June 2021 - openSUSE Security Announce

openSUSE-SU-2021:0857-1: important: Security update for libX11
by opensuse-security＠opensuse.org 09 Jun '21

09 Jun '21

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0857-1 Rating: important References: #1186643 Cross-References: CVE-2021-31535 CVSS scores: CVE-2021-31535 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - Regression in the fix for CVE-2021-31535, causing segfaults for xforms applications like fdesign (bsc#1186643) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-857=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libX11-6-1.6.5-lp152.5.18.1 libX11-6-debuginfo-1.6.5-lp152.5.18.1 libX11-debugsource-1.6.5-lp152.5.18.1 libX11-devel-1.6.5-lp152.5.18.1 libX11-xcb1-1.6.5-lp152.5.18.1 libX11-xcb1-debuginfo-1.6.5-lp152.5.18.1 - openSUSE Leap 15.2 (x86_64): libX11-6-32bit-1.6.5-lp152.5.18.1 libX11-6-32bit-debuginfo-1.6.5-lp152.5.18.1 libX11-devel-32bit-1.6.5-lp152.5.18.1 libX11-xcb1-32bit-1.6.5-lp152.5.18.1 libX11-xcb1-32bit-debuginfo-1.6.5-lp152.5.18.1 - openSUSE Leap 15.2 (noarch): libX11-data-1.6.5-lp152.5.18.1 References: https://www.suse.com/security/cve/CVE-2021-31535.html https://bugzilla.suse.com/1186643

1 0

openSUSE-SU-2021:0851-1: moderate: Security update for python-py
by opensuse-security＠opensuse.org 07 Jun '21

07 Jun '21

openSUSE Security Update: Security update for python-py ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0851-1 Rating: moderate References: #1179805 #1184505 Cross-References: CVE-2020-29651 CVSS scores: CVE-2020-29651 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29651 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for python-py fixes the following issues: - CVE-2020-29651: Fixed regular expression denial of service in svnwc.py (bsc#1179805, bsc#1184505). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-851=1 Package List: - openSUSE Leap 15.2 (noarch): python2-py-1.8.1-lp152.2.6.1 python3-py-1.8.1-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-29651.html https://bugzilla.suse.com/1179805 https://bugzilla.suse.com/1184505

1 0

openSUSE-SU-2021:0853-1: moderate: Security update for csync2
by opensuse-security＠opensuse.org 07 Jun '21

07 Jun '21

openSUSE Security Update: Security update for csync2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0853-1 Rating: moderate References: #1147137 #1147139 Cross-References: CVE-2019-15522 CVE-2019-15523 CVSS scores: CVE-2019-15522 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-15522 (SUSE): 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2019-15523 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2019-15523 (SUSE): 2.6 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for csync2 fixes the following issues: - CVE-2019-15522: Fixed an issue where daemon fails to enforce TLS (bsc#1147137) - CVE-2019-15523: Fixed an incorrect TLS handshake error handling (bsc#1147139) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-853=1 Package List: - openSUSE Leap 15.2 (x86_64): csync2-2.0+git.1461714863.10636a4-lp152.5.3.1 csync2-debuginfo-2.0+git.1461714863.10636a4-lp152.5.3.1 csync2-debugsource-2.0+git.1461714863.10636a4-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-15522.html https://www.suse.com/security/cve/CVE-2019-15523.html https://bugzilla.suse.com/1147137 https://bugzilla.suse.com/1147139

1 0

openSUSE-SU-2021:0846-1: important: Security update for umoci
by opensuse-security＠opensuse.org 07 Jun '21

07 Jun '21

openSUSE Security Update: Security update for umoci ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0846-1 Rating: important References: #1184147 Cross-References: CVE-2021-29136 CVSS scores: CVE-2021-29136 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-29136 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for umoci fixes the following issues: Update to v0.4.7 (bsc#1184147). - CVE-2021-29136: Fixed overwriting of host files via malicious layer (bsc#1184147). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-846=1 Package List: - openSUSE Leap 15.2 (x86_64): umoci-0.4.7-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-29136.html https://bugzilla.suse.com/1184147

1 0

openSUSE-SU-2021:0845-1: moderate: Security update for inn
by opensuse-security＠opensuse.org 07 Jun '21

07 Jun '21

openSUSE Security Update: Security update for inn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0845-1 Rating: moderate References: #1182321 Cross-References: CVE-2021-31998 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for inn fixes the following issues: - CVE-2021-31998: change user to news before calling innupgrade, which could have allow local privilege escalation. [boo#1182321] This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-845=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): inn-2.6.2-bp152.2.8.1 inn-devel-2.6.2-bp152.2.8.1 mininews-2.6.2-bp152.2.8.1 References: https://www.suse.com/security/cve/CVE-2021-31998.html https://bugzilla.suse.com/1182321

1 0

openSUSE-SU-2021:0843-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Jun '21

