July 2021 - openSUSE Security Announce

openSUSE-SU-2021:1825-1: important: Security update for lz4
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for lz4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1825-1 Rating: important References: #1185438 Cross-References: CVE-2021-3520 CVSS scores: CVE-2021-3520 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3520 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lz4 fixes the following issues: - CVE-2021-3520: Fixed memory corruption due to an integer overflow bug caused by memmove argument (bsc#1185438). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1825=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): liblz4-1-1.9.2-3.3.1 liblz4-1-debuginfo-1.9.2-3.3.1 liblz4-devel-1.9.2-3.3.1 lz4-1.9.2-3.3.1 lz4-debuginfo-1.9.2-3.3.1 lz4-debugsource-1.9.2-3.3.1 - openSUSE Leap 15.3 (x86_64): liblz4-1-32bit-1.9.2-3.3.1 liblz4-1-32bit-debuginfo-1.9.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3520.html https://bugzilla.suse.com/1185438

1 0

openSUSE-SU-2021:1834-1: important: Security update for ceph
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1834-1 Rating: important References: #1185619 #1186020 #1186021 Cross-References: CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVSS scores: CVE-2021-3509 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-3509 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3524 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3524 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3531 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3531 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - (CVE-2021-3509) fix cookie injection issue (bsc#1186021) - (CVE-2021-3531) RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (bsc#1186020) - (CVE-2021-3524) sanitize \r in s3 CORSConfiguration��s ExposeHeader (bsc#1185619) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1834=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ceph-15.2.12.83+g528da226523-3.25.1 ceph-base-15.2.12.83+g528da226523-3.25.1 ceph-base-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-common-15.2.12.83+g528da226523-3.25.1 ceph-common-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-debugsource-15.2.12.83+g528da226523-3.25.1 ceph-fuse-15.2.12.83+g528da226523-3.25.1 ceph-fuse-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-immutable-object-cache-15.2.12.83+g528da226523-3.25.1 ceph-immutable-object-cache-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mds-15.2.12.83+g528da226523-3.25.1 ceph-mds-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mgr-15.2.12.83+g528da226523-3.25.1 ceph-mgr-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-mon-15.2.12.83+g528da226523-3.25.1 ceph-mon-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-osd-15.2.12.83+g528da226523-3.25.1 ceph-osd-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-radosgw-15.2.12.83+g528da226523-3.25.1 ceph-radosgw-debuginfo-15.2.12.83+g528da226523-3.25.1 cephfs-shell-15.2.12.83+g528da226523-3.25.1 libcephfs-devel-15.2.12.83+g528da226523-3.25.1 libcephfs2-15.2.12.83+g528da226523-3.25.1 libcephfs2-debuginfo-15.2.12.83+g528da226523-3.25.1 librados-devel-15.2.12.83+g528da226523-3.25.1 librados-devel-debuginfo-15.2.12.83+g528da226523-3.25.1 librados2-15.2.12.83+g528da226523-3.25.1 librados2-debuginfo-15.2.12.83+g528da226523-3.25.1 libradospp-devel-15.2.12.83+g528da226523-3.25.1 librbd-devel-15.2.12.83+g528da226523-3.25.1 librbd1-15.2.12.83+g528da226523-3.25.1 librbd1-debuginfo-15.2.12.83+g528da226523-3.25.1 librgw-devel-15.2.12.83+g528da226523-3.25.1 librgw2-15.2.12.83+g528da226523-3.25.1 librgw2-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-ceph-argparse-15.2.12.83+g528da226523-3.25.1 python3-ceph-common-15.2.12.83+g528da226523-3.25.1 python3-cephfs-15.2.12.83+g528da226523-3.25.1 python3-cephfs-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rados-15.2.12.83+g528da226523-3.25.1 python3-rados-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rbd-15.2.12.83+g528da226523-3.25.1 python3-rbd-debuginfo-15.2.12.83+g528da226523-3.25.1 python3-rgw-15.2.12.83+g528da226523-3.25.1 python3-rgw-debuginfo-15.2.12.83+g528da226523-3.25.1 rados-objclass-devel-15.2.12.83+g528da226523-3.25.1 rbd-fuse-15.2.12.83+g528da226523-3.25.1 rbd-fuse-debuginfo-15.2.12.83+g528da226523-3.25.1 rbd-mirror-15.2.12.83+g528da226523-3.25.1 rbd-mirror-debuginfo-15.2.12.83+g528da226523-3.25.1 rbd-nbd-15.2.12.83+g528da226523-3.25.1 rbd-nbd-debuginfo-15.2.12.83+g528da226523-3.25.1 - openSUSE Leap 15.3 (x86_64): ceph-test-15.2.12.83+g528da226523-3.25.1 ceph-test-debuginfo-15.2.12.83+g528da226523-3.25.1 ceph-test-debugsource-15.2.12.83+g528da226523-3.25.1 - openSUSE Leap 15.3 (noarch): ceph-grafana-dashboards-15.2.12.83+g528da226523-3.25.1 ceph-mgr-cephadm-15.2.12.83+g528da226523-3.25.1 ceph-mgr-dashboard-15.2.12.83+g528da226523-3.25.1 ceph-mgr-diskprediction-cloud-15.2.12.83+g528da226523-3.25.1 ceph-mgr-diskprediction-local-15.2.12.83+g528da226523-3.25.1 ceph-mgr-k8sevents-15.2.12.83+g528da226523-3.25.1 ceph-mgr-modules-core-15.2.12.83+g528da226523-3.25.1 ceph-mgr-rook-15.2.12.83+g528da226523-3.25.1 ceph-prometheus-alerts-15.2.12.83+g528da226523-3.25.1 cephadm-15.2.12.83+g528da226523-3.25.1 References: https://www.suse.com/security/cve/CVE-2021-3509.html https://www.suse.com/security/cve/CVE-2021-3524.html https://www.suse.com/security/cve/CVE-2021-3531.html https://bugzilla.suse.com/1185619 https://bugzilla.suse.com/1186020 https://bugzilla.suse.com/1186021

