June 2021 - openSUSE Security Announce

openSUSE-SU-2021:0835-1: important: Security update for nginx
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0835-1 Rating: important References: #1186126 Cross-References: CVE-2021-23017 CVSS scores: CVE-2021-23017 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following issues: - CVE-2021-23017: nginx DNS resolver off-by-one heap write (bsc#1186126) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-835=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nginx-1.16.1-lp152.2.3.1 nginx-debuginfo-1.16.1-lp152.2.3.1 nginx-debugsource-1.16.1-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): nginx-source-1.16.1-lp152.2.3.1 vim-plugin-nginx-1.16.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-23017.html https://bugzilla.suse.com/1186126

1 0

openSUSE-SU-2021:0834-1: important: Security update for dhcp
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0834-1 Rating: important References: #1186382 Cross-References: CVE-2021-25217 CVSS scores: CVE-2021-25217 (SUSE): 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dhcp fixes the following issues: - CVE-2021-25217: A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (bsc#1186382) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-834=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dhcp-4.3.6.P1-lp152.8.6.1 dhcp-client-4.3.6.P1-lp152.8.6.1 dhcp-client-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-debugsource-4.3.6.P1-lp152.8.6.1 dhcp-devel-4.3.6.P1-lp152.8.6.1 dhcp-doc-4.3.6.P1-lp152.8.6.1 dhcp-relay-4.3.6.P1-lp152.8.6.1 dhcp-relay-debuginfo-4.3.6.P1-lp152.8.6.1 dhcp-server-4.3.6.P1-lp152.8.6.1 dhcp-server-debuginfo-4.3.6.P1-lp152.8.6.1 References: https://www.suse.com/security/cve/CVE-2021-25217.html https://bugzilla.suse.com/1186382

1 0

openSUSE-SU-2021:0832-1: important: Security update for xstream
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0832-1 Rating: important References: #1184372 #1184373 #1184374 #1184375 #1184376 #1184377 #1184378 #1184379 #1184380 #1184796 #1184797 Cross-References: CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344 CVE-2021-21345 CVE-2021-21346 CVE-2021-21347 CVE-2021-21348 CVE-2021-21349 CVE-2021-21350 CVE-2021-21351 CVSS scores: CVE-2021-21341 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21341 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21342 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-21342 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-21343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21343 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21344 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21344 (SUSE): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-21345 (NVD) : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21345 (SUSE): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21346 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21346 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21348 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21348 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21349 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-21349 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-21350 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21350 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21351 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-21351 (SUSE): 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code (bsc#1184796) - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources (bsc#1184797) - CVE-2021-21350: arbitrary code execution (bsc#1184380) - CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time (bsc#1184374) - CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host (bsc#1184378) - CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host (bsc#1184375) - CVE-2021-21342: server-side forgery (bsc#1184379) - CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time (bsc#1184377) - CVE-2021-21346: remote attacker could load and execute arbitrary code (bsc#1184373) - CVE-2021-21345: remote attacker with sufficient rights could execute commands (bsc#1184372) - CVE-2021-21343: replace or inject objects, that result in the deletion of files on the local host (bsc#1184376) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-832=1 Package List: - openSUSE Leap 15.2 (noarch): xstream-1.4.16-lp152.2.6.1 xstream-benchmark-1.4.16-lp152.2.6.1 xstream-javadoc-1.4.16-lp152.2.6.1 xstream-parent-1.4.16-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-21341.html https://www.suse.com/security/cve/CVE-2021-21342.html https://www.suse.com/security/cve/CVE-2021-21343.html https://www.suse.com/security/cve/CVE-2021-21344.html https://www.suse.com/security/cve/CVE-2021-21345.html https://www.suse.com/security/cve/CVE-2021-21346.html https://www.suse.com/security/cve/CVE-2021-21347.html https://www.suse.com/security/cve/CVE-2021-21348.html https://www.suse.com/security/cve/CVE-2021-21349.html https://www.suse.com/security/cve/CVE-2021-21350.html https://www.suse.com/security/cve/CVE-2021-21351.html https://bugzilla.suse.com/1184372 https://bugzilla.suse.com/1184373 https://bugzilla.suse.com/1184374 https://bugzilla.suse.com/1184375 https://bugzilla.suse.com/1184376 https://bugzilla.suse.com/1184377 https://bugzilla.suse.com/1184378 https://bugzilla.suse.com/1184379 https://bugzilla.suse.com/1184380 https://bugzilla.suse.com/1184796 https://bugzilla.suse.com/1184797