06 Jun '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0843-1 Rating: important References: #1087082 #1133021 #1152457 #1152489 #1155518 #1156395 #1164648 #1177666 #1178418 #1179519 #1179827 #1179851 #1182378 #1182999 #1183346 #1183976 #1184259 #1185428 #1185495 #1185589 #1185645 #1185703 #1185725 #1185758 #1185861 #1185863 #1185911 #1185938 #1185982 #1186320 #1186416 #1186439 #1186460 #1186484 #1186573 Cross-References: CVE-2020-24586 CVE-2020-24587 CVE-2020-24588 CVE-2020-26139 CVE-2020-26141 CVE-2020-26145 CVE-2020-26147 CVE-2021-23134 CVE-2021-32399 CVE-2021-33034 CVE-2021-33200 CVE-2021-3491 CVSS scores: CVE-2020-24586 (NVD) : 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2020-24586 (SUSE): 4.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVE-2020-24587 (NVD) : 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2020-24587 (SUSE): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-24588 (NVD) : 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2020-24588 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-26139 (NVD) : 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26139 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-26141 (SUSE): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26145 (SUSE): 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26147 (NVD) : 5.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N CVE-2021-23134 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-23134 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32399 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32399 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-33034 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-33034 (SUSE): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-33200 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33200 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3491 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 23 fixes is now available. Description: The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484). - CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an arbitrary values. (bsc#1186111) - CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062) - CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their privileges. (bnc#1186060) - CVE-2021-3491: Fixed a potential heap overflow in mem_rw(). This vulnerability is related to the PROVIDE_BUFFERS operation, which allowed the MAX_RW_COUNT limit to be bypassed (bsc#1185642). - CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611). - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network packets and/or exfiltrate user data (bnc#1185859). - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862). - CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. (bnc#1185861) - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (bnc#1185859). - CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. (bnc#1185860) - CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bnc#1185987) The following non-security bugs were fixed: - ACPI / hotplug / PCI: Fix reference count leak in enable_slot() (git-fixes). - ACPI: GTDT: Do not corrupt interrupt mappings on watchdow probe failure (git-fixes). - ACPI: custom_method: fix a possible memory leak (git-fixes). - ACPI: custom_method: fix potential use-after-free issue (git-fixes). - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro (git-fixes). - ALSA: bebob: enable to deliver MIDI messages for multiple ports (git-fixes). - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 (git-fixes). - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency (git-fixes). - ALSA: firewire-lib: fix calculation for size of IR context payload (git-fixes). - ALSA: firewire-lib: fix check for the size of isochronous packet payload (git-fixes). - ALSA: hda/conexant: Re-order CX5066 quirk table entries (git-fixes). - ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable (git-fixes). - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 (git-fixes). - ALSA: hda/realtek: Headphone volume is controlled by Front mixer (git-fixes). - ALSA: hda/realtek: reset eapd coeff to default value for alc287 (git-fixes). - ALSA: hda: fixup headset for ASUS GU502 laptop (git-fixes). - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP (git-fixes). - ALSA: hdsp: do not disable if not enabled (git-fixes). - ALSA: hdspm: do not disable if not enabled (git-fixes). - ALSA: intel8x0: Do not update period unless prepared (git-fixes). - ALSA: line6: Fix racy initialization of LINE6 MIDI (git-fixes). - ALSA: rme9652: do not disable if not enabled (git-fixes). - ALSA: usb-audio: Validate MS endpoint descriptors (git-fixes). - ALSA: usb-audio: fix control-request direction (git-fixes). - ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci (git-fixes). - ALSA: usb-audio: scarlett2: Improve driver startup messages (git-fixes). - ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static (git-fixes). - ARM64: vdso32: Install vdso32 from vdso_install (git-fixes). - ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet (git-fixes). - ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF (git-fixes). - ASoC: cs35l33: fix an error code in probe() (git-fixes). - ASoC: cs42l42: Regmap must use_single_read/write (git-fixes). - ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() (git-fixes). - ASoC: rsnd: core: Check convert rate in rsnd_hw_params (git-fixes). - ASoC: rt286: Generalize support for ALC3263 codec (git-fixes). - ASoC: rt286: Make RT286_SET_GPIO_* readable and writable (git-fixes). - Bluetooth: L2CAP: Fix handling LE modes by L2CAP_OPTIONS (git-fixes). - Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes). - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default (git-fixes). - Bluetooth: check for zapped sk before connecting (git-fixes). - Bluetooth: initialize skb_queue_head at l2cap_chan_create() (git-fixes). - Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM (git-fixes). - Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185725). - Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185725). - Drivers: hv: vmbus: Use after free in __vmbus_open() (git-fixes). - Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices (git-fixes). - Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state (git-fixes). - KVM: s390: fix guarded storage control register handling (bsc#1133021). - Move upstreamed media fixes into sorted section - NFC: nci: fix memory leak in nci_allocate_device (git-fixes). - PCI/RCEC: Fix RCiEP device to RCEC association (git-fixes). - PCI: Allow VPD access for QLogic ISP2722 (git-fixes). - PCI: PM: Do not read power state in pci_enable_device_flags() (git-fixes). - PCI: Release OF node in pci_scan_device()'s error path (git-fixes). - PCI: endpoint: Fix missing destroy_workqueue() (git-fixes). - PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() (git-fixes). - PCI: thunder: Fix compile testing (git-fixes). - PM / devfreq: Use more accurate returned new_freq as resume_freq (git-fixes). - RDMA/addr: create addr_wq with WQ_MEM_RECLAIM flag (bsc#1183346). - RDMA/core: create ib_cm with WQ_MEM_RECLAIM flag (bsc#1183346). - RDMA/hns: Delete redundant abnormal interrupt status (git-fixes). - RDMA/hns: Delete redundant condition judgment related to eq (git-fixes). - RDMA/qedr: Fix error return code in qedr_iw_connect() (jsc#SLE-8215). - RDMA/srpt: Fix error return code in srpt_cm_req_recv() (git-fixes). - Revert "arm64: vdso: Fix compilation with clang older than 8" (git-fixes). - Revert "gdrom: fix a memory leak bug" (git-fixes). - Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" (git-fixes). - Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" (git-fixes). - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") (git-fixes). - SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428). - SUNRPC: More fixes for backlog congestion (bsc#1185428). - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet (git-fixes). - USB: Add reset-resume quirk for WD19's Realtek Hub (git-fixes). - USB: serial: pl2303: add support for PL2303HXN (bsc#1186320). - USB: serial: pl2303: fix line-speed handling on newer chips (bsc#1186320). - USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check (git-fixes). - USB: trancevibrator: fix control-request direction (git-fixes). - amdgpu: avoid incorrect %hu format string (git-fixes). - arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes). - arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes). - arm64: avoid -Woverride-init warning (git-fixes). - arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes). - arm64: kdump: update ppos when reading elfcorehdr (git-fixes). - arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes). - arm64: link with -z norelro for LLD or aarch64-elf (git-fixes). - arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes). - arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes). - arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes). - arm64: vdso32: make vdso32 install conditional (git-fixes). - arm: mm: use __pfn_to_section() to get mem_section (git-fixes). - ata: ahci: Disable SXS for Hisilicon Kunpeng920 (git-fixes). - blk-iocost: ioc_pd_free() shouldn't assume irq disabled (git-fixes). - blk-mq: Swap two calls in blk_mq_exit_queue() (git-fixes). - block/genhd: use atomic_t for disk_event->block (bsc#1185497). - block: Fix three kernel-doc warnings (git-fixes). - block: fix get_max_io_size() (git-fixes). - bnxt_en: Fix RX consumer index logic in the error path (git-fixes). - bnxt_en: fix ternary sign extension bug in bnxt_show_temp() (git-fixes). - bpf: Fix leakage of uninitialized bpf stack under speculation (bsc#1155518). - bpf: Fix masking negation logic upon negative dst register (bsc#1155518). - btrfs: fix race between transaction aborts and fsyncs leading to use-after-free (bsc#1186441). - btrfs: fix race when picking most recent mod log operation for an old root (bsc#1186439). - cdc-wdm: untangle a circular dependency between callback and softint (git-fixes). - cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom (git-fixes). - cdrom: gdrom: initialize global variable at init time (git-fixes). - ceph: do not clobber i_snap_caps on non-I_NEW inode (bsc#1186501). - ceph: fix inode leak on getattr error in __fh_to_dentry (bsc#1186501). - ceph: fix up error handling with snapdirs (bsc#1186501). - ceph: only check pool permissions for regular files (bsc#1186501). - cfg80211: scan: drop entry from hidden_list on overflow (git-fixes). - clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return (git-fixes). - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (bsc#1185758). - crypto: api - check for ERR pointers in crypto_destroy_tfm() (git-fixes). - crypto: mips/poly1305 - enable for all MIPS processors (git-fixes). - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (git-fixes). - crypto: qat - Fix a double free in adf_create_ring (git-fixes). - crypto: qat - do not release