-2020-6816 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23980 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python-bleach fixes the following issues: - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547) Update to 3.1.5: * replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson. Update to 3.1.4 (boo#1168280, CVE-2020-6817): * ``bleach.clean`` behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute were vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``. * Style attributes with dashes, or single or double quoted values are cleaned instead of passed through. update to 3.1.3 (boo#1167379, CVE-2020-6816): * Add relative link to code of conduct. (#442) * Drop deprecated 'setup.py test' support. (#507) * Fix typo: curren -> current in tests/test_clean.py (#504) * Test on PyPy 7 * Drop test support for end of life Python 3.4 * ``bleach.clean`` behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or ``svg`` tags and one or more of the RCDATA tags ``script``, ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or ``xmp`` in the allowed tags whitelist were vulnerable to a mutation XSS. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-552=1 Package List: - openSUSE Leap 15.2 (noarch): python2-bleach-3.1.5-lp152.2.3.1 python3-bleach-3.1.5-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-6816.html https://www.suse.com/security/cve/CVE-2020-6817.html https://www.suse.com/security/cve/CVE-2021-23980.html https://bugzilla.suse.com/1167379 https://bugzilla.suse.com/1168280 https://bugzilla.suse.com/1184547

1 0

openSUSE-SU-2021:0548-1: important: Security update for umoci
by opensuse-security＠opensuse.org 13 Apr '21

13 Apr '21

openSUSE Security Update: Security update for umoci ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0548-1 Rating: important References: #1184147 Cross-References: CVE-2021-29136 CVSS scores: CVE-2021-29136 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for umoci fixes the following issues: - Update to umoci v0.4.6. - CVE-2021-29136: malicious layer allows overwriting of host files (bsc#1184147) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-548=1 Package List: - openSUSE Leap 15.2 (x86_64): umoci-0.4.6-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-29136.html https://bugzilla.suse.com/1184147

1 0

openSUSE-SU-2021:0545-1: important: Security update for hostapd
by opensuse-security＠opensuse.org 12 Apr '21

12 Apr '21

openSUSE Security Update: Security update for hostapd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0545-1 Rating: important References: #1150934 #1172700 #1184348 Cross-References: CVE-2019-16275 CVE-2020-12695 CVE-2021-30004 CVSS scores: CVE-2019-16275 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-16275 (SUSE): 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-12695 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H CVE-2021-30004 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-30004 (SUSE): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for hostapd fixes the following issues: - CVE-2021-30004: forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (boo#1184348) - CVE-2020-12695: UPnP SUBSCRIBE misbehavior in hostapd WPS AP (boo#1172700) - CVE-2019-16275: AP mode PMF disconnection protection bypass (boo#1150934) - added AppArmor profile (source apparmor-usr.sbin.hostapd) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-545=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): hostapd-2.9-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-16275.html https://www.suse.com/security/cve/CVE-2020-12695.html https://www.suse.com/security/cve/CVE-2021-30004.html https://bugzilla.suse.com/1150934 https://bugzilla.suse.com/1172700 https://bugzilla.suse.com/1184348

1 0

openSUSE-SU-2021:0544-1: moderate: Security update for ceph
by opensuse-security＠opensuse.org 12 Apr '21