1 0

openSUSE-SU-2021:0829-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0829-1 Rating: important References: Cross-References: CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 76.0.4017.154 - CHR-8420 Update chromium on desktop-stable-90-4017 to 90.0.4430.212 - DNA-92411 Bookmarks breadcrumbs wrong color when pressed in dark mode - DNA-92587 Sync settings: ��Use old password�� button doesn��t work - DNA-92672 Make it possible for agent to inject scripts into startpage - DNA-92712 Add SD reload API - DNA-93190 The bookmark can��t be opened in Workspace 5-6 - DNA-93247 Reopen last closed tab shortcut opens random tab on new window - DNA-93294 Binary diff for opera_browser.dll is not created on 32-bit builds - DNA-93313 Add opauto test to cover DNA-93190 - DNA-93368 Fix an error in Polish translation - DNA-93408 [Windows] widevine_cdm_component_installer does not compile on desktop-stable-90-4017 - The update to chromium 90.0.4430.212 fixes following issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508, CVE-2021-30509, CVE-2021-30510, CVE-2021-30511, CVE-2021-30512, CVE-2021-30513, CVE-2021-30514, CVE-2021-30515, CVE-2021-30516, CVE-2021-30517, CVE-2021-30518, CVE-2021-30519, CVE-2021-30520 Update to version 76.0.4017.123 - DNA-91951 SkipAds click by default with Adblocker on Youtube - DNA-92293 [Mac] Crash at opera::BrowserWindowImpl::Cleanup() - DNA-92714 [Mac] Worskpace switching lags with lot of tabs - DNA-92847 DCHECK at tab_lifecycle_unit_source.cc:145 - DNA-92860 [Windows] Fix issues when running buildsign script with Python 3 - DNA-92879 Fix issues when running buildsign script with Python 3 - DNA-92938 opera://activity/ page ignores workspaces - DNA-93015 [Player] Panel is too narrow - DNA-93044 Remove unnecessary question mark in Cashback string in Polish - DNA-93070 [Search Tabs] Selecting items with cursor keys skips over content matches - DNA-93122 Use input in builddiff.py - DNA-93175 Fix running repacking Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-829=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-76.0.4017.154-lp152.2.49.1 References: https://www.suse.com/security/cve/CVE-2021-30506.html https://www.suse.com/security/cve/CVE-2021-30507.html https://www.suse.com/security/cve/CVE-2021-30508.html https://www.suse.com/security/cve/CVE-2021-30509.html https://www.suse.com/security/cve/CVE-2021-30510.html https://www.suse.com/security/cve/CVE-2021-30511.html https://www.suse.com/security/cve/CVE-2021-30512.html https://www.suse.com/security/cve/CVE-2021-30513.html https://www.suse.com/security/cve/CVE-2021-30514.html https://www.suse.com/security/cve/CVE-2021-30515.html https://www.suse.com/security/cve/CVE-2021-30516.html https://www.suse.com/security/cve/CVE-2021-30517.html https://www.suse.com/security/cve/CVE-2021-30518.html https://www.suse.com/security/cve/CVE-2021-30519.html https://www.suse.com/security/cve/CVE-2021-30520.html

