June 2021 - openSUSE Security Announce

openSUSE-SU-2021:0915-1: moderate: Security update for live555
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for live555 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0915-1 Rating: moderate References: #1146283 #1185874 Cross-References: CVE-2019-15232 CVE-2021-28899 CVSS scores: CVE-2019-15232 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28899 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for live555 fixes the following issues: Update to 2021.05.22: - Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-915=1 Package List: - openSUSE Leap 15.2 (x86_64): libBasicUsageEnvironment1-2021.05.22-lp152.3.6.1 libBasicUsageEnvironment1-debuginfo-2021.05.22-lp152.3.6.1 libUsageEnvironment3-2021.05.22-lp152.3.6.1 libUsageEnvironment3-debuginfo-2021.05.22-lp152.3.6.1 libgroupsock30-2021.05.22-lp152.3.6.1 libgroupsock30-debuginfo-2021.05.22-lp152.3.6.1 libliveMedia94-2021.05.22-lp152.3.6.1 libliveMedia94-debuginfo-2021.05.22-lp152.3.6.1 live555-2021.05.22-lp152.3.6.1 live555-debuginfo-2021.05.22-lp152.3.6.1 live555-debugsource-2021.05.22-lp152.3.6.1 live555-devel-2021.05.22-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15232.html https://www.suse.com/security/cve/CVE-2021-28899.html https://bugzilla.suse.com/1146283 https://bugzilla.suse.com/1185874

1 0

openSUSE-SU-2021:0910-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0910-1 Rating: important References: #1186696 Cross-References: CVE-2021-29964 CVE-2021-29967 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 78.11 (bsc#1186696) Security issues fixed: - CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11 General improvements: - OpenPGP could not be disabled for an account if a key was previously configured - Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME - Contacts moved between CardDAV address books were not synced to the new server - CardDAV compatibility fixes for Google Contacts - Folder pane had no clear indication of focus on macOS This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-910=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.11.0-lp152.2.45.1 MozillaThunderbird-debuginfo-78.11.0-lp152.2.45.1 MozillaThunderbird-debugsource-78.11.0-lp152.2.45.1 MozillaThunderbird-translations-common-78.11.0-lp152.2.45.1 MozillaThunderbird-translations-other-78.11.0-lp152.2.45.1 References: https://www.suse.com/security/cve/CVE-2021-29964.html https://www.suse.com/security/cve/CVE-2021-29967.html https://bugzilla.suse.com/1186696

