July 2021 - openSUSE Security Announce

openSUSE-SU-2021:1825-1: important: Security update for lz4
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for lz4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1825-1 Rating: important References: #1185438 Cross-References: CVE-2021-3520 CVSS scores: CVE-2021-3520 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3520 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lz4 fixes the following issues: - CVE-2021-3520: Fixed memory corruption due to an integer overflow bug caused by memmove argument (bsc#1185438). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1825=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): liblz4-1-1.9.2-3.3.1 liblz4-1-debuginfo-1.9.2-3.3.1 liblz4-devel-1.9.2-3.3.1 lz4-1.9.2-3.3.1 lz4-debuginfo-1.9.2-3.3.1 lz4-debugsource-1.9.2-3.3.1 - openSUSE Leap 15.3 (x86_64): liblz4-1-32bit-1.9.2-3.3.1 liblz4-1-32bit-debuginfo-1.9.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3520.html https://bugzilla.suse.com/1185438

1 0

openSUSE-SU-2021:1834-1: important: Security update for ceph
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1834-1 Rating: important References: #1185619 #1186020 #1186021 Cross-References: CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVSS scores: CVE-2021-3509 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-3509 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3524 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3524 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3531 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3531 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - (CVE-2021-3509) fix cookie injection issue (bsc#1186021) - (CVE-2021-3531) RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (bsc#1186020) - (CVE-2021-3524) sanitize \r in s3 CORSConfiguration��s ExposeHeader (bsc#1185619) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1834=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ceph-15.2.12.83+g528da226523-3.25.1 ceph-base-15.2.12.83+g528da226523-3.25.1 ceph-base-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-common-15.2.12.83+g528da226523-3.25.1 ceph-common-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-debugsource-15.2.12.83+g528da226523-3.25.1 ceph-fuse-15.2.12.83+g528da226523-3.25.1 ceph-fuse-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-immutable-object-cache-15.2.12.83+g528da226523-3.25.1 ceph-immutable-object-cache-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mds-15.2.12.83+g528da226523-3.25.1 ceph-mds-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mgr-15.2.12.83+g528da226523-3.25.1 ceph-mgr-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mon-15.2.12.83+g528da226523-3.25.1 ceph-mon-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-osd-15.2.12.83+g528da226523-3.25.1 ceph-osd-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-radosgw-15.2.12.83+g528da226523-3.25.1 ceph-radosgw-debuginfo-15.2.12.83+g528da226523-3.25.1 cephfs-shell-15.2.12.83+g528da226523-3.25.1 libcephfs-devel-15.2.12.83+g528da226523-3.25.1 libcephfs2-15.2.12.83+g528da226523-3.25.1 libcephfs2-debuginfo-15.2.12.83+g528da226523-3.25.1 librados-devel-15.2.12.83+g528da226523-3.25.1 librados-devel-debuginfo-15.2.12.83+g528da226523-3.25.1 librados2-15.2.12.83+g528da226523-3.25.1 librados2-debuginfo-15.2.12.83+g528da226523-3.25.1 libradospp-devel-15.2.12.83+g528da226523-3.25.1 librbd-devel-15.2.12.83+g528da226523-3.25.1 librbd1-15.2.12.83+g528da226523-3.25.1 librbd1-debuginfo-15.2.12.83+g528da226523-3.25.1 librgw-devel-15.2.12.83+g528da226523-3.25.1 librgw2-15.2.12.83+g528da226523-3.25.1 librgw2-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-ceph-argparse-15.2.12.83+g528da226523-3.25.1 python3-ceph-common-15.2.12.83+g528da226523-3.25.1 python3-cephfs-15.2.12.83+g528da226523-3.25.1 python3-cephfs-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rados-15.2.12.83+g528da226523-3.25.1 python3-rados-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rbd-15.2.12.83+g528da226523-3.25.1 python3-rbd-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rgw-15.2.12.83+g528da226523-3.25.1 python3-rgw-debuginfo-15.2.12.83+g528da226523-3.25.1 rados-objclass-devel-15.2.12.83+g528da226523-3.25.1 rbd-fuse-15.2.12.83+g528da226523-3.25.1 rbd-fuse-debuginfo-15.2.12.83+g528da226523-3.25.1 rbd-mirror-15.2.12.83+g528da226523-3.25.1 rbd-mirror-debuginfo-15.2.12.83+g528da226523-3.25.1 rbd-nbd-15.2.12.83+g528da226523-3.25.1 rbd-nbd-debuginfo-15.2.12.83+g528da226523-3.25.1 - openSUSE Leap 15.3 (x86_64): ceph-test-15.2.12.83+g528da226523-3.25.1 ceph-test-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-test-debugsource-15.2.12.83+g528da226523-3.25.1 - openSUSE Leap 15.3 (noarch): ceph-grafana-dashboards-15.2.12.83+g528da226523-3.25.1 ceph-mgr-cephadm-15.2.12.83+g528da226523-3.25.1 ceph-mgr-dashboard-15.2.12.83+g528da226523-3.25.1 ceph-mgr-diskprediction-cloud-15.2.12.83+g528da226523-3.25.1 ceph-mgr-diskprediction-local-15.2.12.83+g528da226523-3.25.1 ceph-mgr-k8sevents-15.2.12.83+g528da226523-3.25.1 ceph-mgr-modules-core-15.2.12.83+g528da226523-3.25.1 ceph-mgr-rook-15.2.12.83+g528da226523-3.25.1 ceph-prometheus-alerts-15.2.12.83+g528da226523-3.25.1 cephadm-15.2.12.83+g528da226523-3.25.1 References: https://www.suse.com/security/cve/CVE-2021-3509.html https://www.suse.com/security/cve/CVE-2021-3524.html https://www.suse.com/security/cve/CVE-2021-3531.html https://bugzilla.suse.com/1185619 https://bugzilla.suse.com/1186020 https://bugzilla.suse.com/1186021