1 0

openSUSE-SU-2021:1651-1: critical: Security update for graphviz
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for graphviz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1651-1 Rating: critical References: #1185833 Cross-References: CVE-2020-18032 CVSS scores: CVE-2020-18032 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-18032 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphviz fixes the following issues: - CVE-2020-18032: Fixed possible remote code execution via buffer overflow (bsc#1185833). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1651=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): graphviz-2.40.1-6.9.1 graphviz-addons-debuginfo-2.40.1-6.9.1 graphviz-addons-debugsource-2.40.1-6.9.1 graphviz-debuginfo-2.40.1-6.9.1 graphviz-debugsource-2.40.1-6.9.1 graphviz-devel-2.40.1-6.9.1 graphviz-doc-2.40.1-6.9.1 graphviz-gd-2.40.1-6.9.1 graphviz-gd-debuginfo-2.40.1-6.9.1 graphviz-gnome-2.40.1-6.9.1 graphviz-gnome-debuginfo-2.40.1-6.9.1 graphviz-guile-2.40.1-6.9.1 graphviz-guile-debuginfo-2.40.1-6.9.1 graphviz-gvedit-2.40.1-6.9.1 graphviz-gvedit-debuginfo-2.40.1-6.9.1 graphviz-java-2.40.1-6.9.1 graphviz-java-debuginfo-2.40.1-6.9.1 graphviz-lua-2.40.1-6.9.1 graphviz-lua-debuginfo-2.40.1-6.9.1 graphviz-perl-2.40.1-6.9.1 graphviz-perl-debuginfo-2.40.1-6.9.1 graphviz-php-2.40.1-6.9.1 graphviz-php-debuginfo-2.40.1-6.9.1 graphviz-plugins-core-2.40.1-6.9.1 graphviz-plugins-core-debuginfo-2.40.1-6.9.1 graphviz-python-2.40.1-6.9.1 graphviz-python-debuginfo-2.40.1-6.9.1 graphviz-ruby-2.40.1-6.9.1 graphviz-ruby-debuginfo-2.40.1-6.9.1 graphviz-smyrna-2.40.1-6.9.1 graphviz-smyrna-debuginfo-2.40.1-6.9.1 graphviz-tcl-2.40.1-6.9.1 graphviz-tcl-debuginfo-2.40.1-6.9.1 libgraphviz6-2.40.1-6.9.1 libgraphviz6-debuginfo-2.40.1-6.9.1 References: https://www.suse.com/security/cve/CVE-2020-18032.html https://bugzilla.suse.com/1185833

1 0

openSUSE-SU-2021:2163-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2163-1 Rating: moderate References: #1186328 Cross-References: CVE-2020-15522 CVSS scores: CVE-2020-15522 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-15522 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bouncycastle fixes the following issues: - CVE-2020-15522: Fixed a timing issue within the EC math library (bsc#1186328). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2163=1 Package List: - openSUSE Leap 15.3 (noarch): bouncycastle-1.64-3.3.1 bouncycastle-javadoc-1.64-3.3.1 bouncycastle-mail-1.64-3.3.1 bouncycastle-pg-1.64-3.3.1 bouncycastle-pkix-1.64-3.3.1 bouncycastle-tls-1.64-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-15522.html https://bugzilla.suse.com/1186328

1 0

openSUSE-SU-2021:2118-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2118-1 Rating: important References: #1186151 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ovmf fixes the following issues: - Fixed a possible buffer overflow in IScsiDxe (bsc#1186151) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2118=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): ovmf-202008-10.8.1 ovmf-tools-202008-10.8.1 - openSUSE Leap 15.3 (noarch): qemu-ovmf-ia32-202008-10.8.1 qemu-ovmf-x86_64-202008-10.8.1 qemu-uefi-aarch32-202008-10.8.1 qemu-uefi-aarch64-202008-10.8.1 - openSUSE Leap 15.3 (x86_64): qemu-ovmf-x86_64-debug-202008-10.8.1 References: https://bugzilla.suse.com/1186151

1 0

openSUSE-SU-2021:1989-1: moderate: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1989-1 Rating: moderate References: #1185055 Cross-References: CVE-2021-2163 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u292 (icedtea 3.19.0). - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1989=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.292-3.52.1 java-1_8_0-openjdk-accessibility-1.8.0.292-3.52.1 java-1_8_0-openjdk-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-debugsource-1.8.0.292-3.52.1 java-1_8_0-openjdk-demo-1.8.0.292-3.52.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-devel-1.8.0.292-3.52.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-headless-1.8.0.292-3.52.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.292-3.52.1 java-1_8_0-openjdk-src-1.8.0.292-3.52.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.292-3.52.1 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://bugzilla.suse.com/1185055