12 Apr '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0544-1 Rating: moderate References: #1172926 #1176390 #1176489 #1176679 #1176828 #1177360 #1177857 #1178837 #1178860 #1178905 #1178932 #1179569 #1179997 #1182766 Cross-References: CVE-2020-25678 CVE-2020-27839 CVSS scores: CVE-2020-25678 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVE-2020-27839 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 12 fixes is now available. Description: This update for ceph fixes the following issues: - ceph was updated to to 15.2.9 - cephadm: fix 'inspect' and 'pull' (bsc#1182766) - CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token (bsc#1179997) - CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905) - mgr/orchestrator: Sort 'ceph orch device ls' by host (bsc#1172926) - mgr/dashboard: enable different URL for users of browser to Grafana (bsc#1176390, bsc#1176679) - mgr/cephadm: lock multithreaded access to OSDRemovalQueue (bsc#1176489) - cephadm: command_unit: call systemctl with verbose=True (bsc#1176828) - cephadm: silence "Failed to evict container" log msg (bsc#1177360) - mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails (bsc#1177857) - rgw: cls/user: set from_index for reset stats calls (bsc#1178837) - mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860) - cephadm: reference the last local image by digest (bsc#1178932, bsc#1179569) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-544=1 Package List: - openSUSE Leap 15.2 (x86_64): ceph-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-base-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-base-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-common-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-common-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-debugsource-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-fuse-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-fuse-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-immutable-object-cache-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-immutable-object-cache-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mds-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mds-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mon-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mon-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-osd-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-osd-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-radosgw-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-radosgw-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-test-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-test-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-test-debugsource-15.2.9.83+g4275378de0-lp152.2.12.1 cephfs-shell-15.2.9.83+g4275378de0-lp152.2.12.1 libcephfs-devel-15.2.9.83+g4275378de0-lp152.2.12.1 libcephfs2-15.2.9.83+g4275378de0-lp152.2.12.1 libcephfs2-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 librados-devel-15.2.9.83+g4275378de0-lp152.2.12.1 librados-devel-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 librados2-15.2.9.83+g4275378de0-lp152.2.12.1 librados2-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 libradospp-devel-15.2.9.83+g4275378de0-lp152.2.12.1 librbd-devel-15.2.9.83+g4275378de0-lp152.2.12.1 librbd1-15.2.9.83+g4275378de0-lp152.2.12.1 librbd1-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 librgw-devel-15.2.9.83+g4275378de0-lp152.2.12.1 librgw2-15.2.9.83+g4275378de0-lp152.2.12.1 librgw2-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 python3-ceph-argparse-15.2.9.83+g4275378de0-lp152.2.12.1 python3-ceph-common-15.2.9.83+g4275378de0-lp152.2.12.1 python3-cephfs-15.2.9.83+g4275378de0-lp152.2.12.1 python3-cephfs-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rados-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rados-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rbd-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rbd-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rgw-15.2.9.83+g4275378de0-lp152.2.12.1 python3-rgw-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 rados-objclass-devel-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-fuse-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-fuse-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-mirror-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-mirror-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-nbd-15.2.9.83+g4275378de0-lp152.2.12.1 rbd-nbd-debuginfo-15.2.9.83+g4275378de0-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-cephadm-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-dashboard-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-diskprediction-cloud-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-diskprediction-local-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-k8sevents-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-modules-core-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-mgr-rook-15.2.9.83+g4275378de0-lp152.2.12.1 ceph-prometheus-alerts-15.2.9.83+g4275378de0-lp152.2.12.1 cephadm-15.2.9.83+g4275378de0-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-25678.html https://www.suse.com/security/cve/CVE-2020-27839.html https://bugzilla.suse.com/1172926 https://bugzilla.suse.com/1176390 https://bugzilla.suse.com/1176489 https://bugzilla.suse.com/1176679 https://bugzilla.suse.com/1176828 https://bugzilla.suse.com/1177360 https://bugzilla.suse.com/1177857 https://bugzilla.suse.com/1178837 https://bugzilla.suse.com/1178860 https://bugzilla.suse.com/1178905 https://bugzilla.suse.com/1178932 https://bugzilla.suse.com/1179569 https://bugzilla.suse.com/1179997 https://bugzilla.suse.com/1182766

1 0

openSUSE-SU-2021:0542-1: moderate: Security update for tpm2-tss-engine
by opensuse-security＠opensuse.org 12 Apr '21