1 0

openSUSE-SU-2021:1651-1: critical: Security update for graphviz
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for graphviz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1651-1 Rating: critical References: #1185833 Cross-References: CVE-2020-18032 CVSS scores: CVE-2020-18032 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-18032 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphviz fixes the following issues: - CVE-2020-18032: Fixed possible remote code execution via buffer overflow (bsc#1185833). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1651=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): graphviz-2.40.1-6.9.1 graphviz-addons-debuginfo-2.40.1-6.9.1 graphviz-addons-debugsource-2.40.1-6.9.1 graphviz-debuginfo-2.40.1-6.9.1 graphviz-debugsource-2.40.1-6.9.1 graphviz-devel-2.40.1-6.9.1 graphviz-doc-2.40.1-6.9.1 graphviz-gd-2.40.1-6.9.1 graphviz-gd-debuginfo-2.40.1-6.9.1 graphviz-gnome-2.40.1-6.9.1 graphviz-gnome-debuginfo-2.40.1-6.9.1 graphviz-guile-2.40.1-6.9.1 graphviz-guile-debuginfo-2.40.1-6.9.1 graphviz-gvedit-2.40.1-6.9.1 graphviz-gvedit-debuginfo-2.40.1-6.9.1 graphviz-java-2.40.1-6.9.1 graphviz-java-debuginfo-2.40.1-6.9.1 graphviz-lua-2.40.1-6.9.1 graphviz-lua-debuginfo-2.40.1-6.9.1 graphviz-perl-2.40.1-6.9.1 graphviz-perl-debuginfo-2.40.1-6.9.1 graphviz-php-2.40.1-6.9.1 graphviz-php-debuginfo-2.40.1-6.9.1 graphviz-plugins-core-2.40.1-6.9.1 graphviz-plugins-core-debuginfo-2.40.1-6.9.1 graphviz-python-2.40.1-6.9.1 graphviz-python-debuginfo-2.40.1-6.9.1 graphviz-ruby-2.40.1-6.9.1 graphviz-ruby-debuginfo-2.40.1-6.9.1 graphviz-smyrna-2.40.1-6.9.1 graphviz-smyrna-debuginfo-2.40.1-6.9.1 graphviz-tcl-2.40.1-6.9.1 graphviz-tcl-debuginfo-2.40.1-6.9.1 libgraphviz6-2.40.1-6.9.1 libgraphviz6-debuginfo-2.40.1-6.9.1 References: https://www.suse.com/security/cve/CVE-2020-18032.html https://bugzilla.suse.com/1185833

