June 2021 - openSUSE Security Announce

openSUSE-SU-2021:0881-1: important: Security update for chromium
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0881-1 Rating: important References: #1187141 Cross-References: CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.101 (boo#1187141) * CVE-2021-30544: Use after free in BFCache * CVE-2021-30545: Use after free in Extensions * CVE-2021-30546: Use after free in Autofill * CVE-2021-30547: Out of bounds write in ANGLE * CVE-2021-30548: Use after free in Loader * CVE-2021-30549: Use after free in Spell check * CVE-2021-30550: Use after free in Accessibility * CVE-2021-30551: Type Confusion in V8 * CVE-2021-30552: Use after free in Extensions * CVE-2021-30553: Use after free in Network service * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-881=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.101-lp152.2.104.1 chromedriver-debuginfo-91.0.4472.101-lp152.2.104.1 chromium-91.0.4472.101-lp152.2.104.1 chromium-debuginfo-91.0.4472.101-lp152.2.104.1 References: https://www.suse.com/security/cve/CVE-2021-30544.html https://www.suse.com/security/cve/CVE-2021-30545.html https://www.suse.com/security/cve/CVE-2021-30546.html https://www.suse.com/security/cve/CVE-2021-30547.html https://www.suse.com/security/cve/CVE-2021-30548.html https://www.suse.com/security/cve/CVE-2021-30549.html https://www.suse.com/security/cve/CVE-2021-30550.html https://www.suse.com/security/cve/CVE-2021-30551.html https://www.suse.com/security/cve/CVE-2021-30552.html https://www.suse.com/security/cve/CVE-2021-30553.html https://bugzilla.suse.com/1187141

1 0

openSUSE-SU-2021:0876-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0876-1 Rating: important References: #1179833 #1179836 #1179837 #1179839 Cross-References: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVSS scores: CVE-2020-24489 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-24511 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2020-24512 (SUSE): 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2020-24513 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20210608 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0442.html Other fixes: - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xe on/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3- spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3- spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-cor e-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-120 0v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xe on/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile This update was imported from the SUSE:SLE-15:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-876=1 Package List: - openSUSE Leap 15.2 (x86_64): ucode-intel-20210525-lp152.2.17.1 References: https://www.suse.com/security/cve/CVE-2020-24489.html https://www.suse.com/security/cve/CVE-2020-24511.html https://www.suse.com/security/cve/CVE-2020-24512.html https://www.suse.com/security/cve/CVE-2020-24513.html https://bugzilla.suse.com/1179833 https://bugzilla.suse.com/1179836 https://bugzilla.suse.com/1179837 https://bugzilla.suse.com/1179839

1 0

openSUSE-SU-2021:0874-1: important: Security update for spice
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0874-1 Rating: important References: #1181686 Cross-References: CVE-2021-20201 CVSS scores: CVE-2021-20201 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20201 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: - CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-874=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libspice-server-devel-0.14.2-lp152.2.6.1 libspice-server1-0.14.2-lp152.2.6.1 libspice-server1-debuginfo-0.14.2-lp152.2.6.1 spice-debugsource-0.14.2-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-20201.html https://bugzilla.suse.com/1181686