1 0

openSUSE-SU-2021:0828-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0828-1 Rating: important References: Cross-References: CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 76.0.4017.154 - CHR-8420 Update chromium on desktop-stable-90-4017 to 90.0.4430.212 - DNA-92411 Bookmarks breadcrumbs wrong color when pressed in dark mode - DNA-92587 Sync settings: ��Use old password�� button doesn��t work - DNA-92672 Make it possible for agent to inject scripts into startpage - DNA-92712 Add SD reload API - DNA-93190 The bookmark can��t be opened in Workspace 5-6 - DNA-93247 Reopen last closed tab shortcut opens random tab on new window - DNA-93294 Binary diff for opera_browser.dll is not created on 32-bit builds - DNA-93313 Add opauto test to cover DNA-93190 - DNA-93368 Fix an error in Polish translation - DNA-93408 [Windows] widevine_cdm_component_installer does not compile on desktop-stable-90-4017 - The update to chromium 90.0.4430.212 fixes following issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508, CVE-2021-30509, CVE-2021-30510, CVE-2021-30511, CVE-2021-30512, CVE-2021-30513, CVE-2021-30514, CVE-2021-30515, CVE-2021-30516, CVE-2021-30517, CVE-2021-30518, CVE-2021-30519, CVE-2021-30520 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-828=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-76.0.4017.154-lp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-30506.html https://www.suse.com/security/cve/CVE-2021-30507.html https://www.suse.com/security/cve/CVE-2021-30508.html https://www.suse.com/security/cve/CVE-2021-30509.html https://www.suse.com/security/cve/CVE-2021-30510.html https://www.suse.com/security/cve/CVE-2021-30511.html https://www.suse.com/security/cve/CVE-2021-30512.html https://www.suse.com/security/cve/CVE-2021-30513.html https://www.suse.com/security/cve/CVE-2021-30514.html https://www.suse.com/security/cve/CVE-2021-30515.html https://www.suse.com/security/cve/CVE-2021-30516.html https://www.suse.com/security/cve/CVE-2021-30517.html https://www.suse.com/security/cve/CVE-2021-30518.html https://www.suse.com/security/cve/CVE-2021-30519.html https://www.suse.com/security/cve/CVE-2021-30520.html

1 0

openSUSE-SU-2021:0830-1: moderate: Security update for inn
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for inn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0830-1 Rating: moderate References: #1182321 Cross-References: CVE-2021-31998 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for inn fixes the following issues: - CVE-2021-31998: change user to news before calling innupgrade, which could have allow local privilege escalation. [boo#1182321] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-830=1 Package List: - openSUSE Leap 15.2 (x86_64): inn-2.6.2-lp152.2.6.1 inn-debuginfo-2.6.2-lp152.2.6.1 inn-debugsource-2.6.2-lp152.2.6.1 inn-devel-2.6.2-lp152.2.6.1 mininews-2.6.2-lp152.2.6.1 mininews-debuginfo-2.6.2-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-31998.html https://bugzilla.suse.com/1182321

1 0

openSUSE-SU-2021:0826-1: moderate: Security update for upx
by opensuse-security＠opensuse.org 03 Jun '21

03 Jun '21

openSUSE Security Update: Security update for upx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0826-1 Rating: moderate References: #1186238 Cross-References: CVE-2020-24119 CVSS scores: CVE-2020-24119 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for upx fixes the following issues: - CVE-2020-24119: Fixed a heap buffer overflow in p_lx_elf.cpp (boo#1186238) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-826=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): upx-3.96-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-24119.html https://bugzilla.suse.com/1186238

1 0

openSUSE-SU-2021:0825-1: important: Security update for chromium
by opensuse-security＠opensuse.org 02 Jun '21