1 0

openSUSE-SU-2021:2123-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2123-1 Rating: important References: #1187418 #1187419 Cross-References: CVE-2021-29157 CVE-2021-33515 CVSS scores: CVE-2021-29157 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-33515 (NVD) : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-33515 (SUSE): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418) - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2123=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dovecot23-2.3.11.3-55.1 dovecot23-backend-mysql-2.3.11.3-55.1 dovecot23-backend-mysql-debuginfo-2.3.11.3-55.1 dovecot23-backend-pgsql-2.3.11.3-55.1 dovecot23-backend-pgsql-debuginfo-2.3.11.3-55.1 dovecot23-backend-sqlite-2.3.11.3-55.1 dovecot23-backend-sqlite-debuginfo-2.3.11.3-55.1 dovecot23-debuginfo-2.3.11.3-55.1 dovecot23-debugsource-2.3.11.3-55.1 dovecot23-devel-2.3.11.3-55.1 dovecot23-fts-2.3.11.3-55.1 dovecot23-fts-debuginfo-2.3.11.3-55.1 dovecot23-fts-lucene-2.3.11.3-55.1 dovecot23-fts-lucene-debuginfo-2.3.11.3-55.1 dovecot23-fts-solr-2.3.11.3-55.1 dovecot23-fts-solr-debuginfo-2.3.11.3-55.1 dovecot23-fts-squat-2.3.11.3-55.1 dovecot23-fts-squat-debuginfo-2.3.11.3-55.1 References: https://www.suse.com/security/cve/CVE-2021-29157.html https://www.suse.com/security/cve/CVE-2021-33515.html https://bugzilla.suse.com/1187418 https://bugzilla.suse.com/1187419

1 0

openSUSE-SU-2021:1897-1: important: Security update for libX11
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1897-1 Rating: important References: #1186643 Cross-References: CVE-2021-31535 CVSS scores: CVE-2021-31535 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-31535 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - Regression in the fix for CVE-2021-31535, causing segfaults for xforms applications like fdesign (bsc#1186643) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1897=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libX11-6-1.6.5-3.21.1 libX11-6-debuginfo-1.6.5-3.21.1 libX11-debugsource-1.6.5-3.21.1 libX11-devel-1.6.5-3.21.1 libX11-xcb1-1.6.5-3.21.1 libX11-xcb1-debuginfo-1.6.5-3.21.1 - openSUSE Leap 15.3 (noarch): libX11-data-1.6.5-3.21.1 - openSUSE Leap 15.3 (x86_64): libX11-6-32bit-1.6.5-3.21.1 libX11-6-32bit-debuginfo-1.6.5-3.21.1 libX11-devel-32bit-1.6.5-3.21.1 libX11-xcb1-32bit-1.6.5-3.21.1 libX11-xcb1-32bit-debuginfo-1.6.5-3.21.1 References: https://www.suse.com/security/cve/CVE-2021-31535.html https://bugzilla.suse.com/1186643

1 0

openSUSE-SU-2021:1958-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1958-1 Rating: moderate References: #1186764 Cross-References: CVE-2020-17541 CVSS scores: CVE-2020-17541 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libjpeg-turbo fixes the following issues: - CVE-2020-17541: Fixed a stack-based buffer overflow in the "transform" component (bsc#1186764). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1958=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjpeg-turbo-1.5.3-5.18.1 libjpeg-turbo-debuginfo-1.5.3-5.18.1 libjpeg-turbo-debugsource-1.5.3-5.18.1 libjpeg62-62.2.0-5.18.1 libjpeg62-debuginfo-62.2.0-5.18.1 libjpeg62-devel-62.2.0-5.18.1 libjpeg62-turbo-1.5.3-5.18.1 libjpeg62-turbo-debugsource-1.5.3-5.18.1 libjpeg8-8.1.2-5.18.1 libjpeg8-debuginfo-8.1.2-5.18.1 libjpeg8-devel-8.1.2-5.18.1 libturbojpeg0-8.1.2-5.18.1 libturbojpeg0-debuginfo-8.1.2-5.18.1 - openSUSE Leap 15.3 (x86_64): libjpeg62-32bit-62.2.0-5.18.1 libjpeg62-32bit-debuginfo-62.2.0-5.18.1 libjpeg62-devel-32bit-62.2.0-5.18.1 libjpeg8-32bit-8.1.2-5.18.1 libjpeg8-32bit-debuginfo-8.1.2-5.18.1 libjpeg8-devel-32bit-8.1.2-5.18.1 libturbojpeg0-32bit-8.1.2-5.18.1 libturbojpeg0-32bit-debuginfo-8.1.2-5.18.1 References: https://www.suse.com/security/cve/CVE-2020-17541.html https://bugzilla.suse.com/1186764

1 0

openSUSE-SU-2021:1666-1: moderate: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1666-1 Rating: moderate References: #1185055 Cross-References: CVE-2021-2163 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: - Update to OpenJDK 8u292 build 10 with OpenJ9 0.26.0 virtual machine. - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1666=1 Package List: - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.292-3.14.1 java-1_8_0-openj9-accessibility-1.8.0.292-3.14.1 java-1_8_0-openj9-debuginfo-1.8.0.292-3.14.1 java-1_8_0-openj9-debugsource-1.8.0.292-3.14.1 java-1_8_0-openj9-demo-1.8.0.292-3.14.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.292-3.14.1 java-1_8_0-openj9-devel-1.8.0.292-3.14.1 java-1_8_0-openj9-headless-1.8.0.292-3.14.1 java-1_8_0-openj9-src-1.8.0.292-3.14.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.292-3.14.1 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://bugzilla.suse.com/1185055