1 0

openSUSE-SU-2021:0885-1: moderate: Security update for libopenmpt
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0885-1 Rating: moderate References: #1186663 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libopenmpt fixes the following issues: Various bugfix and stability issues were fixed, some of those might have security impact. libopenmpt was updated to 0.3.28: * Fixed excessive memory consumption with malformed files in various formats. Changes in 0.3.27: * AMS: Avoid allocating excessive amount of memory for compressed song message in malformed files. * S3M: Some samples were imported with a too high sample rate if module was saved with Scream Tracker 3. Changes in 0.3.26: * DMF: Improve import of finetune effect with parameters larger than +/-15. Changes in 0.3.25: * AMS: An upper bound for uncompressed sample size is now established to avoid memory exhaustion from malformed files. * MO3: Avoid certain ModPlug hacks from being fixed up twice, which could lead to e.g. very narrow pan swing range for old OpenMPT IT files saved with a recent MO3 encoder version. * IMF: Instrument sample mapping was off by one octave, notable in the guitar part of Astaris by Karsten Koch. * PLM: Percentage offset (Mxx) was slightly off. Changes in 0.3.24: * PP20: The first few bytes of some files were not decompressed properly, making some files unplayable (depending on the original format). Changes in 0.3.23: * IT: Global volume slides with both nibbles set preferred the ��slide up�� nibble over the ��slide down�� nibble in old OpenMPT versions, unlike other slides. Such old files are now imported correctly again. * IT: Fixed an edge case where, if the filter hit full cutoff / no resonance on the first tick of a row where a new delayed note would be triggered, the filter would be disabled even though it should stay active. Fixes trace.it by maddie. * XM: Out-of-range arpeggio clamping behaviour broke in OpenMPT 1.23.05.00. The arpeggios in Binary World by Dakota now play correctly again. * S3M: Support old-style sample pre-amp value in very early S3M files. * S3M: Only force-enable fast slides for files ST 3.00. Previously, any S3M file made with an ST3 version older than 3.20 enabled them. * M15: Improve tracker detection heuristics to never assume SoundTracker 2.0 if there is a huge number of Dxx commands, as that is a definite hint that they should be treated as volume slides. Fixes Monty On The Run by Master Blaster. Changes in 0.3.22: * IT: Disable retrigger with short notes quirk for modules saved with Chibi Tracker, as it does not implement that quirk. * MOD: Fix early song ending due to ProTracker pattern jump quirk (EEx + Dxx on same row) if infinite looping is disabled. Fixes Haunted Tracks.mod by Triace. * MOD: Vibrato type ��ramp down�� was upside down. Changes in 0.3.21: * IT: Vibrato was too fast in Old Effects mode since libopenmpt 0.3. * XM: Treat 8bitbubsy��s FT2 clone exactly like Fasttracker 2 with respect to compatibility and playback flags. For example, FT2 Pan Law was not applied. * DMF: Some files had a wrong tempo since libopenmpt 0.2.5705-beta15. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-885=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmodplug-devel-0.3.28-lp152.2.3.1 libmodplug1-0.3.28-lp152.2.3.1 libmodplug1-debuginfo-0.3.28-lp152.2.3.1 libopenmpt-debugsource-0.3.28-lp152.2.3.1 libopenmpt-devel-0.3.28-lp152.2.3.1 libopenmpt0-0.3.28-lp152.2.3.1 libopenmpt0-debuginfo-0.3.28-lp152.2.3.1 libopenmpt_modplug1-0.3.28-lp152.2.3.1 libopenmpt_modplug1-debuginfo-0.3.28-lp152.2.3.1 openmpt123-0.3.28-lp152.2.3.1 openmpt123-debuginfo-0.3.28-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libmodplug1-32bit-0.3.28-lp152.2.3.1 libmodplug1-32bit-debuginfo-0.3.28-lp152.2.3.1 libopenmpt0-32bit-0.3.28-lp152.2.3.1 libopenmpt0-32bit-debuginfo-0.3.28-lp152.2.3.1 libopenmpt_modplug1-32bit-0.3.28-lp152.2.3.1 libopenmpt_modplug1-32bit-debuginfo-0.3.28-lp152.2.3.1 References: https://bugzilla.suse.com/1186663

1 0

openSUSE-SU-2021:0878-1: important: Security update for containerd, docker, runc
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for containerd, docker, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0878-1 Rating: important References: #1168481 #1175081 #1175821 #1181594 #1181641 #1181677 #1181730 #1181732 #1181749 #1182451 #1182476 #1182947 #1183024 #1183855 #1184768 #1184962 #1185405 Cross-References: CVE-2021-21284 CVE-2021-21285 CVE-2021-21334 CVE-2021-30465 CVSS scores: CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2021-21334 (NVD) : 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-21334 (SUSE): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-30465 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-30465 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 13 fixes is now available. Description: This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594) * Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476). * CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732) * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730). * btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081) runc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962). * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821). * Fixed /dev/null is not available (bsc#1168481). * CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405). containerd was updated to v1.4.4 * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397). * Handle a requirement from docker (bsc#1181594). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-878=1 Package List: - openSUSE Leap 15.2 (noarch): docker-bash-completion-20.10.6_ce-lp152.2.12.1 docker-fish-completion-20.10.6_ce-lp152.2.12.1 docker-zsh-completion-20.10.6_ce-lp152.2.12.1 - openSUSE Leap 15.2 (x86_64): containerd-1.4.4-lp152.2.6.1 containerd-ctr-1.4.4-lp152.2.6.1 docker-20.10.6_ce-lp152.2.12.1 docker-debuginfo-20.10.6_ce-lp152.2.12.1 runc-1.0.0~rc93-lp152.2.3.1 runc-debuginfo-1.0.0~rc93-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21284.html https://www.suse.com/security/cve/CVE-2021-21285.html https://www.suse.com/security/cve/CVE-2021-21334.html https://www.suse.com/security/cve/CVE-2021-30465.html https://bugzilla.suse.com/1168481 https://bugzilla.suse.com/1175081 https://bugzilla.suse.com/1175821 https://bugzilla.suse.com/1181594 https://bugzilla.suse.com/1181641 https://bugzilla.suse.com/1181677 https://bugzilla.suse.com/1181730 https://bugzilla.suse.com/1181732 https://bugzilla.suse.com/1181749 https://bugzilla.suse.com/1182451 https://bugzilla.suse.com/1182476 https://bugzilla.suse.com/1182947 https://bugzilla.suse.com/1183024 https://bugzilla.suse.com/1183855 https://bugzilla.suse.com/1184768 https://bugzilla.suse.com/1184962 https://bugzilla.suse.com/1185405