1 0

openSUSE-SU-2021:2163-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2163-1 Rating: moderate References: #1186328 Cross-References: CVE-2020-15522 CVSS scores: CVE-2020-15522 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-15522 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following issues: - CVE-2020-15522: Fixed a timing issue within the EC math library (bsc#1186328). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2163=1 Package List: - openSUSE Leap 15.3 (noarch): bouncycastle-1.64-3.3.1 bouncycastle-javadoc-1.64-3.3.1 bouncycastle-mail-1.64-3.3.1 bouncycastle-pg-1.64-3.3.1 bouncycastle-pkix-1.64-3.3.1 bouncycastle-tls-1.64-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15522.html https://bugzilla.suse.com/1186328

1 0

openSUSE-SU-2021:2118-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2118-1 Rating: important References: #1186151 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ovmf fixes the following issues: - Fixed a possible buffer overflow in IScsiDxe (bsc#1186151) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2118=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): ovmf-202008-10.8.1 ovmf-tools-202008-10.8.1 - openSUSE Leap 15.3 (noarch): qemu-ovmf-ia32-202008-10.8.1 qemu-ovmf-x86_64-202008-10.8.1 qemu-uefi-aarch32-202008-10.8.1 qemu-uefi-aarch64-202008-10.8.1 - openSUSE Leap 15.3 (x86_64): qemu-ovmf-x86_64-debug-202008-10.8.1 References: https://bugzilla.suse.com/1186151

1 0

openSUSE-SU-2021:1989-1: moderate: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1989-1 Rating: moderate References: #1185055 Cross-References: CVE-2021-2163 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u292 (icedtea 3.19.0). - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1989=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.292-3.52.1 java-1_8_0-openjdk-accessibility-1.8.0.292-3.52.1 java-1_8_0-openjdk-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-debugsource-1.8.0.292-3.52.1 java-1_8_0-openjdk-demo-1.8.0.292-3.52.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-devel-1.8.0.292-3.52.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-headless-1.8.0.292-3.52.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-src-1.8.0.292-3.52.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.292-3.52.1 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://bugzilla.suse.com/1185055

1 0

openSUSE-SU-2021:2123-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2123-1 Rating: important References: #1187418 #1187419 Cross-References: CVE-2021-29157 CVE-2021-33515 CVSS scores: CVE-2021-29157 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-33515 (NVD) : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-33515 (SUSE): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418) - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2123=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dovecot23-2.3.11.3-55.1 dovecot23-backend-mysql-2.3.11.3-55.1 dovecot23-backend-mysql-debuginfo-2.3.11.3-55.1 dovecot23-backend-pgsql-2.3.11.3-55.1 dovecot23-backend-pgsql-debuginfo-2.3.11.3-55.1 dovecot23-backend-sqlite-2.3.11.3-55.1 dovecot23-backend-sqlite-debuginfo-2.3.11.3-55.1 dovecot23-debuginfo-2.3.11.3-55.1 dovecot23-debugsource-2.3.11.3-55.1 dovecot23-devel-2.3.11.3-55.1 dovecot23-fts-2.3.11.3-55.1 dovecot23-fts-debuginfo-2.3.11.3-55.1 dovecot23-fts-lucene-2.3.11.3-55.1 dovecot23-fts-lucene-debuginfo-2.3.11.3-55.1 dovecot23-fts-solr-2.3.11.3-55.1 dovecot23-fts-solr-debuginfo-2.3.11.3-55.1 dovecot23-fts-squat-2.3.11.3-55.1 dovecot23-fts-squat-debuginfo-2.3.11.3-55.1 References: https://www.suse.com/security/cve/CVE-2021-29157.html https://www.suse.com/security/cve/CVE-2021-33515.html https://bugzilla.suse.com/1187418 https://bugzilla.suse.com/1187419