1 0

openSUSE-SU-2021:1826-1: important: Security update for bind
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1826-1 Rating: important References: #1183453 #1185073 Cross-References: CVE-2021-25214 CVE-2021-25215 CVSS scores: CVE-2021-25214 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-25214 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-25215 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-25215 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - CVE-2021-25214: Fixed a broken inbound incremental zone update (IXFR) which could have caused named to terminate unexpectedly (bsc#1185345). - CVE-2021-25215: Fixed an assertion check which could have failed while answering queries for DNAME records that required the DNAME to be processed to resolve itself (bsc#1185345). - Switched from /var/run to /run (bsc#1185073) - Hardening: Compiled binary with PIE flags to make it position independent Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1826=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bind-9.16.6-22.7.1 bind-chrootenv-9.16.6-22.7.1 bind-debuginfo-9.16.6-22.7.1 bind-debugsource-9.16.6-22.7.1 bind-devel-9.16.6-22.7.1 bind-utils-9.16.6-22.7.1 bind-utils-debuginfo-9.16.6-22.7.1 libbind9-1600-9.16.6-22.7.1 libbind9-1600-debuginfo-9.16.6-22.7.1 libdns1605-9.16.6-22.7.1 libdns1605-debuginfo-9.16.6-22.7.1 libirs-devel-9.16.6-22.7.1 libirs1601-9.16.6-22.7.1 libirs1601-debuginfo-9.16.6-22.7.1 libisc1606-9.16.6-22.7.1 libisc1606-debuginfo-9.16.6-22.7.1 libisccc1600-9.16.6-22.7.1 libisccc1600-debuginfo-9.16.6-22.7.1 libisccfg1600-9.16.6-22.7.1 libisccfg1600-debuginfo-9.16.6-22.7.1 libns1604-9.16.6-22.7.1 libns1604-debuginfo-9.16.6-22.7.1 - openSUSE Leap 15.3 (noarch): bind-doc-9.16.6-22.7.1 python3-bind-9.16.6-22.7.1 References: https://www.suse.com/security/cve/CVE-2021-25214.html https://www.suse.com/security/cve/CVE-2021-25215.html https://bugzilla.suse.com/1183453 https://bugzilla.suse.com/1185073

1 0

openSUSE-SU-2021:1755-1: moderate: Security update for libu2f-host
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libu2f-host ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1755-1 Rating: moderate References: #1124781 #1128140 #1184648 ECO-3687 Cross-References: CVE-2018-20340 CVE-2019-9578 CVSS scores: CVE-2018-20340 (NVD) : 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-20340 (SUSE): 6.4 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-9578 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9578 (SUSE): 2.1 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities, contains one feature and has one errata is now available. Description: This update for libu2f-host fixes the following issues: This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648) Version 1.1.10 (released 2019-05-15) - Add new devices to udev rules. - Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140) Version 1.1.9 (released 2019-03-06) - Fix CID copying from the init response, which broke compatibility with some devices. Version 1.1.8 (released 2019-03-05) - Add udev rules - Drop 70-old-u2f.rules and use 70-u2f.rules for everything - Use a random nonce for setting up CID to prevent fingerprinting - CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140). Version 1.1.7 (released 2019-01-08) - Fix for trusting length from device in device init. - Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781) - Add udev rules for some new devices. - Add udev rule for Feitian ePass FIDO - Add a timeout to the register and authenticate actions. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1755=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libu2f-host-debuginfo-1.1.10-3.9.1 libu2f-host-debugsource-1.1.10-3.9.1 libu2f-host-devel-1.1.10-3.9.1 libu2f-host-doc-1.1.10-3.9.1 libu2f-host0-1.1.10-3.9.1 libu2f-host0-debuginfo-1.1.10-3.9.1 u2f-host-1.1.10-3.9.1 u2f-host-debuginfo-1.1.10-3.9.1 References: https://www.suse.com/security/cve/CVE-2018-20340.html https://www.suse.com/security/cve/CVE-2019-9578.html https://bugzilla.suse.com/1124781 https://bugzilla.suse.com/1128140 https://bugzilla.suse.com/1184648

1 0

openSUSE-SU-2021:1664-1: moderate: Security update for libass
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1664-1 Rating: moderate References: #1184153 Cross-References: CVE-2020-24994 CVSS scores: CVE-2020-24994 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-24994: Fixed a stack overflow in the parse_tag (bsc#1184153). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1664=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libass-debugsource-0.14.0-3.6.1 libass-devel-0.14.0-3.6.1 libass9-0.14.0-3.6.1 libass9-debuginfo-0.14.0-3.6.1 - openSUSE Leap 15.3 (x86_64): libass9-32bit-0.14.0-3.6.1 libass9-32bit-debuginfo-0.14.0-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-24994.html https://bugzilla.suse.com/1184153