12 Apr '21

openSUSE Security Update: Security update for tpm2-tss-engine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0542-1 Rating: moderate References: #1183895 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tpm2-tss-engine fixes the following issues: - Added support to disable fixed compilation flags - Added --disable-defaultflags during compilation to avoid breakage of our gcc-PIE profile (resulted in non-position-independent executable tpm2-tss-genkey, bsc#1183895) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-542=1 Package List: - openSUSE Leap 15.2 (noarch): tpm2-tss-engine-bash-completion-1.0.1-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): tpm2-tss-engine-1.0.1-lp152.3.3.1 tpm2-tss-engine-debuginfo-1.0.1-lp152.3.3.1 tpm2-tss-engine-debugsource-1.0.1-lp152.3.3.1 tpm2-tss-engine-devel-1.0.1-lp152.3.3.1 References: https://bugzilla.suse.com/1183895

1 0

openSUSE-SU-2021:0540-1: moderate: Security update for openSUSE KMPs
by opensuse-security＠opensuse.org 11 Apr '21

11 Apr '21

openSUSE Security Update: Security update for openSUSE KMPs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0540-1 Rating: moderate References: #1174543 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for various openSUSE kernel related packages refreshes them with the new UEFI Secure boot key. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-540=1 Package List: - openSUSE Leap 15.2 (noarch): dpdk-doc-19.11.4-lp152.2.12.1 v4l2loopback-autoload-0.12.5-lp152.2.9.1 v4l2loopback-utils-0.12.5-lp152.2.9.1 virtualbox-guest-desktop-icons-6.1.18-lp152.2.18.1 virtualbox-guest-source-6.1.18-lp152.2.18.1 virtualbox-host-source-6.1.18-lp152.2.18.1 - openSUSE Leap 15.2 (x86_64): bbswitch-0.8-lp152.6.6.1 bbswitch-debugsource-0.8-lp152.6.6.1 bbswitch-kmp-default-0.8_k5.3.18_lp152.69-lp152.6.6.1 bbswitch-kmp-default-debuginfo-0.8_k5.3.18_lp152.69-lp152.6.6.1 bbswitch-kmp-preempt-0.8_k5.3.18_lp152.69-lp152.6.6.1 bbswitch-kmp-preempt-debuginfo-0.8_k5.3.18_lp152.69-lp152.6.6.1 crash-7.2.8-lp152.3.6.1 crash-debuginfo-7.2.8-lp152.3.6.1 crash-debugsource-7.2.8-lp152.3.6.1 crash-devel-7.2.8-lp152.3.6.1 crash-doc-7.2.8-lp152.3.6.1 crash-eppic-7.2.8-lp152.3.6.1 crash-eppic-debuginfo-7.2.8-lp152.3.6.1 crash-gcore-7.2.8-lp152.3.6.1 crash-gcore-debuginfo-7.2.8-lp152.3.6.1 crash-kmp-default-7.2.8_k5.3.18_lp152.69-lp152.3.6.1 crash-kmp-default-debuginfo-7.2.8_k5.3.18_lp152.69-lp152.3.6.1 crash-kmp-preempt-7.2.8_k5.3.18_lp152.69-lp152.3.6.1 crash-kmp-preempt-debuginfo-7.2.8_k5.3.18_lp152.69-lp152.3.6.1 dpdk-19.11.4-lp152.2.12.1 dpdk-debuginfo-19.11.4-lp152.2.12.1 dpdk-debugsource-19.11.4-lp152.2.12.1 dpdk-devel-19.11.4-lp152.2.12.1 dpdk-devel-debuginfo-19.11.4-lp152.2.12.1 dpdk-examples-19.11.4-lp152.2.12.1 dpdk-examples-debuginfo-19.11.4-lp152.2.12.1 dpdk-kmp-default-19.11.4_k5.3.18_lp152.69-lp152.2.12.