June 2021 - openSUSE Security Announce

openSUSE-SU-2021:0933-1: moderate: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jun '21

27 Jun '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0933-1 Rating: moderate References: #1185055 Cross-References: CVE-2021-2163 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u292 (icedtea 3.19.0). - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-933=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-accessibility-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-debuginfo-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-debugsource-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-demo-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-devel-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-headless-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.292-lp152.2.12.2 java-1_8_0-openjdk-src-1.8.0.292-lp152.2.12.2 - openSUSE Leap 15.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.292-lp152.2.12.2 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://bugzilla.suse.com/1185055

1 0

openSUSE-SU-2021:0934-1: moderate: Security update for tpm2.0-tools
by opensuse-security＠opensuse.org 27 Jun '21

27 Jun '21

openSUSE Security Update: Security update for tpm2.0-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0934-1 Rating: moderate References: #1186490 Cross-References: CVE-2021-3565 CVSS scores: CVE-2021-3565 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-3565 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tpm2.0-tools fixes the following issues: - CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used (bsc#1186490). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-934=1 Package List: - openSUSE Leap 15.2 (x86_64): tpm2.0-tools-4.1-lp152.2.3.1 tpm2.0-tools-debuginfo-4.1-lp152.2.3.1 tpm2.0-tools-debugsource-4.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3565.html https://bugzilla.suse.com/1186490

1 0

openSUSE-SU-2021:0931-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 27 Jun '21

27 Jun '21

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0931-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-931=1 Package List: - openSUSE Leap 15.2 (noarch): roundcubemail-1.3.16-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707

1 0

openSUSE-SU-2021:0930-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 27 Jun '21

27 Jun '21

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0930-1 Rating: moderate References: #1184016 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for freeradius-server fixes the following issues: - Fixed plaintext password entries in logfiles (bsc#1184016). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-930=1 Package List: - openSUSE Leap 15.2 (x86_64): freeradius-server-3.0.21-lp152.2.9.1 freeradius-server-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-debugsource-3.0.21-lp152.2.9.1 freeradius-server-devel-3.0.21-lp152.2.9.1 freeradius-server-doc-3.0.21-lp152.2.9.1 freeradius-server-krb5-3.0.21-lp152.2.9.1 freeradius-server-krb5-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-ldap-3.0.21-lp152.2.9.1 freeradius-server-ldap-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-libs-3.0.21-lp152.2.9.1 freeradius-server-libs-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-mysql-3.0.21-lp152.2.9.1 freeradius-server-mysql-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-perl-3.0.21-lp152.2.9.1 freeradius-server-perl-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-postgresql-3.0.21-lp152.2.9.1 freeradius-server-postgresql-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-python3-3.0.21-lp152.2.9.1 freeradius-server-python3-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-sqlite-3.0.21-lp152.2.9.1 freeradius-server-sqlite-debuginfo-3.0.21-lp152.2.9.1 freeradius-server-utils-3.0.21-lp152.2.9.1 freeradius-server-utils-debuginfo-3.0.21-lp152.2.9.1 References: https://bugzilla.suse.com/1184016

1 0

openSUSE-SU-2021:0926-1: important: Security update for tor
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0926-1 Rating: important References: #1179331 #1181244 #1187322 #1187323 #1187324 #1187325 Cross-References: CVE-2021-34548 CVE-2021-34549 CVE-2021-34550 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for tor fixes the following issues: tor 0.4.5.9 * Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell (CVE-2021-34548, boo#1187322) * Detect more failure conditions from the OpenSSL RNG code (boo#1187323) * Resist a hashtable-based CPU denial-of-service attack against relays (CVE-2021-34549, boo#1187324) * Fix an out-of-bounds memory access in v3 onion service descriptor parsing (CVE-2021-34550, boo#1187325) tor 0.4.5.8 * https://lists.torproject.org/pipermail/tor-announce/2021-May/000219.html * allow Linux sandbox with Glibc 2.33 * work with autoconf 2.70+ * several other minor features and bugfixes (see announcement) - Fix logging issue due to systemd picking up stdout - boo#1181244 Continue to log notices to syslog by default. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-926=1 Package List: - openSUSE Leap 15.2 (x86_64): tor-0.4.5.9-lp152.2.12.1 tor-debuginfo-0.4.5.9-lp152.2.12.1 tor-debugsource-0.4.5.9-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-34548.html https://www.suse.com/security/cve/CVE-2021-34549.html https://www.suse.com/security/cve/CVE-2021-34550.html https://bugzilla.suse.com/1179331 https://bugzilla.suse.com/1181244 https://bugzilla.suse.com/1187322 https://bugzilla.suse.com/1187323 https://bugzilla.suse.com/1187324 https://bugzilla.suse.com/1187325