1 0

openSUSE-SU-2021:1860-1: critical: Security update for libwebp
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for libwebp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1860-1 Rating: critical References: #1185652 #1185654 #1185673 #1185674 #1185685 #1185686 #1185688 #1185690 #1185691 #1186247 Cross-References: CVE-2018-25009 CVE-2018-25010 CVE-2018-25011 CVE-2018-25012 CVE-2018-25013 CVE-2020-36328 CVE-2020-36329 CVE-2020-36330 CVE-2020-36331 CVE-2020-36332 CVSS scores: CVE-2018-25009 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25009 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25010 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25010 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25011 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-25011 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-25012 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25012 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2018-25013 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36328 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-36328 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-36329 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-36329 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2020-36330 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36330 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36331 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36331 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36332 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-36332 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for libwebp fixes the following issues: - CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685). - CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691). - CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674). - CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652). - CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690). - CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688). - CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654). - CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686). - CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673). - CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1860=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwebp6-0.5.0-3.5.1 libwebp6-debuginfo-0.5.0-3.5.1 libwebpdecoder2-0.5.0-3.5.1 libwebpdecoder2-debuginfo-0.5.0-3.5.1 libwebpextras0-0.5.0-3.5.1 libwebpextras0-debuginfo-0.5.0-3.5.1 libwebpmux2-0.5.0-3.5.1 libwebpmux2-debuginfo-0.5.0-3.5.1 - openSUSE Leap 15.3 (x86_64): libwebp6-32bit-0.5.0-3.5.1 libwebp6-32bit-debuginfo-0.5.0-3.5.1 libwebpdecoder2-32bit-0.5.0-3.5.1 libwebpdecoder2-32bit-debuginfo-0.5.0-3.5.1 libwebpextras0-32bit-0.5.0-3.5.1 libwebpextras0-32bit-debuginfo-0.5.0-3.5.1 libwebpmux2-32bit-0.5.0-3.5.1 libwebpmux2-32bit-debuginfo-0.5.0-3.5.1 References: https://www.suse.com/security/cve/CVE-2018-25009.html https://www.suse.com/security/cve/CVE-2018-25010.html https://www.suse.com/security/cve/CVE-2018-25011.html https://www.suse.com/security/cve/CVE-2018-25012.html https://www.suse.com/security/cve/CVE-2018-25013.html https://www.suse.com/security/cve/CVE-2020-36328.html https://www.suse.com/security/cve/CVE-2020-36329.html https://www.suse.com/security/cve/CVE-2020-36330.html https://www.suse.com/security/cve/CVE-2020-36331.html https://www.suse.com/security/cve/CVE-2020-36332.html https://bugzilla.suse.com/1185652 https://bugzilla.suse.com/1185654 https://bugzilla.suse.com/1185673 https://bugzilla.suse.com/1185674 https://bugzilla.suse.com/1185685 https://bugzilla.suse.com/1185686 https://bugzilla.suse.com/1185688 https://bugzilla.suse.com/1185690 https://bugzilla.suse.com/1185691 https://bugzilla.suse.com/1186247

1 0

openSUSE-SU-2021:1970-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1970-1 Rating: moderate References: #1183168 #1185924 #1185925 Cross-References: CVE-2021-32027 CVE-2021-32028 CVSS scores: CVE-2021-32027 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32027 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-32028 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for postgresql10 fixes the following issues: - Upgrade to version 10.17: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924). - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925). - Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1970=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): postgresql10-10.17-8.35.1 postgresql10-contrib-10.17-8.35.1 postgresql10-contrib-debuginfo-10.17-8.35.1 postgresql10-debuginfo-10.17-8.35.1 postgresql10-debugsource-10.17-8.35.1 postgresql10-devel-10.17-8.35.1 postgresql10-devel-debuginfo-10.17-8.35.1 postgresql10-plperl-10.17-8.35.1 postgresql10-plperl-debuginfo-10.17-8.35.1 postgresql10-plpython-10.17-8.35.1 postgresql10-plpython-debuginfo-10.17-8.35.1 postgresql10-pltcl-10.17-8.35.1 postgresql10-pltcl-debuginfo-10.17-8.35.1 postgresql10-server-10.17-8.35.1 postgresql10-server-debuginfo-10.17-8.35.1 postgresql10-test-10.17-8.35.1 - openSUSE Leap 15.3 (noarch): postgresql10-docs-10.17-8.35.1 References: https://www.suse.com/security/cve/CVE-2021-32027.html https://www.suse.com/security/cve/CVE-2021-32028.html https://bugzilla.suse.com/1183168 https://bugzilla.suse.com/1185924 https://bugzilla.suse.com/1185925

1 0

openSUSE-SU-2021:2196-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2196-1 Rating: moderate References: #1175448 #1175449 Cross-References: CVE-2020-24370 CVE-2020-24371 CVSS scores: CVE-2020-24370 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24370 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for lua53 fixes the following issues: Update to version 5.3.6: - CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449) - CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448) - Long brackets with a huge number of '=' overflow some internal buffer arithmetic. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2196=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): liblua5_3-5-5.3.6-3.6.1 liblua5_3-5-debuginfo-5.3.6-3.6.1 lua53-5.3.6-3.6.1 lua53-debuginfo-5.3.6-3.6.1 lua53-debugsource-5.3.6-3.6.1 lua53-devel-5.3.6-3.6.1 - openSUSE Leap 15.3 (noarch): lua53-doc-5.3.6-3.6.1 - openSUSE Leap 15.3 (x86_64): liblua5_3-5-32bit-5.3.6-3.6.1 liblua5_3-5-32bit-debuginfo-5.3.6-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-24370.html https://www.suse.com/security/cve/CVE-2020-24371.html https://bugzilla.suse.com/1175448 https://bugzilla.suse.com/1175449