1 0

openSUSE-SU-2021:0892-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0892-1 Rating: moderate References: #1186764 Cross-References: CVE-2020-17541 CVSS scores: CVE-2020-17541 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libjpeg-turbo fixes the following issues: - CVE-2020-17541: Fixed a stack-based buffer overflow in the "transform" component (bsc#1186764). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-892=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjpeg-turbo-1.5.3-lp152.8.6.1 libjpeg-turbo-debuginfo-1.5.3-lp152.8.6.1 libjpeg-turbo-debugsource-1.5.3-lp152.8.6.1 libjpeg62-62.2.0-lp152.8.6.1 libjpeg62-debuginfo-62.2.0-lp152.8.6.1 libjpeg62-devel-62.2.0-lp152.8.6.1 libjpeg62-turbo-1.5.3-lp152.8.6.1 libjpeg62-turbo-debugsource-1.5.3-lp152.8.6.1 libjpeg8-8.1.2-lp152.8.6.1 libjpeg8-debuginfo-8.1.2-lp152.8.6.1 libjpeg8-devel-8.1.2-lp152.8.6.1 libturbojpeg0-8.1.2-lp152.8.6.1 libturbojpeg0-debuginfo-8.1.2-lp152.8.6.1 - openSUSE Leap 15.2 (x86_64): libjpeg62-32bit-62.2.0-lp152.8.6.1 libjpeg62-32bit-debuginfo-62.2.0-lp152.8.6.1 libjpeg62-devel-32bit-62.2.0-lp152.8.6.1 libjpeg8-32bit-8.1.2-lp152.8.6.1 libjpeg8-32bit-debuginfo-8.1.2-lp152.8.6.1 libjpeg8-devel-32bit-8.1.2-lp152.8.6.1 libturbojpeg0-32bit-8.1.2-lp152.8.6.1 libturbojpeg0-32bit-debuginfo-8.1.2-lp152.8.6.1 References: https://www.suse.com/security/cve/CVE-2020-17541.html https://bugzilla.suse.com/1186764

1 0

openSUSE-SU-2021:0870-1: moderate: Security update for pam_radius
by opensuse-security＠opensuse.org 14 Jun '21

14 Jun '21

openSUSE Security Update: Security update for pam_radius ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0870-1 Rating: moderate References: #1163933 Cross-References: CVE-2015-9542 CVSS scores: CVE-2015-9542 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2015-9542 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pam_radius fixes the following issues: - CVE-2015-9542: pam_radius: buffer overflow in password field (bsc#1163933) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-870=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): pam_radius-1.4.0-lp152.4.3.1 pam_radius-debuginfo-1.4.0-lp152.4.3.1 pam_radius-debugsource-1.4.0-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): pam_radius-32bit-1.4.0-lp152.4.3.1 pam_radius-32bit-debuginfo-1.4.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2015-9542.html https://bugzilla.suse.com/1163933

1 0

openSUSE-SU-2021:0868-1: moderate: Security update for 389-ds
by opensuse-security＠opensuse.org 14 Jun '21