1 0

openSUSE-SU-2021:0925-1: important: Security update for openexr
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0925-1 Rating: important References: #1187310 #1187395 Cross-References: CVE-2021-3598 CVE-2021-3605 CVSS scores: CVE-2021-3598 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3605 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openexr fixes the following issues: - Fixed CVE-2021-3605 [bsc#1187395]: Heap buffer overflow in the rleUncompress function - Fixed CVE-2021-3598 [bsc#1187310]: Heap buffer overflow in Imf_3_1:CharPtrIO:readChars This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-925=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.17.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.17.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.17.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.17.1 openexr-2.2.1-lp152.7.17.1 openexr-debuginfo-2.2.1-lp152.7.17.1 openexr-debugsource-2.2.1-lp152.7.17.1 openexr-devel-2.2.1-lp152.7.17.1 openexr-doc-2.2.1-lp152.7.17.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.17.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.17.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.17.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.17.1 References: https://www.suse.com/security/cve/CVE-2021-3598.html https://www.suse.com/security/cve/CVE-2021-3605.html https://bugzilla.suse.com/1187310 https://bugzilla.suse.com/1187395

1 0

openSUSE-SU-2021:0919-1: important: Security update for libgcrypt
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0919-1 Rating: important References: #1187212 Cross-References: CVE-2021-33560 CVSS scores: CVE-2021-33560 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-33560 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgcrypt fixes the following issues: - CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-919=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libgcrypt-cavs-1.8.2-lp152.17.3.1 libgcrypt-cavs-debuginfo-1.8.2-lp152.17.3.1 libgcrypt-debugsource-1.8.2-lp152.17.3.1 libgcrypt-devel-1.8.2-lp152.17.3.1 libgcrypt-devel-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-1.8.2-lp152.17.3.1 libgcrypt20-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-hmac-1.8.2-lp152.17.3.1 - openSUSE Leap 15.2 (x86_64): libgcrypt-devel-32bit-1.8.2-lp152.17.3.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-32bit-1.8.2-lp152.17.3.1 libgcrypt20-32bit-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-hmac-32bit-1.8.2-lp152.17.3.1 References: https://www.suse.com/security/cve/CVE-2021-33560.html https://bugzilla.suse.com/1187212

1 0

openSUSE-SU-2021:0920-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0920-1 Rating: important References: #1187418 #1187419 Cross-References: CVE-2021-29157 CVE-2021-33515 CVSS scores: CVE-2021-29157 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-33515 (SUSE): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418) - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-920=1 Package List: - openSUSE Leap 15.2 (x86_64): dovecot23-2.3.11.3-lp152.2.9.1 dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 dovecot23-backend-mysql-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 dovecot23-backend-pgsql-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 dovecot23-backend-sqlite-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-debugsource-2.3.11.3-lp152.2.9.1 dovecot23-devel-2.3.11.3-lp152.2.9.1 dovecot23-fts-2.3.11.3-lp152.2.9.1 dovecot23-fts-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 dovecot23-fts-lucene-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 dovecot23-fts-solr-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 dovecot23-fts-squat-debuginfo-2.3.11.3-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-29157.html https://www.suse.com/security/cve/CVE-2021-33515.html https://bugzilla.suse.com/1187418 https://bugzilla.suse.com/1187419

1 0

openSUSE-SU-2021:0917-1: important: Security update for gupnp
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for gupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0917-1 Rating: important References: #1186590 Cross-References: CVE-2021-33516 CVSS scores: CVE-2021-33516 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-33516 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gupnp fixes the following issues: - CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-917=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gupnp-debugsource-1.2.2-lp152.2.3.1 libgupnp-1_2-0-1.2.2-lp152.2.3.1 libgupnp-1_2-0-debuginfo-1.2.2-lp152.2.3.1 libgupnp-devel-1.2.2-lp152.2.3.1 typelib-1_0-GUPnP-1_0-1.2.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libgupnp-1_2-0-32bit-1.2.2-lp152.2.3.1 libgupnp-1_2-0-32bit-debuginfo-1.2.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-33516.html https://bugzilla.suse.com/1186590

1 0

openSUSE-SU-2021:0918-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0918-1 Rating: important References: #1186151 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ovmf fixes the following issues: - Fixed a possible buffer overflow in IScsiDxe (bsc#1186151) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-918=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ovmf-201911-lp152.6.17.1 ovmf-tools-201911-lp152.6.17.1 - openSUSE Leap 15.2 (x86_64): qemu-ovmf-x86_64-debug-201911-lp152.6.17.1 - openSUSE Leap 15.2 (noarch): qemu-ovmf-ia32-201911-lp152.6.17.1 qemu-ovmf-x86_64-201911-lp152.6.17.1 References: https://bugzilla.suse.com/1186151

1 0