uninitialized resources (git-fixes). - crypto: qat - fix error path in adf_isr_resource_alloc() (git-fixes). - crypto: qat - fix unmap invalid dma address (git-fixes). - crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c (git-fixes). - crypto: stm32/hash - Fix PM reference leak on stm32-hash.c (git-fixes). - cxgb4: Fix unintentional sign extension issues (git-fixes). - dm: avoid filesystem lookup in dm_get_dev_t() (git-fixes). - dmaengine: dw-edma: Fix crash on loading/unloading driver (git-fixes). - docs: kernel-parameters: Add gpio_mockup_named_lines (git-fixes). - docs: kernel-parameters: Move gpio-mockup for alphabetic order (git-fixes). - drivers: hv: Fix whitespace errors (bsc#1185725). - drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool' (git-fixes). - drm/amd/display: Fix two cursor duplication when using overlay (git-fixes). - drm/amd/display: Force vsync flip when reconfiguring MPCC (git-fixes). - drm/amd/display: Reject non-zero src_y and src_x for video planes (git-fixes). - drm/amd/display: fix dml prefetch validation (git-fixes). - drm/amd/display: fixed divide by zero kernel crash during dsc enablement (git-fixes). - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f (git-fixes). - drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang (git-fixes). - drm/amdgpu: fix NULL pointer dereference (git-fixes). - drm/amdgpu: mask the xgmi number of hops reported from psp to kfd (git-fixes). - drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug (git-fixes). - drm/i915: Avoid div-by-zero on gen2 (git-fixes). - drm/meson: fix shutdown crash when component not probed (git-fixes). - drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal (git-fixes). - drm/msm/mdp5: Do not multiply vclk line count by 100 (git-fixes). - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected (git-fixes). - drm/radeon: Avoid power table parsing memory leaks (git-fixes). - drm/radeon: Fix off-by-one power_state index heap overwrite (git-fixes). - drm/vkms: fix misuse of WARN_ON (git-fixes). - drm: Added orientation quirk for OneGX1 Pro (git-fixes). - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit (git-fixes). - extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged (git-fixes). - extcon: arizona: Fix various races on driver unbind (git-fixes). - fbdev: zero-fill colormap in fbcmap.c (git-fixes). - firmware: arm_scpi: Prevent the ternary sign expansion bug (git-fixes). - fs/epoll: restore waking from ep_done_scan() (bsc#1183868). - ftrace: Handle commands when closing set_ftrace_filter file (git-fixes). - futex: Change utime parameter to be 'const ... *' (git-fixes). - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI (bsc#1164648). - futex: Get rid of the val2 conditional dance (git-fixes). - futex: Make syscall entry points less convoluted (git-fixes). - genirq/irqdomain: Do not try to free an interrupt that has no (git-fixes) - genirq: Disable interrupts for force threaded handlers (git-fixes) - genirq: Reduce irqdebug cacheline bouncing (bsc#1185703 ltc#192641). - gpio: xilinx: Correct kernel doc for xgpio_probe() (git-fixes). - gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 (git-fixes). - hrtimer: Update softirq_expires_next correctly after (git-fixes) - hwmon: (occ) Fix poll rate limiting (git-fixes). - i2c: Add I2C_AQ_NO_REP_START adapter quirk (git-fixes). - i2c: bail out early when RDWR parameters are wrong (git-fixes). - i2c: i801: Do not generate an interrupt on bus reset (git-fixes). - i2c: s3c2410: fix possible NULL pointer deref on read message after write (git-fixes). - i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E (git-fixes). - i40e: Fix PHY type identifiers for 2.5G and 5G adapters (git-fixes). - i40e: Fix use-after-free in i40e_client_subtask() (git-fixes). - i40e: fix broken XDP support (git-fixes). - i40e: fix the restart auto-negotiation after FEC modified (git-fixes). - ibmvfc: Avoid move login if fast fail is enabled (bsc#1185938 ltc#192043). - ibmvfc: Handle move login failure (bsc#1185938 ltc#192043). - ibmvfc: Reinit target retries (bsc#1185938 ltc#192043). - ibmvnic: remove default label from to_string switch (bsc#1152457 ltc#174432 git-fixes). - ics932s401: fix broken handling of errors when word reading fails (git-fixes). - iio: adc: ad7124: Fix missbalanced regulator enable / disable on error (git-fixes). - iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers (git-fixes). - iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: ad7793: Add missing error code in ad7793_setup() (git-fixes). - iio: gyro: fxas21002c: balance runtime power in error path (git-fixes). - iio: gyro: mpu3050: Fix reported temperature value (git-fixes). - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error (git-fixes). - iio: tsl2583: Fix division by a zero lux_val (git-fixes). - intel_th: Consistency and off-by-one fix (git-fixes). - iommu/amd: Add support for map/unmap_resource (jsc#ECO-3482). - ipc/mqueue, msg, sem: Avoid relying on a stack reference past its expiry (bsc#1185988). - ipmi/watchdog: Stop watchdog timer when the current action is 'none' (bsc#1184855). - kernel-docs.spec.in: Build using an utf-8 locale. Sphinx cannot handle UTF-8 input in non-UTF-8 locale. - leds: lp5523: check return value of lp5xx_read and jump to cleanup code (git-fixes). - lpfc: Decouple port_template and vport_template (bsc#185032). - mac80211: clear the beacon's CRC after channel switch (git-fixes). - md-cluster: fix use-after-free issue when removing rdev (bsc#1184082). - md/raid1: properly indicate failure when ending a failed write request (bsc#1185680). - md: do not flush workqueue unconditionally in md_open (bsc#1184081). - md: factor out a mddev_find_locked helper from mddev_find (bsc#1184081). - md: md_open returns -EBUSY when entering racing area (bsc#1184081). - md: split mddev_find (bsc#1184081). - media: adv7604: fix possible use-after-free in adv76xx_remove() (git-fixes). - media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB (git-fixes). - media: dvb-usb: fix memory leak in dvb_usb_adapter_init (git-fixes). - media: em28xx: fix memory leak (git-fixes). - media: gspca/sq905.c: fix uninitialized variable (git-fixes). - media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() (git-fixes). - media: i2c: adv7842: fix possible use-after-free in adv7842_remove() (git-fixes). - media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() (git-fixes). - media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() (git-fixes). - media: ite-cir: check for receive overflow (git-fixes). - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs (git-fixes). - media: platform: sti: Fix runtime PM imbalance in regs_show (git-fixes). - media: tc358743: fix possible use-after-free in tc358743_remove() (git-fixes). - mfd: arizona: Fix rumtime PM imbalance on error (git-fixes). - misc/uss720: fix memory leak in uss720_probe (git-fixes). - mlxsw: spectrum_mr: Update egress RIF list before route's action (git-fixes). - mmc: block: Update ext_csd.cache_ctrl if it was written (git-fixes). - mmc: core: Do a power cycle when the CMD11 fails (git-fixes). - mmc: core: Set read only for SD cards with permanent write protect bit (git-fixes). - mmc: sdhci-pci-gli: increase 1.8V regulator wait (git-fixes). - mmc: sdhci-pci: Add PCI IDs for Intel LKF (git-fixes). - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers (git-fixes). - mmc: sdhci: Check for reset prior to DMA address unmap (git-fixes). - net, xdp: Update pkt_type if generic XDP changes unicast MAC (git-fixes). - net: enetc: fix link error again (git-fixes). - net: hns3: Fix for geneve tx checksum bug (git-fixes). - net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet() (git-fixes). - net: hns3: clear unnecessary reset request in hclge_reset_rebuild (git-fixes). - net: hns3: disable phy loopback setting in hclge_mac_start_phy (git-fixes). - net: hns3: fix for vxlan gpe tx checksum bug (git-fixes). - net: hns3: fix incorrect configuration for igu_egu_hw_err (git-fixes). - net: hns3: initialize the message content in hclge_get_link_mode() (git-fixes). - net: hns3: use netif_tx_disable to stop the transmit queue (git-fixes). - net: thunderx: Fix unintentional sign extension issue (git-fixes). - net: usb: fix memory leak in smsc75xx_bind (git-fixes). - netdevice: Add missing IFF_PHONY_HEADROOM self-definition (git-fixes). - netfilter: conntrack: add new sysctl to disable RST check (bsc#1183947 bsc#1185950). - netfilter: conntrack: avoid misleading 'invalid' in log message (bsc#1183947 bsc#1185950). - netfilter: conntrack: improve RST handling when tuple is re-used (bsc#1183947 bsc#1185950). - nvme-core: add cancel tagset helpers (bsc#1183976). - nvme-fabrics: decode host pathing error for connect (bsc#1179827). - nvme-fc: check sgl supported by target (bsc#1179827). - nvme-fc: clear q_live at beginning of association teardown (bsc#1186479). - nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted (bsc#1184259). - nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() (bsc#1184259). - nvme-fc: short-circuit reconnect retries (bsc#1179827). - nvme-multipath: fix double initialization of ANA state (bsc#1178612, bsc#1184259). - nvme-pci: Remove tag from process cq (git-fixes). - nvme-pci: Remove two-pass completions (git-fixes). - nvme-pci: Simplify nvme_poll_irqdisable (git-fixes). - nvme-pci: align io queue count with allocted nvme_queue in (git-fixes). - nvme-pci: avoid race between nvme_reap_pending_cqes() and nvme_poll() (git-fixes). - nvme-pci: dma read memory barrier for completions (git-fixes). - nvme-pci: fix "slimmer CQ head update" (git-fixes). - nvme-pci: make sure write/poll_queues less or equal then cpu (git-fixes). - nvme-pci: remove last_sq_tail (git-fixes). - nvme-pci: remove volatile cqes (git-fixes). - nvme-pci: slimmer CQ head update (git-fixes). - nvme-pci: use simple suspend when a HMB is enabled (git-fixes). - nvme-tcp: Fix possible race of io_work and direct send (git-fixes). - nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT (git-fixes). - nvme-tcp: add clean action for failed reconnection (bsc#1183976). - nvme-tcp: fix kconfig dependency warning when !CRYPTO (git-fixes). - nvme-tcp: fix misuse of __smp_processor_id with preemption (git-fixes). - nvme-tcp: fix possible hang waiting for icresp response (bsc#1179519). - nvme-tcp: use cancel tagset helper for tear down (bsc#1183976). - nvme: Fix NULL dereference for pci nvme controllers (bsc#1182378). - nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() (bsc#1184259). - nvme: define constants for identification values (git-fixes). - nvme: do not intialize hwmon for discovery controllers (bsc#1184259). - nvme: do not intialize hwmon for discovery controllers (git-fixes). - nvme: document nvme controller states (git-fixes). - nvme: explicitly update mpath disk capacity on revalidation (git-fixes). - nvme: expose reconnect_delay and ctrl_loss_tmo via sysfs (bsc#1182378). - nvme: fix controller