02 Jun '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0825-1 Rating: important References: #1186458 Cross-References: CVE-2021-21212 CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30540 CVSS scores: CVE-2021-21212 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.77 (boo#1186458): * Support Managed configuration API for Web Applications * WebOTP API: cross-origin iframe support * CSS custom counter styles * Support JSON Modules * Clipboard: read-only files support * Remove webkitBeforeTextInserted & webkitEditableCOntentChanged JS events * Honor media HTML attribute for link icon * Import Assertions * Class static initializer blocks * Ergonomic brand checks for private fields * Expose WebAssembly SIMD * New Feature: WebTransport * ES Modules for service workers ('module' type option) * Suggested file name and location for the File System Access API * adaptivePTime property for RTCRtpEncodingParameters * Block HTTP port 10080 - mitigation for NAT Slipstream 2.0 attack * Support WebSockets over HTTP/2 * Support 103 Early Hints for Navigation * CVE-2021-30521: Heap buffer overflow in Autofill * CVE-2021-30522: Use after free in WebAudio * CVE-2021-30523: Use after free in WebRTC * CVE-2021-30524: Use after free in TabStrip * CVE-2021-30525: Use after free in TabGroups * CVE-2021-30526: Out of bounds write in TabStrip * CVE-2021-30527: Use after free in WebUI * CVE-2021-30528: Use after free in WebAuthentication * CVE-2021-30529: Use after free in Bookmarks * CVE-2021-30530: Out of bounds memory access in WebAudio * CVE-2021-30531: Insufficient policy enforcement in Content Security Policy * CVE-2021-30532: Insufficient policy enforcement in Content Security Policy * CVE-2021-30533: Insufficient policy enforcement in PopupBlocker * CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox * CVE-2021-30535: Double free in ICU * CVE-2021-21212: Insufficient data validation in networking * CVE-2021-30536: Out of bounds read in V8 * CVE-2021-30537: Insufficient policy enforcement in cookies * CVE-2021-30538: Insufficient policy enforcement in content security policy * CVE-2021-30539: Insufficient policy enforcement in content security policy * CVE-2021-30540: Incorrect security UI in payments * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-825=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.77-lp152.2.98.1 chromedriver-debuginfo-91.0.4472.77-lp152.2.98.1 chromium-91.0.4472.77-lp152.2.98.1 chromium-debuginfo-91.0.4472.77-lp152.2.98.1 References: https://www.suse.com/security/cve/CVE-2021-21212.html https://www.suse.com/security/cve/CVE-2021-30521.html https://www.suse.com/security/cve/CVE-2021-30522.html https://www.suse.com/security/cve/CVE-2021-30523.html https://www.suse.com/security/cve/CVE-2021-30524.html https://www.suse.com/security/cve/CVE-2021-30525.html https://www.suse.com/security/cve/CVE-2021-30526.html https://www.suse.com/security/cve/CVE-2021-30527.html https://www.suse.com/security/cve/CVE-2021-30528.html https://www.suse.com/security/cve/CVE-2021-30529.html https://www.suse.com/security/cve/CVE-2021-30530.html https://www.suse.com/security/cve/CVE-2021-30531.html https://www.suse.com/security/cve/CVE-2021-30532.html https://www.suse.com/security/cve/CVE-2021-30533.html https://www.suse.com/security/cve/CVE-2021-30534.html https://www.suse.com/security/cve/CVE-2021-30535.html https://www.suse.com/security/cve/CVE-2021-30536.html https://www.suse.com/security/cve/CVE-2021-30537.html https://www.suse.com/security/cve/CVE-2021-30538.html https://www.suse.com/security/cve/CVE-2021-30539.html https://www.suse.com/security/cve/CVE-2021-30540.html https://bugzilla.suse.com/1186458

1 0

openSUSE-SU-2021:0822-1: important: Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly
by opensuse-security＠opensuse.org 01 Jun '21