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_lp152.69-lp152.2.12.1 dpdk-kmp-preempt-19.11.4_k5.3.18_lp152.69-lp152.2.12.1 dpdk-kmp-preempt-debuginfo-19.11.4_k5.3.18_lp152.69-lp152.2.12.1 dpdk-tools-19.11.4-lp152.2.12.1 dpdk-tools-debuginfo-19.11.4-lp152.2.12.1 drbd-9.0.22~1+git.fe2b5983-lp152.2.9.1 drbd-debugsource-9.0.22~1+git.fe2b5983-lp152.2.9.1 drbd-kmp-default-9.0.22~1+git.fe2b5983_k5.3.18_lp152.69-lp152.2.9.1 drbd-kmp-default-debuginfo-9.0.22~1+git.fe2b5983_k5.3.18_lp152.69-lp152.2.9.1 drbd-kmp-preempt-9.0.22~1+git.fe2b5983_k5.3.18_lp152.69-lp152.2.9.1 drbd-kmp-preempt-debuginfo-9.0.22~1+git.fe2b5983_k5.3.18_lp152.69-lp152.2.9.1 libdpdk-20_0-19.11.4-lp152.2.12.1 libdpdk-20_0-debuginfo-19.11.4-lp152.2.12.1 mhvtl-1.62-lp152.2.6.1 mhvtl-debuginfo-1.62-lp152.2.6.1 mhvtl-debugsource-1.62-lp152.2.6.1 mhvtl-kmp-default-1.62_k5.3.18_lp152.69-lp152.2.6.1 mhvtl-kmp-default-debuginfo-1.62_k5.3.18_lp152.69-lp152.2.6.1 mhvtl-kmp-preempt-1.62_k5.3.18_lp152.69-lp152.2.6.1 mhvtl-kmp-preempt-debuginfo-1.62_k5.3.18_lp152.69-lp152.2.6.1 msr-safe-debugsource-1.4.0-lp152.6.1 msr-safe-kmp-default-1.4.0_k5.3.18_lp152.69-lp152.6.1 msr-safe-kmp-default-debuginfo-1.4.0_k5.3.18_lp152.69-lp152.6.1 msr-safe-kmp-preempt-1.4.0_k5.3.18_lp152.69-lp152.6.1 msr-safe-kmp-preempt-debuginfo-1.4.0_k5.3.18_lp152.69-lp152.6.1 openafs-1.8.7-lp152.2.11.1 openafs-authlibs-1.8.7-lp152.2.11.1 openafs-authlibs-debuginfo-1.8.7-lp152.2.11.1 openafs-authlibs-devel-1.8.7-lp152.2.11.1 openafs-client-1.8.7-lp152.2.11.1 openafs-client-debuginfo-1.8.7-lp152.2.11.1 openafs-debuginfo-1.8.7-lp152.2.11.1 openafs-debugsource-1.8.7-lp152.2.11.1 openafs-devel-1.8.7-lp152.2.11.1 openafs-devel-debuginfo-1.8.7-lp152.2.11.1 openafs-fuse_client-1.8.7-lp152.2.11.1 openafs-fuse_client-debuginfo-1.8.7-lp152.2.11.1 openafs-kernel-source-1.8.7-lp152.2.11.1 openafs-kmp-default-1.8.7_k5.3.18_lp152.69-lp152.2.11.1 openafs-kmp-default-debuginfo-1.8.7_k5.3.18_lp152.69-lp152.2.11.1 openafs-kmp-preempt-1.8.7_k5.3.18_lp152.69-lp152.2.11.1 openafs-kmp-preempt-debuginfo-1.8.7_k5.3.18_lp152.69-lp152.2.11.1 openafs-server-1.8.7-lp152.2.11.1 openafs-server-debuginfo-1.8.7-lp152.2.11.1 pcfclock-0.44-lp152.4.6.1 pcfclock-debuginfo-0.44-lp152.4.6.1 pcfclock-debugsource-0.44-lp152.4.6.1 pcfclock-kmp-default-0.44_k5.3.18_lp152.69-lp152.4.6.1 pcfclock-kmp-default-debuginfo-0.44_k5.3.18_lp152.69-lp152.4.6.1 pcfclock-kmp-preempt-0.44_k5.3.18_lp152.69-lp152.4.6.1 pcfclock-kmp-preempt-debuginfo-0.44_k5.3.18_lp152.69-lp152.4.6.1 python3-virtualbox-6.1.18-lp152.2.18.1 