instance leak (git-fixes). - nvme: fix deadlock in disconnect during scan_work and/or ana_work (git-fixes). - nvme: fix possible deadlock when I/O is blocked (git-fixes). - nvme: remove superfluous else in nvme_ctrl_loss_tmo_store (bsc#1182378). - nvme: retrigger ANA log update if group descriptor isn't found (git-fixes) - nvme: simplify error logic in nvme_validate_ns() (bsc#1184259). - nvmet: fix a memory leak (git-fixes). - nvmet: seset ns->file when open fails (bsc#1183873). - nvmet: use new ana_log_size instead the old one (bsc#1184259). - nxp-i2c: restore includes for kABI (bsc#1185589). - nxp-nci: add NXP1002 id (bsc#1185589). - phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() (git-fixes). - pinctrl: ingenic: Improve unreachable code generation (git-fixes). - pinctrl: samsung: use 'int' for register masks in Exynos (git-fixes). - platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue (git-fixes). - platform/x86: intel_pmc_core: Do not use global pmcdev in quirks (git-fixes). - platform/x86: thinkpad_acpi: Correct thermal sensor allocation (git-fixes). - posix-timers: Preserve return value in clock_adjtime32() (git-fixes) - power: supply: Use IRQF_ONESHOT (git-fixes). - power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() (git-fixes). - power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() (git-fixes). - powerpc/64s: Fix crashes when toggling entry flush barrier (bsc#1177666 git-fixes). - powerpc/64s: Fix crashes when toggling stf barrier (bsc#1087082 git-fixes). - qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth (git-fixes). - rtc: pcf2127: handle timestamp interrupts (bsc#1185495). - s390/dasd: fix hanging DASD driver unbind (bsc#1183932 LTC#192153). - s390/entry: save the caller of psw_idle (bsc#1185677). - s390/kdump: fix out-of-memory with PCI (bsc#1182257 LTC#191375). - sched/eas: Do not update misfit status if the task is pinned (git-fixes) - sched/fair: Avoid stale CPU util_est value for schedutil in (git-fixes) - sched/fair: Fix unfairness caused by missing load decay (git-fixes) - scripts/git_sort/git_sort.py: add bpf git repo - scsi: core: Run queue in case of I/O resource contention failure (bsc#1186416). - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (bsc#1179851). - scsi: libfc: Avoid invoking response handler twice if ep is already completed (bsc#1186573). - scsi: lpfc: Add a option to enable interlocked ABTS before job completion (bsc#1186451). - scsi: lpfc: Add ndlp kref accounting for resume RPI path (bsc#1186451). - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology (bsc#1186451). - scsi: lpfc: Fix Node recovery when driver is handling simultaneous PLOGIs (bsc#1186451). - scsi: lpfc: Fix bad memory access during VPD DUMP mailbox command (bsc#1186451). - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the SGLs (bsc#1186451). - scsi: lpfc: Fix node handling for Fabric Controller and Domain Controller (bsc#1186451). - scsi: lpfc: Fix non-optimized ERSP handling (bsc#1186451). - scsi: lpfc: Fix unreleased RPIs when NPIV ports are created (bsc#1186451). - scsi: lpfc: Ignore GID-FT response that may be received after a link flip (bsc#1186451). - scsi: lpfc: Reregister FPIN types if ELS_RDF is received from fabric controller (bsc#1186451). - scsi: lpfc: Update lpfc version to 12.8.0.10 (bsc#1186451). - sctp: delay auto_asconf init until binding the first addr (<cover.1620748346.git.mkubecek(a)suse.cz>). - serial: core: fix suspicious security_locked_down() call (git-fixes). - serial: core: return early on unsupported ioctls (git-fixes). - serial: sh-sci: Fix off-by-one error in FIFO threshold register setting (git-fixes). - serial: stm32: fix incorrect characters on console (git-fixes). - serial: stm32: fix tx_empty condition (git-fixes). - serial: tegra: Fix a mask operation that is always true (git-fixes). - smc: disallow TCP_ULP in smc_setsockopt() (git-fixes). - spi: ath79: always call chipselect function (git-fixes). - spi: ath79: remove spi-master setup and cleanup assignment (git-fixes). - spi: dln2: Fix reference leak to master (git-fixes). - spi: omap-100k: Fix reference leak to master (git-fixes). - spi: qup: fix PM reference leak in spi_qup_remove() (git-fixes). - spi: spi-fsl-dspi: Fix a resource leak in an error handling path (git-fixes). - staging: emxx_udc: fix loop in _nbu2ss_nuke() (git-fixes). - staging: iio: cdc: ad7746: avoid overwrite of num_channels (git-fixes). - tcp: fix to update snd_wl1 in bulk receiver fast path (<cover.1620748346.git.mkubecek(a)suse.cz>). - thermal/drivers/ti-soc-thermal/bandgap Remove unused variable 'val' (git-fixes). - thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue (git-fixes). - tracing: Map all PIDs to command lines (git-fixes). - tty: amiserial: fix TIOCSSERIAL permission check (git-fixes). - tty: fix memory leak in vc_deallocate (git-fixes). - tty: moxa: fix TIOCSSERIAL jiffies conversions (git-fixes). - tty: moxa: fix TIOCSSERIAL permission check (git-fixes). - uio: uio_hv_generic: use devm_kzalloc() for private data alloc (git-fixes). - uio_hv_generic: Fix a memory leak in error handling paths (git-fixes). - uio_hv_generic: Fix another memory leak in error handling paths (git-fixes). - uio_hv_generic: add missed sysfs_remove_bin_file (git-fixes). - usb: core: hub: Fix PM reference leak in usb_port_resume() (git-fixes). - usb: core: hub: fix race condition about TRSMRCY of resume (git-fixes). - usb: dwc2: Fix gadget DMA unmap direction (git-fixes). - usb: dwc3: gadget: Enable suspend events (git-fixes). - usb: dwc3: gadget: Return success always for kick transfer in ep queue (git-fixes). - usb: dwc3: omap: improve extcon initialization (git-fixes). - usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield (git-fixes). - usb: fotg210-hcd: Fix an error message (git-fixes). - usb: gadget/function/f_fs string table fix for multiple languages (git-fixes). - usb: gadget: dummy_hcd: fix gpf in gadget_setup (git-fixes). - usb: gadget: f_uac1: validate input parameters (git-fixes). - usb: gadget: f_uac2: validate input parameters (git-fixes). - usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() (git-fixes). - usb: gadget: uvc: add bInterval checking for HS mode (git-fixes). - usb: musb: fix PM reference leak in musb_irq_work() (git-fixes). - usb: sl811-hcd: improve misleading indentation (git-fixes). - usb: webcam: Invalid size of Processing Unit Descriptor (git-fixes). - usb: xhci: Fix port minor revision (git-fixes). - usb: xhci: Increase timeout for HC halt (git-fixes). - vgacon: Record video mode changes with VT_RESIZEX (git-fixes). - video: hyperv_fb: Add ratelimit on error message (bsc#1185725). - vrf: fix a comment about loopback device (git-fixes). - watchdog/softlockup: Remove obsolete check of last reported task (bsc#1185982). - watchdog/softlockup: report the overall time of softlockups (bsc#1185982). - watchdog: explicitly update timestamp when reporting softlockup (bsc#1185982). - watchdog: rename __touch_watchdog() to a better descriptive name (bsc#1185982). - whitespace cleanup - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join (git-fixes). - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt (git-fixes). - workqueue: Minor follow-ups to the rescuer destruction change (bsc#1185911). - workqueue: more destroy_workqueue() fixes (bsc#1185911). - x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported (bsc#1152489). - xhci: Do not use GFP_KERNEL in (potentially) atomic context (git-fixes). - xhci: check control context is valid before dereferencing it (git-fixes). - xhci: fix potential array out of bounds with several interrupters (git-fixes). - xsk: Respect device's headroom and tailroom on generic xmit path (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-843=1 Package List: - openSUSE Leap 15.2 (noarch): kernel-devel-5.3.18-lp152.78.1 kernel-docs-5.3.18-lp152.78.1 kernel-docs-html-5.3.18-lp152.78.1 kernel-macros-5.3.18-lp152.78.1 kernel-source-5.3.18-lp152.78.1 kernel-source-vanilla-5.3.18-lp152.78.1 - openSUSE Leap 15.2 (x86_64): kernel-debug-5.3.18-lp152.78.1 kernel-debug-debuginfo-5.3.18-lp152.78.1 kernel-debug-debugsource-5.3.18-lp152.78.1 kernel-debug-devel-5.3.18-lp152.78.1 kernel-debug-devel-debuginfo-5.3.18-lp152.78.1 kernel-default-5.3.18-lp152.78.1 kernel-default-base-5.3.18-lp152.78.1.lp152.8.34.1 kernel-default-base-rebuild-5.3.18-lp152.78.1.lp152.8.34.1 kernel-default-debuginfo-5.3.18-lp152.78.1 kernel-default-debugsource-5.3.18-lp152.78.1 kernel-default-devel-5.3.18-lp152.78.1 kernel-default-devel-debuginfo-5.3.18-lp152.78.1 kernel-kvmsmall-5.3.18-lp152.78.1 kernel-kvmsmall-debuginfo-5.3.18-lp152.78.1 kernel-kvmsmall-debugsource-5.3.18-lp152.78.1 kernel-kvmsmall-devel-5.3.18-lp152.78.1 kernel-kvmsmall-devel-debuginfo-5.3.18-lp152.78.1 kernel-obs-build-5.3.18-lp152.78.1 kernel-obs-build-debugsource-5.3.18-lp152.78.1 kernel-obs-qa-5.3.18-lp152.78.1 kernel-preempt-5.3.18-lp152.78.1 kernel-preempt-debuginfo-5.3.18-lp152.78.1 kernel-preempt-debugsource-5.3.18-lp152.78.1 kernel-preempt-devel-5.3.18-lp152.78.1 kernel-preempt-devel-debuginfo-5.3.18-lp152.78.1 kernel-syms-5.3.18-lp152.78.1 References: https://www.suse.com/security/cve/CVE-2020-24586.html https://www.suse.com/security/cve/CVE-2020-24587.html https://www.suse.com/security/cve/CVE-2020-24588.html https://www.suse.com/security/cve/CVE-2020-26139.html https://www.suse.com/security/cve/CVE-2020-26141.html https://www.suse.com/security/cve/CVE-2020-26145.html https://www.suse.com/security/cve/CVE-2020-26147.html https://www.suse.com/security/cve/CVE-2021-23134.html https://www.suse.com/security/cve/CVE-2021-32399.html https://www.suse.com/security/cve/CVE-2021-33034.html https://www.suse.com/security/cve/CVE-2021-33200.html https://www.suse.com/security/cve/CVE-2021-3491.html https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1133021 https://bugzilla.suse.com/1152457 https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1155518 https://bugzilla.suse.com/1156395 https://bugzilla.suse.com/1164648 https://bugzilla.suse.com/1177666 https://bugzilla.suse.com/1178418 https://bugzilla.suse.com/1179519 https://bugzilla.suse.com/1179827 https://bugzilla.suse.com/1179851 https://bugzilla.suse.com/1182378 https://bugzilla.suse.com/1182999 https://bugzilla.suse.com/1183346 https://bugzilla.suse.com/1183976 https://bugzilla.suse.com/1184259 https://bugzilla.suse.com/1185428 https://bugzilla.suse.com/1185495 https://bugzilla.suse.com/1185589 https://bugzilla.suse.com/1185645 https://bugzilla.suse.com/1185703 https://bugzilla.suse.com/1185725 https://bugzilla.suse.com/1185758 https://bugzilla.suse.com/1185861 https://bugzilla.suse.com/1185863 https://bugzilla.suse.com/1185911 https://bugzilla.suse.com/1185938 https://bugzilla.suse.com/1185982 https://bugzilla.suse.com/1186320 https://bugzilla.suse.com/1186416 https://bugzilla.suse.com/1186439 https://bugzilla.suse.com/1186460 https://bugzilla.suse.com/1186484 https://bugzilla.suse.com/1186573