01 Jun '21

openSUSE Security Update: Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0822-1 Rating: important References: #1181255 SLE-13843 Cross-References: CVE-2021-3185 CVSS scores: CVE-2021-3185 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3185 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly fixes the following issues: gstreamer was updated to version 1.16.3 (bsc#1181255): - delay creation of threadpools - bin: Fix `deep-element-removed` log message - buffer: fix meta sequence number fallback on rpi - bufferlist: foreach: always remove as parent if buffer is changed - bus: Make setting/replacing/clearing the sync handler thread-safe - elementfactory: Fix missing features in case a feature moves to another filename - element: When removing a ghost pad also unset its target - meta: intern registered impl string - registry: Use a toolchain-specific registry file on Windows - systemclock: Invalid internal time calculation causes non-increasing clock time on Windows - value: don't write to `const char *` - value: Fix segfault comparing empty GValueArrays - Revert floating enforcing - aggregator: fix iteration direction in skip_buffers - sparsefile: fix possible crash when seeking - baseparse: cache fix - baseparse: fix memory leak when subclass skips whole input buffer - baseparse: Set the private duration before posting a duration-changed message - basetransform: allow not passthrough if generate_output is implemented - identity: Fix a minor leak using meta_str - queue: protect against lost wakeups for iterm_del condition - queue2: Avoid races when posting buffering messages - queue2: Fix missing/dropped buffering messages at startup - identity: Unblock condition variable on FLUSH_START - check: Use `g_thread_yield()` instead of `g_usleep(1)` - tests: use cpu_family for arch checks - gst-launch: Follow up to missing `s/g_print/gst_print/g` - gst-inspect: Add define guard for `g_log_writer_supports_color()` - gst-launch: go back down to `GST_STATE_NULL` in one step. - device-monitor: list hidden providers before listing devices - autotools build fixes for GNU make 4.3 gstreamer-plugins-good was updated to version 1.16.3 (bsc#1181255): - deinterlace: on-the-fly renegotiation - flacenc: Pass audio info from set_format() to query_total_samples() explicitly - flacparse: fix broken reordering of flac metadata - jack: Use jack_free(3) to release ports - jpegdec: check buffer size before dereferencing - pulse: fix discovery of newly added devices - qtdemux fuzzing fixes - qtdemux: Add 'mp3 ' fourcc that VLC seems to produce now - qtdemux: Specify REDIRECT information in error message - rtpbin: fix shutdown crash in rtpbin - rtpsession: rename RTCP thread - rtpvp8pay, rtpvp9pay: fix caps leak in set_caps() - rtpjpegdepay: outputs framed jpeg - rtpjitterbuffer: Properly free internal packets queue in finalize() - rtspsrc: Don't return TRUE for unhandled query - rtspsrc: Avoid stack overflow recursing waiting for response - rtspsrc: Use the correct type for storing the max-rtcp-rtp-time-diff property - rtspsrc: Error out when failling to receive message response - rtspsrc: Fix for segmentation fault when handling set/get_parameter requests - speex: Fix crash on Windows caused by cross-CRT issue - speexdec: Crash when stopping the pipeline - splitmuxsrc: Properly stop the loop if no part reader is present - use gst_element_class_set_metadata when passing dynamic strings - v4l2videodec: Increase internal bitstream pool size - v4l2: fix crash when handling unsupported video format - videocrop: allow properties to be animated by GstController - videomixer: Don't leak peer caps - vp8enc/vp8enc: set 1 for the default value of VP8E_SET_STATIC_THRESHOLD - wavenc: Fix writing of the channel mask with >2 channels gstreamer-plugins-bad was updated to version 1.16.3 (bsc#1181255): - amcvideodec: fix sync meta copying not taking a reference - audiobuffersplit: Perform discont tracking on running time - audiobuffersplit: Specify in the template caps that only interleaved audio is supported - audiobuffersplit: Unset DISCONT flag if not discontinuous - autoconvert: Fix lock-less exchange or free condition - autoconvert: fix compiler warnings with g_atomic on recent GLib versions - avfvideosrc: element requests camera permissions even with capture-screen property is true - codecparsers: h264parser: guard against ref_pic_markings overflow - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated - dtls/connection: fix EOF handling with openssl 1.1.1e - fdkaacdec: add support for mpegversion=2 - hls: Check nettle version to ensure AES128 support - ipcpipeline: Rework compiler checks - interlace: Increment phase_index before checking if we're at the end of the phase - lv2: Make it build with -fno-common - h264parser: Do not allocate too large size of memory for registered user data SEI - ladspa: fix unbounded integer properties - modplug: avoid division by zero - msdkdec: Fix GstMsdkContext leak - msdkenc: fix leaks on windows - musepackdec: Don't fail all queries if no sample rate is known yet - openslessink: Allow openslessink to handle 48kHz streams. - opencv: allow compilation against 4.2.x - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc - vulkan: Drop use of VK_RESULT_BEGIN_RANGE - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset - wasapi: Fix possible deadlock while downwards state change - waylandsink: Clear window when pipeline is stopped - webrtc: Support non-trickle ICE candidates in the SDP - webrtc: Unmap all non-binary buffers received via the datachannel - meson: build with neon 0.31 - Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch - h264parser: guard against ref_pic_markings overflow (bsc#1181255 CVE-2021-3185) - Disable the kate/libtiger plugin. Kate streams for karaoke are not used anymore, and the source tarball for libtiger is no longer available upstream. (jsc#SLE-13843) gstreamer-plugins-ugly was updated to version 1.16.3 (bsc#1181255): + x264enc: corrected em_data value in CEA-708 CC SEI message gstreamer-plugins-base was updated to version 1.16.3 (bsc#1181255): - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate - audioaggregator: Fix negotiation with downstream if there is no peer yet - audioencoder: fix segment event leak - discoverer: Fix caps handling in `pad-added` signal handler - discoverer: Start discovering next URI from right thread - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify) - gl/display/egl: ensure debug category is initialized - gstglwindow_x11: fix resize - pbutils: Add latest H.264 level values - rtpbuffer: fix header extension length validation - video: Fix NV12_64Z32 number of component - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5 - video: fix top/bottom field flags - videodecoder: don't copy interlace-mode from reference state - appsrc/appsink: Make setting/replacing callbacks thread-safe - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU - decodebin3: only force streams-selected seqnum after a select-streams - glupload: Fix fallback from direct dmabuf to dmabuf upload method - glvideomixer: perform `_get_highest_precision()` on the GL thread - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings - oggstream: Workaround for broken PAR in VP8 BOS - subparse: accept WebVTT timestamps without an hour component - playbin: Handle error message with redirection indication - textrender: Fix AYUV output. - typefind: Consider MPEG-PS PSM to be a PES type - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time - videoaggregator: Don't configure NULL chroma-site/colorimetry - videorate/videoscale/audioresample: Ensure that the caps returned from... - build: Replace bashisms in configure for Wayland and GLES3 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-822=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gstreamer-1.16.3-lp152.2.3.1 gstreamer-debuginfo-1.16.3-lp152.2.3.1 gstreamer-debugsource-1.16.3-lp152.2.3.1 gstreamer-devel-1.16.3-lp152.2.3.1 gstreamer-doc-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-debugsource-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-devel-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-doc-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-1.16.3-lp152.3.3.1 gstreamer-plugins-base-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-debugsource-1.16.3-lp152.3.3.1 gstreamer-plugins-base-devel-1.16.3-lp152.3.3.1 gstreamer-plugins-base-doc-1.16.3-lp152.3.3.1 gstreamer-plugins-good-1.16.3-lp152.2.3.1 gstreamer-plugins-good-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-debugsource-1.16.3-lp152.2.3.1 gstreamer-plugins-good-doc-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-gtk-1.16.3-lp152.2.3.1 gstreamer-plugins-good-gtk-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-qtqml-1.16.3-lp152.2.3.1 gstreamer-plugins-good-qtqml-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-debugsource-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-doc-1.16.3-lp152.2.3.1 gstreamer-utils-1.16.3-lp152.2.3.1 gstreamer-utils-debuginfo-1.16.3-lp152.2.3.1 libgstadaptivedemux-1_0-0-1.16.3-lp152.3.3.1 libgstadaptivedemux-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstapp-1_0-0-1.16.3-lp152.3.3.1 libgstapp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstfft-1_0-0-1.16.3-lp152.3.3.1 libgstfft-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstgl-1_0-0-1.16.3-lp152.3.3.1 libgstgl-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstreamer-1_0-0-1.16.3-lp152.2.3.1 libgstreamer-1_0-0-debuginfo-1.16.3-lp152.2.3.1 libgstriff-1_0-0-1.16.3-lp152.3.3.1 libgstriff-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgsttag-1_0-0-1.16.3-lp152.3.3.1 libgsttag-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-debuginfo-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-debuginfo-1.16.3-lp152.3.3.1 typelib-1_0-Gst-1_0-1.16.3-lp152.2.3.1 typelib-1_0-GstAllocators-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstApp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstAudio-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstGL-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstInsertBin-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstMpegts-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstPbutils-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstPlayer-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstRtp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstRtsp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstSdp-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstTag-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstVideo-1_0-1.16.3-lp152.3.3.1 typelib-1_0-GstWebRTC-1_0-1.16.3-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): gstreamer-32bit-1.16.3-lp152.2.3.1 gstreamer-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-base-32bit-debuginfo-1.16.3-lp152.3.3.1 gstreamer-plugins-base-devel-32bit-1.16.3-lp152.3.3.1 gstreamer-plugins-good-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-extra-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-good-jack-32bit-debuginfo-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-32bit-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-32bit-debuginfo-1.16.3-lp152.2.3.1 libgstadaptivedemux-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstadaptivedemux-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstallocators-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstapp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstapp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstaudio-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstbadaudio-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstcodecparsers-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstfft-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstfft-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstgl-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstgl-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstinsertbin-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstisoff-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstmpegts-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstpbutils-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstphotography-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstplayer-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstreamer-1_0-0-32bit-1.16.3-lp152.2.3.1 libgstreamer-1_0-0-32bit-debuginfo-1.16.3-lp152.2.3.1 libgstriff-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstriff-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstrtp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstrtsp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstsctp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstsdp-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgsttag-1_0-0-32bit-1.16.3-lp152.3.3.1 libgsttag-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-32bit-1.16.3-lp152.3.3.1 libgsturidownloader-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstvideo-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstwayland-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-32bit-1.16.3-lp152.3.3.1 libgstwebrtc-1_0-0-32bit-debuginfo-1.16.3-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): gstreamer-lang-1.16.3-lp152.2.3.1 gstreamer-plugins-bad-lang-1.16.3-lp152.3.3.1 gstreamer-plugins-base-lang-1.16.3-lp152.3.3.1 gstreamer-plugins-good-lang-1.16.3-lp152.2.3.1 gstreamer-plugins-ugly-lang-1.16.3-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3185.html https://bugzilla.suse.com/1181255