1 0

openSUSE-SU-2021:1854-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1854-1 Rating: moderate References: #1185086 #1185633 #1186198 #1186199 Cross-References: CVE-2021-29950 CVE-2021-29951 CVE-2021-29956 CVE-2021-29957 CVSS scores: CVE-2021-29950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-29950 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29951 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-29951 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-29956 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-29957 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-29957 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.10.2 - CVE-2021-29957: Fixed partial protection of inline OpenPGP message not indicated (bsc#1186198). - CVE-2021-29956: Fixed Thunderbird stored OpenPGP secret keys without master password protection (bsc#1186199). - CVE-2021-29951: Fixed Thunderbird Maintenance Service could have been started or stopped by domain users (bsc#1185633). - CVE-2021-29950: Fixed logic issue potentially leaves key material unlocked (bsc#1185086). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1854=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-78.10.2-8.27.1 MozillaThunderbird-debuginfo-78.10.2-8.27.1 MozillaThunderbird-debugsource-78.10.2-8.27.1 MozillaThunderbird-translations-common-78.10.2-8.27.1 MozillaThunderbird-translations-other-78.10.2-8.27.1 References: https://www.suse.com/security/cve/CVE-2021-29950.html https://www.suse.com/security/cve/CVE-2021-29951.html https://www.suse.com/security/cve/CVE-2021-29956.html https://www.suse.com/security/cve/CVE-2021-29957.html https://bugzilla.suse.com/1185086 https://bugzilla.suse.com/1185633 https://bugzilla.suse.com/1186198 https://bugzilla.suse.com/1186199

1 0

openSUSE-SU-2021:2136-1: important: Security update for cryptctl
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for cryptctl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2136-1 Rating: important References: #1186226 Cross-References: CVE-2019-18906 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2136=1 Package List: - openSUSE Leap 15.3 (ppc64le x86_64): cryptctl-2.4-4.5.1 cryptctl-debuginfo-2.4-4.5.1 References: https://www.suse.com/security/cve/CVE-2019-18906.html https://bugzilla.suse.com/1186226

1 0

openSUSE-SU-2021:1954-1: important: Security update for containerd, docker, runc
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for containerd, docker, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1954-1 Rating: important References: #1168481 #1175081 #1175821 #1181594 #1181641 #1181677 #1181730 #1181732 #1181749 #1182451 #1182476 #1182947 #1183024 #1183855 #1184768 #1184962 #1185405 Cross-References: CVE-2021-21284 CVE-2021-21285 CVE-2021-21334 CVE-2021-30465 CVSS scores: CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2021-21334 (NVD) : 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-21334 (SUSE): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-30465 (NVD) : 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-30465 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has 13 fixes is now available. Description: This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594) * Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476). * CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732) * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730). * btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081) runc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962). * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821). * Fixed /dev/null is not available (bsc#1168481). * CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405). containerd was updated to v1.4.4 * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397). * Handle a requirement from docker (bsc#1181594). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1954=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): containerd-1.4.4-5.32.1 containerd-ctr-1.4.4-5.32.1 docker-20.10.6_ce-6.49.3 docker-debuginfo-20.10.6_ce-6.49.3 runc-1.0.0~rc93-1.14.2 runc-debuginfo-1.0.0~rc93-1.14.2 - openSUSE Leap 15.3 (noarch): docker-bash-completion-20.10.6_ce-6.49.3 docker-fish-completion-20.10.6_ce-6.49.3 docker-zsh-completion-20.10.6_ce-6.49.3 References: https://www.suse.com/security/cve/CVE-2021-21284.html https://www.suse.com/security/cve/CVE-2021-21285.html https://www.suse.com/security/cve/CVE-2021-21334.html https://www.suse.com/security/cve/CVE-2021-30465.html https://bugzilla.suse.com/1168481 https://bugzilla.suse.com/1175081 https://bugzilla.suse.com/1175821 https://bugzilla.suse.com/1181594 https://bugzilla.suse.com/1181641 https://bugzilla.suse.com/1181677 https://bugzilla.suse.com/1181730 https://bugzilla.suse.com/1181732 https://bugzilla.suse.com/1181749 https://bugzilla.suse.com/1182451 https://bugzilla.suse.com/1182476 https://bugzilla.suse.com/1182947 https://bugzilla.suse.com/1183024 https://bugzilla.suse.com/1183855 https://bugzilla.suse.com/1184768 https://bugzilla.suse.com/1184962 https://bugzilla.suse.com/1185405

1 0

openSUSE-SU-2021:2127-1: important: Security update for apache2
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2127-1 Rating: important References: #1186922 #1186923 #1186924 #1187017 #1187040 #1187174 Cross-References: CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641 CVE-2021-31618 CVSS scores: CVE-2020-13950 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-13950 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-35452 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2020-35452 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26690 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-26690 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26691 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26691 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-30641 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-30641 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-31618 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-31618 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-13950 [bsc#1187040]: mod_proxy NULL pointer dereference - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2127=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-2.4.43-3.22.1 apache2-debuginfo-2.4.43-3.22.1 apache2-debugsource-2.4.43-3.22.1 apache2-devel-2.4.43-3.22.1 apache2-event-2.4.43-3.22.1 apache2-event-debuginfo-2.4.43-3.22.1 apache2-example-pages-2.4.43-3.22.1 apache2-prefork-2.4.43-3.22.1 apache2-prefork-debuginfo-2.4.43-3.22.1 apache2-utils-2.4.43-3.22.1 apache2-utils-debuginfo-2.4.43-3.22.1 apache2-worker-2.4.43-3.22.1 apache2-worker-debuginfo-2.4.43-3.22.1 - openSUSE Leap 15.3 (noarch): apache2-doc-2.4.43-3.22.1 References: https://www.suse.com/security/cve/CVE-2020-13950.html https://www.suse.com/security/cve/CVE-2020-35452.html https://www.suse.com/security/cve/CVE-2021-26690.html https://www.suse.com/security/cve/CVE-2021-26691.html https://www.suse.com/security/cve/CVE-2021-30641.html https://www.suse.com/security/cve/CVE-2021-31618.html https://bugzilla.suse.com/1186922 https://bugzilla.suse.com/1186923 https://bugzilla.suse.com/1186924 https://bugzilla.suse.com/1187017 https://bugzilla.suse.com/1187040 https://bugzilla.suse.com/1187174