1 0

openSUSE-SU-2021:0841-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 05 Jun '21

05 Jun '21

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0841-1 Rating: moderate References: #1186722 Cross-References: CVE-2021-32625 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis fixes the following issues: redis was updated to 6.0.14: * CVE-2021-32625: An integer overflow bug could be exploited by using the STRALGO LCS command to cause remote remote code execution (boo#1186722) * Fix crash in UNLINK on a stream key with deleted consumer groups * SINTERSTORE: Add missing keyspace del event when none of the sources exist Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-841=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): redis-6.0.14-lp152.2.6.1 redis-debuginfo-6.0.14-lp152.2.6.1 redis-debugsource-6.0.14-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-32625.html https://bugzilla.suse.com/1186722

1 0

openSUSE-SU-2021:0840-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Jun '21

04 Jun '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0840-1 Rating: important References: #1186458 Cross-References: CVE-2021-21212 CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30540 CVSS scores: CVE-2021-21212 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.77 (boo#1186458): * Support Managed configuration API for Web Applications * WebOTP API: cross-origin iframe support * CSS custom counter styles * Support JSON Modules * Clipboard: read-only files support * Remove webkitBeforeTextInserted & webkitEditableCOntentChanged JS events * Honor media HTML attribute for link icon * Import Assertions * Class static initializer blocks * Ergonomic brand checks for private fields * Expose WebAssembly SIMD * New Feature: WebTransport * ES Modules for service workers ('module' type option) * Suggested file name and location for the File System Access API * adaptivePTime property for RTCRtpEncodingParameters * Block HTTP port 10080 - mitigation for NAT Slipstream 2.0 attack * Support WebSockets over HTTP/2 * Support 103 Early Hints for Navigation * CVE-2021-30521: Heap buffer overflow in Autofill * CVE-2021-30522: Use after free in WebAudio * CVE-2021-30523: Use after free in WebRTC * CVE-2021-30524: Use after free in TabStrip * CVE-2021-30525: Use after free in TabGroups * CVE-2021-30526: Out of bounds write in TabStrip * CVE-2021-30527: Use after free in WebUI * CVE-2021-30528: Use after free in WebAuthentication * CVE-2021-30529: Use after free in Bookmarks * CVE-2021-30530: Out of bounds memory access in WebAudio * CVE-2021-30531: Insufficient policy enforcement in Content Security Policy * CVE-2021-30532: Insufficient policy enforcement in Content Security Policy * CVE-2021-30533: Insufficient policy enforcement in PopupBlocker * CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox * CVE-2021-30535: Double free in ICU * CVE-2021-21212: Insufficient data validation in networking * CVE-2021-30536: Out of bounds read in V8 * CVE-2021-30537: Insufficient policy enforcement in cookies * CVE-2021-30538: Insufficient policy enforcement in content security policy * CVE-2021-30539: Insufficient policy enforcement in content security policy * CVE-2021-30540: Incorrect security UI in payments * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-840=1 Package List: - openSUSE Backports SLE-15-SP3 (x86_64): chromedriver-91.0.4472.77-bp153.2.3.1 chromium-91.0.4472.77-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21212.html https://www.suse.com/security/cve/CVE-2021-30521.html https://www.suse.com/security/cve/CVE-2021-30522.html https://www.suse.com/security/cve/CVE-2021-30523.html https://www.suse.com/security/cve/CVE-2021-30524.html https://www.suse.com/security/cve/CVE-2021-30525.html https://www.suse.com/security/cve/CVE-2021-30526.html https://www.suse.com/security/cve/CVE-2021-30527.html https://www.suse.com/security/cve/CVE-2021-30528.html https://www.suse.com/security/cve/CVE-2021-30529.html https://www.suse.com/security/cve/CVE-2021-30530.html https://www.suse.com/security/cve/CVE-2021-30531.html https://www.suse.com/security/cve/CVE-2021-30532.html https://www.suse.com/security/cve/CVE-2021-30533.html https://www.suse.com/security/cve/CVE-2021-30534.html https://www.suse.com/security/cve/CVE-2021-30535.html https://www.suse.com/security/cve/CVE-2021-30536.html https://www.suse.com/security/cve/CVE-2021-30537.html https://www.suse.com/security/cve/CVE-2021-30538.html https://www.suse.com/security/cve/CVE-2021-30539.html https://www.suse.com/security/cve/CVE-2021-30540.html https://bugzilla.suse.com/1186458

1 0

openSUSE-SU-2021:0838-1: important: Security update for polkit
by opensuse-security＠opensuse.org 04 Jun '21

04 Jun '21

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0838-1 Rating: important References: #1186497 Cross-References: CVE-2021-3560 CVSS scores: CVE-2021-3560 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: - CVE-2021-3560: Fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-838=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpolkit0-0.116-lp152.2.3.1 libpolkit0-debuginfo-0.116-lp152.2.3.1 polkit-0.116-lp152.2.3.1 polkit-debuginfo-0.116-lp152.2.3.1 polkit-debugsource-0.116-lp152.2.3.1 polkit-devel-0.116-lp152.2.3.1 polkit-devel-debuginfo-0.116-lp152.2.3.1 typelib-1_0-Polkit-1_0-0.116-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): polkit-doc-0.116-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libpolkit0-32bit-0.116-lp152.2.3.1 libpolkit0-32bit-debuginfo-0.116-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3560.html https://bugzilla.suse.com/1186497

1 0

openSUSE-SU-2021:0833-1: important: Security update for ceph
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0833-1 Rating: important References: #1185619 #1186020 #1186021 Cross-References: CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVSS scores: CVE-2021-3509 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3524 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3524 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3531 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3531 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - (CVE-2021-3509) fix cookie injection issue (bsc#1186021) - (CVE-2021-3531) RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (bsc#1186020) - (CVE-2021-3524) sanitize \r in s3 CORSConfiguration��s ExposeHeader (bsc#1185619) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-833=1 Package List: - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-cephadm-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-dashboard-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-diskprediction-cloud-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-diskprediction-local-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-k8sevents-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-modules-core-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-rook-15.2.12.83+g528da226523-lp152.2.18.1 ceph-prometheus-alerts-15.2.12.83+g528da226523-lp152.2.18.1 cephadm-15.2.12.83+g528da226523-lp152.2.18.1 - openSUSE Leap 15.2 (x86_64): ceph-15.2.12.83+g528da226523-lp152.2.18.1 ceph-base-15.2.12.83+g528da226523-lp152.2.18.1 ceph-base-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-common-15.2.12.83+g528da226523-lp152.2.18.1 ceph-common-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-debugsource-15.2.12.83+g528da226523-lp152.2.18.1 ceph-fuse-15.2.12.83+g528da226523-lp152.2.18.1 ceph-fuse-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-immutable-object-cache-15.2.12.83+g528da226523-lp152.2.18.1 ceph-immutable-object-cache-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mds-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mds-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mgr-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mon-15.2.12.83+g528da226523-lp152.2.18.1 ceph-mon-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-osd-15.2.12.83+g528da226523-lp152.2.18.1 ceph-osd-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-radosgw-15.2.12.83+g528da226523-lp152.2.18.1 ceph-radosgw-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-test-15.2.12.83+g528da226523-lp152.2.18.1 ceph-test-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 ceph-test-debugsource-15.2.12.83+g528da226523-lp152.2.18.1 cephfs-shell-15.2.12.83+g528da226523-lp152.2.18.1 libcephfs-devel-15.2.12.83+g528da226523-lp152.2.18.1 libcephfs2-15.2.12.83+g528da226523-lp152.2.18.1 libcephfs2-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 librados-devel-15.2.12.83+g528da226523-lp152.2.18.1 librados-devel-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 librados2-15.2.12.83+g528da226523-lp152.2.18.1 librados2-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 libradospp-devel-15.2.12.83+g528da226523-lp152.2.18.1 librbd-devel-15.2.12.83+g528da226523-lp152.2.18.1 librbd1-15.2.12.83+g528da226523-lp152.2.18.1 librbd1-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 librgw-devel-15.2.12.83+g528da226523-lp152.2.18.1 librgw2-15.2.12.83+g528da226523-lp152.2.18.1 librgw2-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 python3-ceph-argparse-15.2.12.83+g528da226523-lp152.2.18.1 python3-ceph-common-15.2.12.83+g528da226523-lp152.2.18.1 python3-cephfs-15.2.12.83+g528da226523-lp152.2.18.1 python3-cephfs-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 python3-rados-15.2.12.83+g528da226523-lp152.2.18.1 python3-rados-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 python3-rbd-15.2.12.83+g528da226523-lp152.2.18.1 python3-rbd-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 python3-rgw-15.2.12.83+g528da226523-lp152.2.18.1 python3-rgw-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 rados-objclass-devel-15.2.12.83+g528da226523-lp152.2.18.1 rbd-fuse-15.2.12.83+g528da226523-lp152.2.18.1 rbd-fuse-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 rbd-mirror-15.2.12.83+g528da226523-lp152.2.18.1 rbd-mirror-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 rbd-nbd-15.2.12.83+g528da226523-lp152.2.18.1 rbd-nbd-debuginfo-15.2.12.83+g528da226523-lp152.2.18.1 References: https://www.suse.com/security/cve/CVE-2021-3509.html https://www.suse.com/security/cve/CVE-2021-3524.html https://www.suse.com/security/cve/CVE-2021-3531.html https://bugzilla.suse.com/1185619 https://bugzilla.suse.com/1186020 https://bugzilla.suse.com/1186021