python3-virtualbox-debuginfo-6.1.18-lp152.2.18.1 rtl8812au-5.6.4.2+git20200318.49e98ff-lp152.2.9.1 rtl8812au-debugsource-5.6.4.2+git20200318.49e98ff-lp152.2.9.1 rtl8812au-kmp-default-5.6.4.2+git20200318.49e98ff_k5.3.18_lp152.69-lp152.2.9.1 rtl8812au-kmp-default-debuginfo-5.6.4.2+git20200318.49e98ff_k5.3.18_lp152.69-lp152.2.9.1 rtl8812au-kmp-preempt-5.6.4.2+git20200318.49e98ff_k5.3.18_lp152.69-lp152.2.9.1 rtl8812au-kmp-preempt-debuginfo-5.6.4.2+git20200318.49e98ff_k5.3.18_lp152.69-lp152.2.9.1 sysdig-0.26.5-lp152.3.6.1 sysdig-debuginfo-0.26.5-lp152.3.6.1 sysdig-debugsource-0.26.5-lp152.3.6.1 sysdig-kmp-default-0.26.5_k5.3.18_lp152.69-lp152.3.6.1 sysdig-kmp-default-debuginfo-0.26.5_k5.3.18_lp152.69-lp152.3.6.1 sysdig-kmp-preempt-0.26.5_k5.3.18_lp152.69-lp152.3.6.1 sysdig-kmp-preempt-debuginfo-0.26.5_k5.3.18_lp152.69-lp152.3.6.1 system-user-msr-1.4.0-lp152.6.1 system-user-msr-debuginfo-1.4.0-lp152.6.1 v4l2loopback-debugsource-0.12.5-lp152.2.9.1 v4l2loopback-kmp-default-0.12.5_k5.3.18_lp152.69-lp152.2.9.1 v4l2loopback-kmp-default-debuginfo-0.12.5_k5.3.18_lp152.69-lp152.2.9.1 v4l2loopback-kmp-preempt-0.12.5_k5.3.18_lp152.69-lp152.2.9.1 v4l2loopback-kmp-preempt-debuginfo-0.12.5_k5.3.18_lp152.69-lp152.2.9.1 vhba-kmp-default-20200106_k5.3.18_lp152.69-lp152.2.6.1 vhba-kmp-default-debuginfo-20200106_k5.3.18_lp152.69-lp152.2.6.1 vhba-kmp-preempt-20200106_k5.3.18_lp152.69-lp152.2.6.1 vhba-kmp-preempt-debuginfo-20200106_k5.3.18_lp152.69-lp152.2.6.1 virtualbox-6.1.18-lp152.2.18.1 virtualbox-debuginfo-6.1.18-lp152.2.18.1 virtualbox-debugsource-6.1.18-lp152.2.18.1 virtualbox-devel-6.1.18-lp152.2.18.1 virtualbox-guest-tools-6.1.18-lp152.2.18.1 virtualbox-guest-tools-debuginfo-6.1.18-lp152.2.18.1 virtualbox-guest-x11-6.1.18-lp152.2.18.1 virtualbox-guest-x11-debuginfo-6.1.18-lp152.2.18.1 virtualbox-kmp-debugsource-6.1.18-lp152.2.18.1 virtualbox-kmp-default-6.1.18_k5.3.18_lp152.69-lp152.2.18.1 virtualbox-kmp-default-debuginfo-6.1.18_k5.3.18_lp152.69-lp152.2.18.1 virtualbox-kmp-preempt-6.1.18_k5.3.18_lp152.69-lp152.2.18.1 virtualbox-kmp-preempt-debuginfo-6.1.18_k5.3.18_lp152.69-lp152.2.18.1 virtualbox-qt-6.1.18-lp152.2.18.1 virtualbox-qt-debuginfo-6.1.18-lp152.2.18.1 virtualbox-vnc-6.1.18-lp152.2.18.1 virtualbox-websrv-6.1.18-lp152.2.18.1 virtualbox-websrv-debuginfo-6.1.18-lp152.2.18.1 xtables-addons-3.9-lp152.2.6.1 xtables-addons-debuginfo-3.9-lp152.2.6.1 xtables-addons-kmp-default-3.9_k5.3.18_lp152.69-lp152.2.6.1 xtables-addons-kmp-default-debuginfo-3.9_k5.3.18_lp152.69-lp152.2.6.1 xtables-addons-kmp-preempt-3.9_k5.3.18_lp152.69-lp152.2.6.1 xtables-addons-kmp-preempt-debuginfo-3.9_k5.3.18_lp152.69-lp152.2.6.1 References: https://bugzilla.suse.com/1174543