1 0

openSUSE-SU-2021:0821-1: important: Security update for slurm
by opensuse-security＠opensuse.org 01 Jun '21

01 Jun '21

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0821-1 Rating: important References: #1186024 Cross-References: CVE-2021-31215 CVSS scores: CVE-2021-31215 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-31215 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm fixes the following issues: - CVE-2021-31215: Fixed a environment mishandling that allowed remote code execution as SlurmUser (bsc#1186024). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-821=1 Package List: - openSUSE Leap 15.2 (x86_64): libnss_slurm2-20.02.7-lp152.2.6.1 libnss_slurm2-debuginfo-20.02.7-lp152.2.6.1 libpmi0-20.02.7-lp152.2.6.1 libpmi0-debuginfo-20.02.7-lp152.2.6.1 libslurm35-20.02.7-lp152.2.6.1 libslurm35-debuginfo-20.02.7-lp152.2.6.1 perl-slurm-20.02.7-lp152.2.6.1 perl-slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-20.02.7-lp152.2.6.1 slurm-auth-none-20.02.7-lp152.2.6.1 slurm-auth-none-debuginfo-20.02.7-lp152.2.6.1 slurm-config-20.02.7-lp152.2.6.1 slurm-config-man-20.02.7-lp152.2.6.1 slurm-cray-20.02.7-lp152.2.6.1 slurm-cray-debuginfo-20.02.7-lp152.2.6.1 slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-debugsource-20.02.7-lp152.2.6.1 slurm-devel-20.02.7-lp152.2.6.1 slurm-doc-20.02.7-lp152.2.6.1 slurm-hdf5-20.02.7-lp152.2.6.1 slurm-hdf5-debuginfo-20.02.7-lp152.2.6.1 slurm-lua-20.02.7-lp152.2.6.1 slurm-lua-debuginfo-20.02.7-lp152.2.6.1 slurm-munge-20.02.7-lp152.2.6.1 slurm-munge-debuginfo-20.02.7-lp152.2.6.1 slurm-node-20.02.7-lp152.2.6.1 slurm-node-debuginfo-20.02.7-lp152.2.6.1 slurm-openlava-20.02.7-lp152.2.6.1 slurm-pam_slurm-20.02.7-lp152.2.6.1 slurm-pam_slurm-debuginfo-20.02.7-lp152.2.6.1 slurm-plugins-20.02.7-lp152.2.6.1 slurm-plugins-debuginfo-20.02.7-lp152.2.6.1 slurm-rest-20.02.7-lp152.2.6.1 slurm-rest-debuginfo-20.02.7-lp152.2.6.1 slurm-seff-20.02.7-lp152.2.6.1 slurm-sjstat-20.02.7-lp152.2.6.1 slurm-slurmdbd-20.02.7-lp152.2.6.1 slurm-slurmdbd-debuginfo-20.02.7-lp152.2.6.1 slurm-sql-20.02.7-lp152.2.6.1 slurm-sql-debuginfo-20.02.7-lp152.2.6.1 slurm-sview-20.02.7-lp152.2.6.1 slurm-sview-debuginfo-20.02.7-lp152.2.6.1 slurm-torque-20.02.7-lp152.2.6.1 slurm-torque-debuginfo-20.02.7-lp152.2.6.1 slurm-webdoc-20.02.7-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-31215.html https://bugzilla.suse.com/1186024

1 0