1 0

openSUSE-SU-2021:0835-1: important: Security update for nginx
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0835-1 Rating: important References: #1186126 Cross-References: CVE-2021-23017 CVSS scores: CVE-2021-23017 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following issues: - CVE-2021-23017: nginx DNS resolver off-by-one heap write (bsc#1186126) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-835=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nginx-1.16.1-lp152.2.3.1 nginx-debuginfo-1.16.1-lp152.2.3.1 nginx-debugsource-1.16.1-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): nginx-source-1.16.1-lp152.2.3.1 vim-plugin-nginx-1.16.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-23017.html https://bugzilla.suse.com/1186126

1 0

openSUSE-SU-2021:0834-1: important: Security update for dhcp
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0834-1 Rating: important References: #1186382 Cross-References: CVE-2021-25217 CVSS scores: CVE-2021-25217 (SUSE): 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dhcp fixes the following issues: - CVE-2021-25217: A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (bsc#1186382) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-834=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dhcp-4.3.6.P1-lp152.8.6.1 dhcp-client-4.3.6.P1-lp152.8.6.1 dhcp-client-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-debugsource-4.3.6.P1-lp152.8.6.1 dhcp-devel-4.3.6.P1-lp152.8.6.1 dhcp-doc-4.3.6.P1-lp152.8.6.1 dhcp-relay-4.3.6.P1-lp152.8.6.1 dhcp-relay-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-server-4.3.6.P1-lp152.8.6.1 dhcp-server-debuginfo-4.3.6.P1-lp152.8.6.1 References: https://www.suse.com/security/cve/CVE-2021-25217.html https://bugzilla.suse.com/1186382

1 0

openSUSE-SU-2021:0832-1: important: Security update for xstream
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0832-1 Rating: important References: #1184372 #1184373 #1184374 #1184375 #1184376 #1184377 #1184378 #1184379 #1184380 #1184796 #1184797 Cross-References: CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344 CVE-2021-21345 CVE-2021-21346 CVE-2021-21347 CVE-2021-21348 CVE-2021-21349 CVE-2021-21350 CVE-2021-21351 CVSS scores: CVE-2021-21341 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21341 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21342 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-21342 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-21343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21343 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21344 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21344 (SUSE): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-21345 (NVD) : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21345 (SUSE): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21346 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21346 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21348 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21348 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21349 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-21349 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-21350 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21350 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21351 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-21351 (SUSE): 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code (bsc#1184796) - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources (bsc#1184797) - CVE-2021-21350: arbitrary code execution (bsc#1184380) - CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time (bsc#1184374) - CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host (bsc#1184378) - CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host (bsc#1184375) - CVE-2021-21342: server-side forgery (bsc#1184379) - CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time (bsc#1184377) - CVE-2021-21346: remote attacker could load and execute arbitrary code (bsc#1184373) - CVE-2021-21345: remote attacker with sufficient rights could execute commands (bsc#1184372) - CVE-2021-21343: replace or inject objects, that result in the deletion of files on the local host (bsc#1184376) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-832=1 Package List: - openSUSE Leap 15.2 (noarch): xstream-1.4.16-lp152.2.6.1 xstream-benchmark-1.4.16-lp152.2.6.1 xstream-javadoc-1.4.16-lp152.2.6.1 xstream-parent-1.4.16-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-21341.html https://www.suse.com/security/cve/CVE-2021-21342.html https://www.suse.com/security/cve/CVE-2021-21343.html https://www.suse.com/security/cve/CVE-2021-21344.html https://www.suse.com/security/cve/CVE-2021-21345.html https://www.suse.com/security/cve/CVE-2021-21346.html https://www.suse.com/security/cve/CVE-2021-21347.html https://www.suse.com/security/cve/CVE-2021-21348.html https://www.suse.com/security/cve/CVE-2021-21349.html https://www.suse.com/security/cve/CVE-2021-21350.html https://www.suse.com/security/cve/CVE-2021-21351.html https://bugzilla.suse.com/1184372 https://bugzilla.suse.com/1184373 https://bugzilla.suse.com/1184374 https://bugzilla.suse.com/1184375 https://bugzilla.suse.com/1184376 https://bugzilla.suse.com/1184377 https://bugzilla.suse.com/1184378 https://bugzilla.suse.com/1184379 https://bugzilla.suse.com/1184380 https://bugzilla.suse.com/1184796 https://bugzilla.suse.com/1184797

1 0

openSUSE-SU-2021:0829-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0829-1 Rating: important References: Cross-References: CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 76.0.4017.154 - CHR-8420 Update chromium on desktop-stable-90-4017 to 90.0.4430.212 - DNA-92411 Bookmarks breadcrumbs wrong color when pressed in dark mode - DNA-92587 Sync settings: ��Use old password�� button doesn��t work - DNA-92672 Make it possible for agent to inject scripts into startpage - DNA-92712 Add SD reload API - DNA-93190 The bookmark can��t be opened in Workspace 5-6 - DNA-93247 Reopen last closed tab shortcut opens random tab on new window - DNA-93294 Binary diff for opera_browser.dll is not created on 32-bit builds - DNA-93313 Add opauto test to cover DNA-93190 - DNA-93368 Fix an error in Polish translation - DNA-93408 [Windows] widevine_cdm_component_installer does not compile on desktop-stable-90-4017 - The update to chromium 90.0.4430.212 fixes following issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508, CVE-2021-30509, CVE-2021-30510, CVE-2021-30511, CVE-2021-30512, CVE-2021-30513, CVE-2021-30514, CVE-2021-30515, CVE-2021-30516, CVE-2021-30517, CVE-2021-30518, CVE-2021-30519, CVE-2021-30520 Update to version 76.0.4017.123 - DNA-91951 SkipAds click by default with Adblocker on Youtube - DNA-92293 [Mac] Crash at opera::BrowserWindowImpl::Cleanup() - DNA-92714 [Mac] Worskpace switching lags with lot of tabs - DNA-92847 DCHECK at tab_lifecycle_unit_source.cc:145 - DNA-92860 [Windows] Fix issues when running buildsign script with Python 3 - DNA-92879 Fix issues when running buildsign script with Python 3 - DNA-92938 opera://activity/ page ignores workspaces - DNA-93015 [Player] Panel is too narrow - DNA-93044 Remove unnecessary question mark in Cashback string in Polish - DNA-93070 [Search Tabs] Selecting items with cursor keys skips over content matches - DNA-93122 Use input in builddiff.py - DNA-93175 Fix running repacking Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-829=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-76.0.4017.154-lp152.2.49.1 References: https://www.suse.com/security/cve/CVE-2021-30506.html https://www.suse.com/security/cve/CVE-2021-30507.html https://www.suse.com/security/cve/CVE-2021-30508.html https://www.suse.com/security/cve/CVE-2021-30509.html https://www.suse.com/security/cve/CVE-2021-30510.html https://www.suse.com/security/cve/CVE-2021-30511.html https://www.suse.com/security/cve/CVE-2021-30512.html https://www.suse.com/security/cve/CVE-2021-30513.html https://www.suse.com/security/cve/CVE-2021-30514.html https://www.suse.com/security/cve/CVE-2021-30515.html https://www.suse.com/security/cve/CVE-2021-30516.html https://www.suse.com/security/cve/CVE-2021-30517.html https://www.suse.com/security/cve/CVE-2021-30518.html https://www.suse.com/security/cve/CVE-2021-30519.html https://www.suse.com/security/cve/CVE-2021-30520.html

1 0

openSUSE-SU-2021:0828-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0828-1 Rating: important References: Cross-References: CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 76.0.4017.154 - CHR-8420 Update chromium on desktop-stable-90-4017 to 90.0.4430.212 - DNA-92411 Bookmarks breadcrumbs wrong color when pressed in dark mode - DNA-92587 Sync settings: ��Use old password�� button doesn��t work - DNA-92672 Make it possible for agent to inject scripts into startpage - DNA-92712 Add SD reload API - DNA-93190 The bookmark can��t be opened in Workspace 5-6 - DNA-93247 Reopen last closed tab shortcut opens random tab on new window - DNA-93294 Binary diff for opera_browser.dll is not created on 32-bit builds - DNA-93313 Add opauto test to cover DNA-93190 - DNA-93368 Fix an error in Polish translation - DNA-93408 [Windows] widevine_cdm_component_installer does not compile on desktop-stable-90-4017 - The update to chromium 90.0.4430.212 fixes following issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508, CVE-2021-30509, CVE-2021-30510, CVE-2021-30511, CVE-2021-30512, CVE-2021-30513, CVE-2021-30514, CVE-2021-30515, CVE-2021-30516, CVE-2021-30517, CVE-2021-30518, CVE-2021-30519, CVE-2021-30520 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-828=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-76.0.4017.154-lp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-30506.html https://www.suse.com/security/cve/CVE-2021-30507.html https://www.suse.com/security/cve/CVE-2021-30508.html https://www.suse.com/security/cve/CVE-2021-30509.html https://www.suse.com/security/cve/CVE-2021-30510.html https://www.suse.com/security/cve/CVE-2021-30511.html https://www.suse.com/security/cve/CVE-2021-30512.html https://www.suse.com/security/cve/CVE-2021-30513.html https://www.suse.com/security/cve/CVE-2021-30514.html https://www.suse.com/security/cve/CVE-2021-30515.html https://www.suse.com/security/cve/CVE-2021-30516.html https://www.suse.com/security/cve/CVE-2021-30517.html https://www.suse.com/security/cve/CVE-2021-30518.html https://www.suse.com/security/cve/CVE-2021-30519.html https://www.suse.com/security/cve/CVE-2021-30520.html