1 0

openSUSE-SU-2021:1019-1: moderate: Security update for solo
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for solo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1019-1 Rating: moderate References: #1186848 Cross-References: CVE-2020-27208 CVSS scores: CVE-2020-27208 (NVD) : 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for solo fixes the following issues: Update to Solo 4.1.2 * Fix boo#1186848 CVE-202-27208, security issue in firmware source that is part of the source package. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1019=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1019=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1019=1 Package List: - openSUSE Leap 15.2 (noarch): solo-udev-4.1.2-lp152.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): solo-udev-4.1.2-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): solo-udev-4.1.2-bp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-27208.html https://bugzilla.suse.com/1186848

1 0

openSUSE-SU-2021:2125-1: important: Security update for wireshark
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2125-1 Rating: important References: #1179930 #1179931 #1179932 #1179933 #1180102 #1180232 #1181598 #1181599 #1183353 #1184110 #1185128 Cross-References: CVE-2020-26418 CVE-2020-26419 CVE-2020-26420 CVE-2020-26421 CVE-2020-26422 CVE-2021-22173 CVE-2021-22174 CVE-2021-22191 CVE-2021-22207 CVSS scores: CVE-2020-26418 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26418 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26419 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26422 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26422 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-22173 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22173 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22174 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22174 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22207 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-22207 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the following issues: Update wireshark to version 3.4.5 - New and updated support and bug fixes for multiple protocols - Asynchronous DNS resolution is always enabled - Protobuf fields can be dissected as Wireshark (header) fields - UI improvements Including security fixes for: - CVE-2021-22191: Wireshark could open unsafe URLs (bsc#1183353). - CVE-2021-22207: MS-WSP dissector excessive memory consumption (bsc#1185128) - CVE-2020-26422: QUIC dissector crash (bsc#1180232) - CVE-2020-26418: Kafka dissector memory leak (bsc#1179930) - CVE-2020-26419: Multiple dissector memory leaks (bsc#1179931) - CVE-2020-26420: RTPS dissector memory leak (bsc#1179932) - CVE-2020-26421: USB HID dissector crash (bsc#1179933) - CVE-2021-22173: Fix USB HID dissector memory leak (bsc#1181598) - CVE-2021-22174: Fix USB HID dissector crash (bsc#1181599) libqt5-qtmultimedia and sbc are necessary dependencies. libvirt is needed to rebuild wireshark-plugin-libvirt. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2125=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsbc1-1.3-3.2.1 libsbc1-debuginfo-1.3-3.2.1 libwireshark14-3.4.5-3.53.1 libwireshark14-debuginfo-3.4.5-3.53.1 libwiretap11-3.4.5-3.53.1 libwiretap11-debuginfo-3.4.5-3.53.1 libwsutil12-3.4.5-3.53.1 libwsutil12-debuginfo-3.4.5-3.53.1 sbc-1.3-3.2.1 sbc-debuginfo-1.3-3.2.1 sbc-debugsource-1.3-3.2.1 sbc-devel-1.3-3.2.1 wireshark-3.4.5-3.53.1 wireshark-debuginfo-3.4.5-3.53.1 wireshark-debugsource-3.4.5-3.53.1 wireshark-devel-3.4.5-3.53.1 wireshark-ui-qt-3.4.5-3.53.1 wireshark-ui-qt-debuginfo-3.4.5-3.53.1 - openSUSE Leap 15.3 (x86_64): libsbc1-32bit-1.3-3.2.1 libsbc1-32bit-debuginfo-1.3-3.2.1 References: https://www.suse.com/security/cve/CVE-2020-26418.html https://www.suse.com/security/cve/CVE-2020-26419.html https://www.suse.com/security/cve/CVE-2020-26420.html https://www.suse.com/security/cve/CVE-2020-26421.html https://www.suse.com/security/cve/CVE-2020-26422.html https://www.suse.com/security/cve/CVE-2021-22173.html https://www.suse.com/security/cve/CVE-2021-22174.html https://www.suse.com/security/cve/CVE-2021-22191.html https://www.suse.com/security/cve/CVE-2021-22207.html https://bugzilla.suse.com/1179930 https://bugzilla.suse.com/1179931 https://bugzilla.suse.com/1179932 https://bugzilla.suse.com/1179933 https://bugzilla.suse.com/1180102 https://bugzilla.suse.com/1180232 https://bugzilla.suse.com/1181598 https://bugzilla.suse.com/1181599 https://bugzilla.suse.com/1183353 https://bugzilla.suse.com/1184110 https://bugzilla.suse.com/1185128