1 0

openSUSE-SU-2021:0535-1: moderate: Security update for bcc
by opensuse-security＠opensuse.org 11 Apr '21

11 Apr '21

openSUSE Security Update: Security update for bcc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0535-1 Rating: moderate References: #1183399 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for bcc fixes the following issues: - Enabled PIE for bcc-lua if lua support is enabled (bsc#1183399) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-535=1 Package List: - openSUSE Leap 15.2 (x86_64): bcc-debuginfo-0.12.0-lp152.3.3.1 bcc-debugsource-0.12.0-lp152.3.3.1 bcc-devel-0.12.0-lp152.3.3.1 bcc-docs-0.12.0-lp152.3.3.1 bcc-examples-0.12.0-lp152.3.3.1 bcc-lua-0.12.0-lp152.3.3.1 bcc-lua-debuginfo-0.12.0-lp152.3.3.1 bcc-tools-0.12.0-lp152.3.3.1 libbcc0-0.12.0-lp152.3.3.1 libbcc0-debuginfo-0.12.0-lp152.3.3.1 python2-bcc-0.12.0-lp152.3.3.1 python3-bcc-0.12.0-lp152.3.3.1 References: https://bugzilla.suse.com/1183399

1 0

openSUSE-SU-2021:0536-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 11 Apr '21

11 Apr '21

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0536-1 Rating: moderate References: #1184172 #1184173 #1184174 Cross-References: CVE-2021-3474 CVE-2021-3475 CVE-2021-3476 CVSS scores: CVE-2021-3474 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3474 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3475 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3475 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3476 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3476 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2021-3474: Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder (bsc#1184174) - CVE-2021-3475: Integer-overflow in Imf_2_5::calculateNumTiles (bsc#1184173) - CVE-2021-3476: Undefined-shift in Imf_2_5::unpack14 (bsc#1184172) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-536=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.11.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.11.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.11.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.11.1 openexr-2.2.1-lp152.7.11.1 openexr-debuginfo-2.2.1-lp152.7.11.1 openexr-debugsource-2.2.1-lp152.7.11.1 openexr-devel-2.2.1-lp152.7.11.1 openexr-doc-2.2.1-lp152.7.11.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.11.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.11.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.11.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.11.1 References: https://www.suse.com/security/cve/CVE-2021-3474.html https://www.suse.com/security/cve/CVE-2021-3475.html https://www.suse.com/security/cve/CVE-2021-3476.html https://bugzilla.suse.com/1184172 https://bugzilla.suse.com/1184173 https://bugzilla.suse.com/1184174

1 0

openSUSE-SU-2021:0533-1: important: Security update for isync
by opensuse-security＠opensuse.org 10 Apr '21

10 Apr '21

openSUSE Security Update: Security update for isync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0533-1 Rating: important References: #1182488 Cross-References: CVE-2021-20247 CVSS scores: CVE-2021-20247 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for isync fixes the following issues: - isync was updated to version 1.3.5 - CVE-2021-20247: reject funny mailbox names from IMAP LIST/LSUB (boo#1182488) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-533=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): isync-1.3.5-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20247.html https://bugzilla.suse.com/1182488

1 0