14 Jun '21

openSUSE Security Update: Security update for 389-ds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0868-1 Rating: moderate References: #1185356 Cross-References: CVE-2021-3514 CVSS scores: CVE-2021-3514 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for 389-ds fixes the following issues: - CVE-2021-3514: Fixed a sync_repl NULL pointer dereference in sync_create_state_control() (bsc#1185356) 389-ds was updated to version 1.4.3.23~git0.f53d0132b: Bump version to 1.4.3.23: * Issue 4725 - [RFE] DS - Update the password policy to support a Temporary Password Rules (#4727) * Issue 4759 - Fix coverity issue (#4760) * Issue 4656 - Fix cherry pick error around replication enabling * Issue 4701 - RFE - Exclude attributes from retro changelog (#4723) (#4746) * Issue 4742 - UI - should always use LDAPI path when calling CLI * Issue 4667 - incorrect accounting of readers in vattr rwlock (#4732) * Issue 4711 - SIGSEV with sync_repl (#4738) * Issue 4649 - fix testcase importing ContentSyncPlugin * Issue 2736 - Warnings from automatic shebang munging macro * Issue 2736 - https://github.com/389ds/389-ds-base/issues/2736 * Issue 4706 - negative wtime in access log for CMP operations Bump version to 1.4.3.22: * Issue 4671 - UI - Fix browser crashes * lib389 - Add ContentSyncPlugin class * Issue 4656 - lib389 - fix cherry pick error * Issue 4229 - Fix Rust linking * Issue 4658 - monitor - connection start date is incorrect * Issue 2621 - lib389 - backport ds_supports_new_changelog() * Issue 4656 - Make replication CLI backwards compatible with role name change * Issue 4656 - Remove problematic language from UI/CLI/lib389 * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin Bump version to 1.4.3.21: * Issue 4169 - UI - updates on the tuning page are not reflected in the UI * Issue 4588 - BUG - unable to compile without xcrypt (#4589) * Issue 4513 - Fix replication CI test failures (#4557) * Issue 4646 - CLI/UI - revise DNA plugin management * Issue 4644 - Large updates can reset the CLcache to the beginning of the changelog (#4647) * Issue 4649 - crash in sync_repl when a MODRDN create a cenotaph (#4652) * Issue 4615 - log message when psearch first exceeds max threads per conn Bump version to 1.4.3.20: * Issue 4324 - Some architectures the cache line size file does not exist * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-868=1 Package List: - openSUSE Leap 15.2 (x86_64): 389-ds-1.4.3.23~git0.f53d0132b-lp152.2.15.1 389-ds-debuginfo-1.4.3.23~git0.f53d0132b-lp152.2.15.1 389-ds-debugsource-1.4.3.23~git0.f53d0132b-lp152.2.15.1 389-ds-devel-1.4.3.23~git0.f53d0132b-lp152.2.15.1 389-ds-snmp-1.4.3.23~git0.f53d0132b-lp152.2.15.1 389-ds-snmp-debuginfo-1.4.3.23~git0.f53d0132b-lp152.2.15.1 lib389-1.4.3.23~git0.f53d0132b-lp152.2.15.1 libsvrcore0-1.4.3.23~git0.f53d0132b-lp152.2.15.1 libsvrcore0-debuginfo-1.4.3.23~git0.f53d0132b-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-3514.html https://bugzilla.suse.com/1185356

1 0

openSUSE-SU-2021:0861-1: moderate: Security update for python-HyperKitty
by opensuse-security＠opensuse.org 09 Jun '21

09 Jun '21

openSUSE Security Update: Security update for python-HyperKitty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0861-1 Rating: moderate References: #1186575 Cross-References: CVE-2021-33038 CVSS scores: CVE-2021-33038 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-HyperKitty fixes the following issues: - CVE-2021-33038 [boo#1186575], information disclosure when importing a private mailing list Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-861=1 Package List: - openSUSE Leap 15.2 (noarch): python3-HyperKitty-1.3.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-33038.html https://bugzilla.suse.com/1186575

1 0

openSUSE-SU-2021:0858-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 09 Jun '21

09 Jun '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0858-1 Rating: important References: #1185633 #1186696 Cross-References: CVE-2021-29951 CVE-2021-29964 CVE-2021-29967 CVSS scores: CVE-2021-29951 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.11.0 ESR (bsc#1186696) * CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message * CVE-2021-29967: Memory safety bugs fixed in Firefox This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-858=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.11.0-lp152.2.58.1 MozillaFirefox-branding-upstream-78.11.0-lp152.2.58.1 MozillaFirefox-buildsymbols-78.11.0-lp152.2.58.1 MozillaFirefox-debuginfo-78.11.0-lp152.2.58.1 MozillaFirefox-debugsource-78.11.0-lp152.2.58.1 MozillaFirefox-devel-78.11.0-lp152.2.58.1 MozillaFirefox-translations-common-78.11.0-lp152.2.58.1 MozillaFirefox-translations-other-78.11.0-lp152.2.58.1 References: https://www.suse.com/security/cve/CVE-2021-29951.html https://www.suse.com/security/cve/CVE-2021-29964.html https://www.suse.com/security/cve/CVE-2021-29967.html https://bugzilla.suse.com/1185633 https://bugzilla.suse.com/1186696

1 0