1 0

openSUSE-SU-2021:0830-1: moderate: Security update for inn
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for inn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0830-1 Rating: moderate References: #1182321 Cross-References: CVE-2021-31998 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for inn fixes the following issues: - CVE-2021-31998: change user to news before calling innupgrade, which could have allow local privilege escalation. [boo#1182321] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-830=1 Package List: - openSUSE Leap 15.2 (x86_64): inn-2.6.2-lp152.2.6.1 inn-debuginfo-2.6.2-lp152.2.6.1 inn-debugsource-2.6.2-lp152.2.6.1 inn-devel-2.6.2-lp152.2.6.1 mininews-2.6.2-lp152.2.6.1 mininews-debuginfo-2.6.2-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-31998.html https://bugzilla.suse.com/1182321

1 0

openSUSE-SU-2021:0826-1: moderate: Security update for upx
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for upx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0826-1 Rating: moderate References: #1186238 Cross-References: CVE-2020-24119 CVSS scores: CVE-2020-24119 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for upx fixes the following issues: - CVE-2020-24119: Fixed a heap buffer overflow in p_lx_elf.cpp (boo#1186238) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-826=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): upx-3.96-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-24119.html https://bugzilla.suse.com/1186238

1 0

openSUSE-SU-2021:0825-1: important: Security update for chromium
by opensuse-security＠opensuse.org 02 Jun '21

02 Jun '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0825-1 Rating: important References: #1186458 Cross-References: CVE-2021-21212 CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30540 CVSS scores: CVE-2021-21212 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.77 (boo#1186458): * Support Managed configuration API for Web Applications * WebOTP API: cross-origin iframe support * CSS custom counter styles * Support JSON Modules * Clipboard: read-only files support * Remove webkitBeforeTextInserted & webkitEditableCOntentChanged JS events * Honor media HTML attribute for link icon * Import Assertions * Class static initializer blocks * Ergonomic brand checks for private fields * Expose WebAssembly SIMD * New Feature: WebTransport * ES Modules for service workers ('module' type option) * Suggested file name and location for the File System Access API * adaptivePTime property for RTCRtpEncodingParameters * Block HTTP port 10080 - mitigation for NAT Slipstream 2.0 attack * Support WebSockets over HTTP/2 * Support 103 Early Hints for Navigation * CVE-2021-30521: Heap buffer overflow in Autofill * CVE-2021-30522: Use after free in WebAudio * CVE-2021-30523: Use after free in WebRTC * CVE-2021-30524: Use after free in TabStrip * CVE-2021-30525: Use after free in TabGroups * CVE-2021-30526: Out of bounds write in TabStrip * CVE-2021-30527: Use after free in WebUI * CVE-2021-30528: Use after free in WebAuthentication * CVE-2021-30529: Use after free in Bookmarks * CVE-2021-30530: Out of bounds memory access in WebAudio * CVE-2021-30531: Insufficient policy enforcement in Content Security Policy * CVE-2021-30532: Insufficient policy enforcement in Content Security Policy * CVE-2021-30533: Insufficient policy enforcement in PopupBlocker * CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox * CVE-2021-30535: Double free in ICU * CVE-2021-21212: Insufficient data validation in networking * CVE-2021-30536: Out of bounds read in V8 * CVE-2021-30537: Insufficient policy enforcement in cookies * CVE-2021-30538: Insufficient policy enforcement in content security policy * CVE-2021-30539: Insufficient policy enforcement in content security policy * CVE-2021-30540: Incorrect security UI in payments * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-825=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.77-lp152.2.98.1 chromedriver-debuginfo-91.0.4472.77-lp152.2.98.1 chromium-91.0.4472.77-lp152.2.98.1 chromium-debuginfo-91.0.4472.77-lp152.2.98.1 References: https://www.suse.com/security/cve/CVE-2021-21212.html https://www.suse.com/security/cve/CVE-2021-30521.html https://www.suse.com/security/cve/CVE-2021-30522.html https://www.suse.com/security/cve/CVE-2021-30523.html https://www.suse.com/security/cve/CVE-2021-30524.html https://www.suse.com/security/cve/CVE-2021-30525.html https://www.suse.com/security/cve/CVE-2021-30526.html https://www.suse.com/security/cve/CVE-2021-30527.html https://www.suse.com/security/cve/CVE-2021-30528.html https://www.suse.com/security/cve/CVE-2021-30529.html https://www.suse.com/security/cve/CVE-2021-30530.html https://www.suse.com/security/cve/CVE-2021-30531.html https://www.suse.com/security/cve/CVE-2021-30532.html https://www.suse.com/security/cve/CVE-2021-30533.html https://www.suse.com/security/cve/CVE-2021-30534.html https://www.suse.com/security/cve/CVE-2021-30535.html https://www.suse.com/security/cve/CVE-2021-30536.html https://www.suse.com/security/cve/CVE-2021-30537.html https://www.suse.com/security/cve/CVE-2021-30538.html https://www.suse.com/security/cve/CVE-2021-30539.html https://www.suse.com/security/cve/CVE-2021-30540.html https://bugzilla.suse.com/1186458

1 0

openSUSE-SU-2021:0822-1: important: Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly
by opensuse-security＠opensuse.org 01 Jun '21