1 0

openSUSE-SU-2021:0909-1: important: Security update for wireshark, libvirt, sbc, libqt5-qtmultimedia
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for wireshark, libvirt, sbc, libqt5-qtmultimedia ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0909-1 Rating: important References: #1179930 #1179931 #1179932 #1179933 #1180102 #1180232 #1181598 #1181599 #1183353 #1184110 #1185128 Cross-References: CVE-2020-26418 CVE-2020-26419 CVE-2020-26420 CVE-2020-26421 CVE-2020-26422 CVE-2021-22173 CVE-2021-22174 CVE-2021-22191 CVE-2021-22207 CVSS scores: CVE-2020-26418 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26418 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26419 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26422 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26422 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-22173 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22173 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22174 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22174 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22207 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-22207 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the following issues: Update wireshark to version 3.4.5 - New and updated support and bug fixes for multiple protocols - Asynchronous DNS resolution is always enabled - Protobuf fields can be dissected as Wireshark (header) fields - UI improvements Including security fixes for: - CVE-2021-22191: Wireshark could open unsafe URLs (bsc#1183353). - CVE-2021-22207: MS-WSP dissector excessive memory consumption (bsc#1185128) - CVE-2020-26422: QUIC dissector crash (bsc#1180232) - CVE-2020-26418: Kafka dissector memory leak (bsc#1179930) - CVE-2020-26419: Multiple dissector memory leaks (bsc#1179931) - CVE-2020-26420: RTPS dissector memory leak (bsc#1179932) - CVE-2020-26421: USB HID dissector crash (bsc#1179933) - CVE-2021-22173: Fix USB HID dissector memory leak (bsc#1181598) - CVE-2021-22174: Fix USB HID dissector crash (bsc#1181599) libqt5-qtmultimedia and sbc are necessary dependencies. libvirt is needed to rebuild wireshark-plugin-libvirt. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-909=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark14-3.4.5-lp152.2.12.1 libwireshark14-debuginfo-3.4.5-lp152.2.12.1 libwiretap11-3.4.5-lp152.2.12.1 libwiretap11-debuginfo-3.4.5-lp152.2.12.1 libwsutil12-3.4.5-lp152.2.12.1 libwsutil12-debuginfo-3.4.5-lp152.2.12.1 wireshark-3.4.5-lp152.2.12.1 wireshark-debuginfo-3.4.5-lp152.2.12.1 wireshark-debugsource-3.4.5-lp152.2.12.1 wireshark-devel-3.4.5-lp152.2.12.1 wireshark-ui-qt-3.4.5-lp152.2.12.1 wireshark-ui-qt-debuginfo-3.4.5-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26418.html https://www.suse.com/security/cve/CVE-2020-26419.html https://www.suse.com/security/cve/CVE-2020-26420.html https://www.suse.com/security/cve/CVE-2020-26421.html https://www.suse.com/security/cve/CVE-2020-26422.html https://www.suse.com/security/cve/CVE-2021-22173.html https://www.suse.com/security/cve/CVE-2021-22174.html https://www.suse.com/security/cve/CVE-2021-22191.html https://www.suse.com/security/cve/CVE-2021-22207.html https://bugzilla.suse.com/1179930 https://bugzilla.suse.com/1179931 https://bugzilla.suse.com/1179932 https://bugzilla.suse.com/1179933 https://bugzilla.suse.com/1180102 https://bugzilla.suse.com/1180232 https://bugzilla.suse.com/1181598 https://bugzilla.suse.com/1181599 https://bugzilla.suse.com/1183353 https://bugzilla.suse.com/1184110 https://bugzilla.suse.com/1185128

1 0

openSUSE-SU-2021:0907-1: important: Security update for cryptctl
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for cryptctl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0907-1 Rating: important References: #1186226 Cross-References: CVE-2019-18906 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-907=1 Package List: - openSUSE Leap 15.2 (x86_64): cryptctl-2.4-lp152.5.3.1 cryptctl-debuginfo-2.4-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-18906.html https://bugzilla.suse.com/1186226

1 0

openSUSE-SU-2021:0906-1: important: Security update for libnettle
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0906-1 Rating: important References: #1187060 Cross-References: CVE-2021-3580 CVSS scores: CVE-2021-3580 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: - CVE-2021-3580: Fixed a remote denial of service in the RSA decryption via manipulated ciphertext (bsc#1187060). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-906=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libhogweed4-3.4.1-lp152.4.6.1 libhogweed4-debuginfo-3.4.1-lp152.4.6.1 libnettle-debugsource-3.4.1-lp152.4.6.1 libnettle-devel-3.4.1-lp152.4.6.1 libnettle6-3.4.1-lp152.4.6.1 libnettle6-debuginfo-3.4.1-lp152.4.6.1 nettle-3.4.1-lp152.4.6.1 nettle-debuginfo-3.4.1-lp152.4.6.1 - openSUSE Leap 15.2 (x86_64): libhogweed4-32bit-3.4.1-lp152.4.6.1 libhogweed4-32bit-debuginfo-3.4.1-lp152.4.6.1 libnettle-devel-32bit-3.4.1-lp152.4.6.1 libnettle6-32bit-3.4.1-lp152.4.6.1 libnettle6-32bit-debuginfo-3.4.1-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-3580.html https://bugzilla.suse.com/1187060