1 0

openSUSE-SU-2021:1897-1: important: Security update for libX11
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1897-1 Rating: important References: #1186643 Cross-References: CVE-2021-31535 CVSS scores: CVE-2021-31535 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-31535 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - Regression in the fix for CVE-2021-31535, causing segfaults for xforms applications like fdesign (bsc#1186643) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1897=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libX11-6-1.6.5-3.21.1 libX11-6-debuginfo-1.6.5-3.21.1 libX11-debugsource-1.6.5-3.21.1 libX11-devel-1.6.5-3.21.1 libX11-xcb1-1.6.5-3.21.1 libX11-xcb1-debuginfo-1.6.5-3.21.1 - openSUSE Leap 15.3 (noarch): libX11-data-1.6.5-3.21.1 - openSUSE Leap 15.3 (x86_64): libX11-6-32bit-1.6.5-3.21.1 libX11-6-32bit-debuginfo-1.6.5-3.21.1 libX11-devel-32bit-1.6.5-3.21.1 libX11-xcb1-32bit-1.6.5-3.21.1 libX11-xcb1-32bit-debuginfo-1.6.5-3.21.1 References: https://www.suse.com/security/cve/CVE-2021-31535.html https://bugzilla.suse.com/1186643

1 0

openSUSE-SU-2021:1958-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1958-1 Rating: moderate References: #1186764 Cross-References: CVE-2020-17541 CVSS scores: CVE-2020-17541 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libjpeg-turbo fixes the following issues: - CVE-2020-17541: Fixed a stack-based buffer overflow in the "transform" component (bsc#1186764). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1958=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjpeg-turbo-1.5.3-5.18.1 libjpeg-turbo-debuginfo-1.5.3-5.18.1 libjpeg-turbo-debugsource-1.5.3-5.18.1 libjpeg62-62.2.0-5.18.1 libjpeg62-debuginfo-62.2.0-5.18.1 libjpeg62-devel-62.2.0-5.18.1 libjpeg62-turbo-1.5.3-5.18.1 libjpeg62-turbo-debugsource-1.5.3-5.18.1 libjpeg8-8.1.2-5.18.1 libjpeg8-debuginfo-8.1.2-5.18.1 libjpeg8-devel-8.1.2-5.18.1 libturbojpeg0-8.1.2-5.18.1 libturbojpeg0-debuginfo-8.1.2-5.18.1 - openSUSE Leap 15.3 (x86_64): libjpeg62-32bit-62.2.0-5.18.1 libjpeg62-32bit-debuginfo-62.2.0-5.18.1 libjpeg62-devel-32bit-62.2.0-5.18.1 libjpeg8-32bit-8.1.2-5.18.1 libjpeg8-32bit-debuginfo-8.1.2-5.18.1 libjpeg8-devel-32bit-8.1.2-5.18.1 libturbojpeg0-32bit-8.1.2-5.18.1 libturbojpeg0-32bit-debuginfo-8.1.2-5.18.1 References: https://www.suse.com/security/cve/CVE-2020-17541.html https://bugzilla.suse.com/1186764

1 0

openSUSE-SU-2021:1666-1: moderate: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1666-1 Rating: moderate References: #1185055 Cross-References: CVE-2021-2163 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: - Update to OpenJDK 8u292 build 10 with OpenJ9 0.26.0 virtual machine. - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1666=1 Package List: - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.292-3.14.1 java-1_8_0-openj9-accessibility-1.8.0.292-3.14.1 java-1_8_0-openj9-debuginfo-1.8.0.292-3.14.1 java-1_8_0-openj9-debugsource-1.8.0.292-3.14.1 java-1_8_0-openj9-demo-1.8.0.292-3.14.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.292-3.14.1 java-1_8_0-openj9-devel-1.8.0.292-3.14.1 java-1_8_0-openj9-headless-1.8.0.292-3.14.1 java-1_8_0-openj9-src-1.8.0.292-3.14.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.292-3.14.1 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://bugzilla.suse.com/1185055

1 0