01 Jun '21

openSUSE Security Update: Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0822-1 Rating: important References: #1181255 SLE-13843 Cross-References: CVE-2021-3185 CVSS scores: CVE-2021-3185 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3185 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues: gstreamer was updated to version 1.16.3 (bsc#1181255): - delay creation of threadpools - bin: Fix `deep-element-removed` log message - buffer: fix meta sequence number fallback on rpi - bufferlist: foreach: always remove as parent if buffer is changed - bus: Make setting/replacing/clearing the sync handler thread-safe - elementfactory: Fix missing features in case a feature moves to another filename - element: When removing a ghost pad also unset its target - meta: intern registered impl string - registry: Use a toolchain-specific registry file on Windows - systemclock: Invalid internal time calculation causes non-increasing clock time on Windows - value: don't write to `const char *` - value: Fix segfault comparing empty GValueArrays - Revert floating enforcing - aggregator: fix iteration direction in skip_buffers - sparsefile: fix possible crash when seeking - baseparse: cache fix - baseparse: fix memory leak when subclass skips whole input buffer - baseparse: Set the private duration before posting a duration-changed message - basetransform: allow not passthrough if generate_output is implemented - identity: Fix a minor leak using meta_str - queue: protect against lost wakeups for iterm_del condition - queue2: Avoid races when posting buffering messages - queue2: Fix missing/dropped buffering messages at startup - identity: Unblock condition variable on FLUSH_START - check: Use `g_thread_yield()` instead of `g_usleep(1)` - tests: use cpu_family for arch checks - gst-launch: Follow up to missing `s/g_print/gst_print/g` - gst-inspect: Add define guard for `g_log_writer_supports_color()` - gst-launch: go back down to `GST_STATE_NULL` in one step. - device-monitor: list hidden providers before listing devices - autotools build fixes for GNU make 4.3 gstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255): - deinterlace: on-the-fly renegotiation - flacenc: Pass audio info from set_format() to query_total_samples() explicitly - flacparse: fix broken reordering of flac metadata - jack: Use jack_free(3) to release ports - jpegdec: check buffer size before dereferencing - pulse: fix discovery of newly added devices - qtdemux fuzzing fixes - qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now - qtdemux: Specify REDIRECT information in error message - rtpbin: fix shutdown crash in rtpbin - rtpsession: rename RTCP thread - rtpvp8pay, rtpvp9pay: fix caps leak in set_caps() - rtpjpegdepay: outputs framed jpeg - rtpjitterbuffer: Properly free internal packets queue in finalize() - rtspsrc: Don't return TRUE for unhandled query - rtspsrc: Avoid stack overflow recursing waiting for response - rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property - rtspsrc: Error out when failling to receive message response - rtspsrc: Fix for segmentation fault when handling set/get_parameter requests - speex: Fix crash on Windows caused by cross-CRT issue - speexdec: Crash when stopping the pipeline - splitmuxsrc: Properly stop the loop if no part reader is present - use gst_element_class_set_metadata when passing dynamic strings - v4l2videodec: Increase internal bitstream pool size - v4l2: fix crash when handling unsupported video format - videocrop: allow properties to be animated by GstController - videomixer: Don't leak peer caps - vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD - wavenc: Fix writing of the channel mask with >2 channels gstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255): - amcvideodec: fix sync meta copying not taking a reference - audiobuffersplit: Perform discont tracking on running time - audiobuffersplit: Specify in the template caps that only interleaved audio is supported - audiobuffersplit: Unset DISCONT flag if not discontinuous - autoconvert: Fix lock-less exchange or free condition - autoconvert: fix compiler warnings with g_atomic on recent GLib versions - avfvideosrc: element requests camera permissions even with capture-screen property is true - codecparsers: h264parser: guard against ref_pic_markings overflow - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated - dtls/connection: fix EOF handling with openssl 1.1.1e - fdkaacdec: add support for mpegversion=2 - hls: Check nettle version to ensure AES128 support - ipcpipeline: Rework compiler checks - interlace: Increment phase_index before checking if we're at the end of the phase - lv2: Make it build with -fno-common - h264parser: Do not allocate too large size of memory for registered user data SEI - ladspa: fix unbounded integer properties - modplug: avoid division by zero - msdkdec: Fix GstMsdkContext leak - msdkenc: fix leaks on windows - musepackdec: Don't fail all queries if no sample rate is known yet - openslessink: Allow openslessink to handle 48kHz streams. - opencv: allow compilation against 4.2.x - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc - vulkan: Drop use of VK_RESULT_BEGIN_RANGE - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset - wasapi: Fix possible deadlock while downwards state change - waylandsink: Clear window when pipeline is stopped - webrtc: Support non-trickle ICE candidates in the SDP - webrtc: Unmap all non-binary buffers received via the datachannel - meson: build with neon 0.31 - Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch - h264parser: guard against ref_pic_markings overflow (bsc#1181255 CVE-2021-3185) - Disable the kate/libtiger plugin. Kate streams for karaoke are not used anymore, and the source tarball for libtiger is no longer available upstream. (jsc#SLE-13843) gstreamer-plugins-ugly was updated to version 1.16.3 (bsc#1181255): + x264enc: corrected em_data value in CEA-708 CC SEI message gstreamer-plugins-base was updated to version 1.16.3 (bsc#1181255): - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate - audioaggregator: Fix negotiation with downstream if there is no peer yet - audioencoder: fix segment event leak - discoverer: Fix caps handling in `pad-added` signal handler - discoverer: Start discovering next URI from right thread - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify) - gl/display/egl: ensure debug category is initialized - gstglwindow_x11: fix resize - pbutils: Add latest H.264 level values - rtpbuffer: fix header extension length validation - video: Fix NV12_64Z32 number of component - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5 - video: fix top/bottom field flags - videodecoder: don't copy interlace-mode from reference state - appsrc/appsink: Make setting/replacing callbacks thread-safe - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU - decodebin3: only force streams-selected seqnum after a select-streams - glupload: Fix fallback from direct dmabuf to dmabuf upload method - glvideomixer: perform `_get_highest_precision()` on the GL thread - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings - oggstream: Workaround for broken PAR in VP8 BOS - subparse: accept WebVTT timestamps without an hour component - playbin: Handle error message with redirection indication - textrender: Fix AYUV output. - typefind: Consider MPEG-PS PSM to be a PES type - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time - videoaggregator: Don't configure NULL chroma-site/colorimetry - videorate/videoscale/audioresample: Ensure that the caps returned from... - build: Replace bashisms in configure for Wayland and GLES3 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-822=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gstreamer-1.16.3-lp152.2.3.1 gstreamer-debuginfo-1.16.3-lp152.2.3.1 gstreamer-debugsource-1.16.3-lp152.2.3.1 gstreamer-devel-1.16.3-lp152.2.3.1 gstreamer-doc-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-debugsource-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-devel-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-doc-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-1.16.3-lp152.3.3.1 gstreamer-plugins-base-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-debugsource-1.16.3-lp152.3.3.1 gstreamer-plugins-base-devel-1.16.3-lp152.3.3.1 gstreamer-plugins-base-doc-1.16.3-lp152.3.3.1 gstreamer-plugins-good-1.16.3-lp152.2.3.1 gstreamer-plugins-good-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-debugsource-1.16.3-lp152.2.3.1 gstreamer-plugins-good-doc-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-gtk-1.16.3-lp152.2.3.1 gstreamer-plugins-good-gtk-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-qtqml-1.16.3-lp152.2.3.1 gstreamer-plugins-good-qtqml-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-debugsource-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-doc-1.16.3-lp152.2.3.1 gstreamer-utils-1.16.3-lp152.2.3.1 gstreamer-utils-debuginfo-1.16.3-lp152.2.3.1 libgstadaptivedemux-1_0-0-1.16.3-lp152.3.3.1 libgstadaptivedemux-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstapp-1_0-0-1.16.3-lp152.3.3.1 libgstapp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstfft-1_0-0-1.16.3-lp152.3.3.1 libgstfft-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstgl-1_0-0-1.16.3-lp152.3.3.1 libgstgl-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstreamer-1_0-0-1.16.3-lp152.2.3.1 libgstreamer-1_0-0-debuginfo-1.16.3-lp152.2.3.1 libgstriff-1_0-0-1.16.3-lp152.3.3.1 libgstriff-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgsttag-1_0-0-1.16.3-lp152.3.3.1 libgsttag-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-debuginfo-1.16.3-lp152.3.3.1 typelib-1_0-Gst-1_0-1.16.3-lp152.2.3.1 typelib-1_0-GstAllocators-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstApp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstAudio-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstGL-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstInsertBin-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstMpegts-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstPbutils-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstPlayer-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstRtp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstRtsp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstSdp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstTag-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstVideo-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstWebRTC-1_0-1.16.3-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): gstreamer-32bit-1.16.3-lp152.2.3.1 gstreamer-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-base-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-devel-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-good-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-32bit-debuginfo-1.16.3-lp152.2.3.1 libgstadaptivedemux-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstadaptivedemux-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstapp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstapp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstfft-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstfft-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstgl-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstgl-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstreamer-1_0-0-32bit-1.16.3-lp152.2.3.1 libgstreamer-1_0-0-32bit-debuginfo-1.16.3-lp152.2.3.1 libgstriff-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstriff-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgsttag-1_0-0-32bit-1.16.3-lp152.3.3.1 libgsttag-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-32bit-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): gstreamer-lang-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-lang-1.16.3-lp152.3.3.1 gstreamer-plugins-base-lang-1.16.3-lp152.3.3.1 gstreamer-plugins-good-lang-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-lang-1.16.3-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3185.html https://bugzilla.suse.com/1181255

1 0

openSUSE-SU-2021:0821-1: important: Security update for slurm
by opensuse-security＠opensuse.org 01 Jun '21

01 Jun '21

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0821-1 Rating: important References: #1186024 Cross-References: CVE-2021-31215 CVSS scores: CVE-2021-31215 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-31215 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm fixes the following issues: - CVE-2021-31215: Fixed a environment mishandling that allowed remote code execution as SlurmUser (bsc#1186024). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-821=1 Package List: - openSUSE Leap 15.2 (x86_64): libnss_slurm2-20.02.7-lp152.2.6.1 libnss_slurm2-debuginfo-20.02.7-lp152.2.6.1 libpmi0-20.02.7-lp152.2.6.1 libpmi0-debuginfo-20.02.7-lp152.2.6.1 libslurm35-20.02.7-lp152.2.6.1 libslurm35-debuginfo-20.02.7-lp152.2.6.1 perl-slurm-20.02.7-lp152.2.6.1 perl-slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-20.02.7-lp152.2.6.1 slurm-auth-none-20.02.7-lp152.2.6.1 slurm-auth-none-debuginfo-20.02.7-lp152.2.6.1 slurm-config-20.02.7-lp152.2.6.1 slurm-config-man-20.02.7-lp152.2.6.1 slurm-cray-20.02.7-lp152.2.6.1 slurm-cray-debuginfo-20.02.7-lp152.2.6.1 slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-debugsource-20.02.7-lp152.2.6.1 slurm-devel-20.02.7-lp152.2.6.1 slurm-doc-20.02.7-lp152.2.6.1 slurm-hdf5-20.02.7-lp152.2.6.1 slurm-hdf5-debuginfo-20.02.7-lp152.2.6.1 slurm-lua-20.02.7-lp152.2.6.1 slurm-lua-debuginfo-20.02.7-lp152.2.6.1 slurm-munge-20.02.7-lp152.2.6.1 slurm-munge-debuginfo-20.02.7-lp152.2.6.1 slurm-node-20.02.7-lp152.2.6.1 slurm-node-debuginfo-20.02.7-lp152.2.6.1 slurm-openlava-20.02.7-lp152.2.6.1 slurm-pam_slurm-20.02.7-lp152.2.6.1 slurm-pam_slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-plugins-20.02.7-lp152.2.6.1 slurm-plugins-debuginfo-20.02.7-lp152.2.6.1 slurm-rest-20.02.7-lp152.2.6.1 slurm-rest-debuginfo-20.02.7-lp152.2.6.1 slurm-seff-20.02.7-lp152.2.6.1 slurm-sjstat-20.02.7-lp152.2.6.1 slurm-slurmdbd-20.02.7-lp152.2.6.1 slurm-slurmdbd-debuginfo-20.02.7-lp152.2.6.1 slurm-sql-20.02.7-lp152.2.6.1 slurm-sql-debuginfo-20.02.7-lp152.2.6.1 slurm-sview-20.02.7-lp152.2.6.1 slurm-sview-debuginfo-20.02.7-lp152.2.6.1 slurm-torque-20.02.7-lp152.2.6.1 slurm-torque-debuginfo-20.02.7-lp152.2.6.1 slurm-webdoc-20.02.7-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-31215.html https://bugzilla.suse.com/1186024

1 0