1 0

openSUSE-SU-2021:0911-1: important: Security update for xstream
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0911-1 Rating: important References: #1186651 Cross-References: CVE-2021-29505 CVSS scores: CVE-2021-29505 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29505 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-911=1 Package List: - openSUSE Leap 15.2 (noarch): xstream-1.4.17-lp152.2.9.1 xstream-benchmark-1.4.17-lp152.2.9.1 xstream-javadoc-1.4.17-lp152.2.9.1 xstream-parent-1.4.17-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-29505.html https://bugzilla.suse.com/1186651

1 0

openSUSE-SU-2021:0908-1: important: Security update for apache2
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0908-1 Rating: important References: #1186922 #1186923 #1186924 #1187017 #1187040 #1187174 Cross-References: CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641 CVE-2021-31618 CVSS scores: CVE-2020-13950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-13950 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-35452 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2020-35452 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26690 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-26690 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26691 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-30641 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-30641 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-31618 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-13950 [bsc#1187040]: mod_proxy NULL pointer dereference - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-908=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): apache2-2.4.43-lp152.2.15.1 apache2-debuginfo-2.4.43-lp152.2.15.1 apache2-debugsource-2.4.43-lp152.2.15.1 apache2-devel-2.4.43-lp152.2.15.1 apache2-event-2.4.43-lp152.2.15.1 apache2-event-debuginfo-2.4.43-lp152.2.15.1 apache2-example-pages-2.4.43-lp152.2.15.1 apache2-prefork-2.4.43-lp152.2.15.1 apache2-prefork-debuginfo-2.4.43-lp152.2.15.1 apache2-utils-2.4.43-lp152.2.15.1 apache2-utils-debuginfo-2.4.43-lp152.2.15.1 apache2-worker-2.4.43-lp152.2.15.1 apache2-worker-debuginfo-2.4.43-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): apache2-doc-2.4.43-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-13950.html https://www.suse.com/security/cve/CVE-2020-35452.html https://www.suse.com/security/cve/CVE-2021-26690.html https://www.suse.com/security/cve/CVE-2021-26691.html https://www.suse.com/security/cve/CVE-2021-30641.html https://www.suse.com/security/cve/CVE-2021-31618.html https://bugzilla.suse.com/1186922 https://bugzilla.suse.com/1186923 https://bugzilla.suse.com/1186924 https://bugzilla.suse.com/1187017 https://bugzilla.suse.com/1187040 https://bugzilla.suse.com/1187174

1 0

openSUSE-SU-2021:0901-1: important: Security update for python-rsa
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for python-rsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0901-1 Rating: important References: #1172389 Cross-References: CVE-2020-13757 CVSS scores: CVE-2020-13757 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-13757 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rsa fixes the following issues: - CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-901=1 Package List: - openSUSE Leap 15.2 (noarch): python2-rsa-3.4.2-lp152.4.3.1 python3-rsa-3.4.2-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-13757.html https://bugzilla.suse.com/1172389

1 0

openSUSE-SU-2021:0904-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0904-1 Rating: moderate References: #1175132 #1185790 Cross-References: CVE-2021-31525 CVSS scores: CVE-2021-31525 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-31525 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.15 fixes the following issues: - Updated go to upstream version 1.15.12 (released 2021-05-06) (bsc#1175132). - CVE-2021-31525: Fixed stack overflow via net/http ReadRequest (bsc#1185790). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-904=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.12-lp152.17.1 go1.15-doc-1.15.12-lp152.17.1 go1.15-race-1.15.12-lp152.17.1 References: https://www.suse.com/security/cve/CVE-2021-31525.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1185790

1 0

openSUSE-SU-2021:0900-1: important: Security update for xterm
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for xterm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0900-1 Rating: important References: #1182091 Cross-References: CVE-2021-27135 CVSS scores: CVE-2021-27135 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-27135 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xterm fixes the following issues: - CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-900=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xterm-330-lp152.6.3.1 xterm-bin-330-lp152.6.3.1 xterm-bin-debuginfo-330-lp152.6.3.1 xterm-debugsource-330-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2021-27135.html https://bugzilla.suse.com/1182091

1 0