1 0

openSUSE-SU-2021:2003-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2003-1 Rating: important References: #1186696 Cross-References: CVE-2021-29964 CVE-2021-29967 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 78.11 (bsc#1186696) Security issues fixed: - CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11 General improvements: - OpenPGP could not be disabled for an account if a key was previously configured - Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME - Contacts moved between CardDAV address books were not synced to the new server - CardDAV compatibility fixes for Google Contacts - Folder pane had no clear indication of focus on macOS Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2003=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-78.11.0-8.30.1 MozillaThunderbird-debuginfo-78.11.0-8.30.1 MozillaThunderbird-debugsource-78.11.0-8.30.1 MozillaThunderbird-translations-common-78.11.0-8.30.1 MozillaThunderbird-translations-other-78.11.0-8.30.1 References: https://www.suse.com/security/cve/CVE-2021-29964.html https://www.suse.com/security/cve/CVE-2021-29967.html https://bugzilla.suse.com/1186696

1 0

openSUSE-SU-2021:1994-1: moderate: Security update for postgresql12
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1994-1 Rating: moderate References: #1179945 #1183118 #1183168 #1185924 #1185925 #1185926 Cross-References: CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 CVSS scores: CVE-2021-32027 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32027 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-32028 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-32029 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for postgresql12 fixes the following issues: Upgrade to version 12.7: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924). - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925). - CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926). - Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168). - Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118). - Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1994=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): postgresql12-12.7-8.20.1 postgresql12-contrib-12.7-8.20.1 postgresql12-contrib-debuginfo-12.7-8.20.1 postgresql12-debuginfo-12.7-8.20.1 postgresql12-debugsource-12.7-8.20.1 postgresql12-devel-12.7-8.20.1 postgresql12-devel-debuginfo-12.7-8.20.1 postgresql12-llvmjit-12.7-8.20.1 postgresql12-llvmjit-debuginfo-12.7-8.20.1 postgresql12-plperl-12.7-8.20.1 postgresql12-plperl-debuginfo-12.7-8.20.1 postgresql12-plpython-12.7-8.20.1 postgresql12-plpython-debuginfo-12.7-8.20.1 postgresql12-pltcl-12.7-8.20.1 postgresql12-pltcl-debuginfo-12.7-8.20.1 postgresql12-server-12.7-8.20.1 postgresql12-server-debuginfo-12.7-8.20.1 postgresql12-server-devel-12.7-8.20.1 postgresql12-server-devel-debuginfo-12.7-8.20.1 postgresql12-test-12.7-8.20.1 - openSUSE Leap 15.3 (noarch): postgresql12-docs-12.7-8.20.1 References: https://www.suse.com/security/cve/CVE-2021-32027.html https://www.suse.com/security/cve/CVE-2021-32028.html https://www.suse.com/security/cve/CVE-2021-32029.html https://bugzilla.suse.com/1179945 https://bugzilla.suse.com/1183118 https://bugzilla.suse.com/1183168 https://bugzilla.suse.com/1185924 https://bugzilla.suse.com/1185925 https://bugzilla.suse.com/1185926

1 0

openSUSE-SU-2021:1933-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1933-1 Rating: important References: #1179833 #1179836 #1179837 #1179839 Cross-References: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVSS scores: CVE-2020-24489 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-24489 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-24511 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2020-24512 (SUSE): 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2020-24513 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20210608 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0 0442.html Other fixes: - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xe on/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3- spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3- spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/co re/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-cor e-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-120 0v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xe on/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1933=1 Package List: - openSUSE Leap 15.3 (x86_64): ucode-intel-20210525-7.1 References: https://www.suse.com/security/cve/CVE-2020-24489.html https://www.suse.com/security/cve/CVE-2020-24511.html https://www.suse.com/security/cve/CVE-2020-24512.html https://www.suse.com/security/cve/CVE-2020-24513.html https://bugzilla.suse.com/1179833 https://bugzilla.suse.com/1179836 https://bugzilla.suse.com/1179837 https://bugzilla.suse.com/1179839

1 0

openSUSE-SU-2021:2012-1: important: Security update for python-urllib3
by opensuse-security＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2012-1 Rating: important References: #1187045 Cross-References: CVE-2021-33503 CVSS scores: CVE-2021-33503 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-33503 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-urllib3 fixes the following issues: - CVE-2021-33503: Fixed a denial of service when the URL contained many @ characters in the authority component (bsc#1187045) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2012=1 Package List: - openSUSE Leap 15.3 (noarch): python3-urllib3-1.25.10-4.3.1 References: https://www.suse.com/security/cve/CVE-2021-33503.html https://bugzilla.suse.com/1187045

1 0

openSUSE-SU-2021:1914-1: moderate: Security update for libopenmpt
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1914-1 Rating: moderate References: #1186663 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libopenmpt fixes the following issues: Various bugfix and stability issues were fixed, some of those might have security impact. libopenmpt was updated to 0.3.28: * Fixed excessive memory consumption with malformed files in various formats. Changes in 0.3.27: * AMS: Avoid allocating excessive amount of memory for compressed song message in malformed files. * S3M: Some samples were imported with a too high sample rate if module was saved with Scream Tracker 3. Changes in 0.3.26: * DMF: Improve import of finetune effect with parameters larger than +/-15. Changes in 0.3.25: * AMS: An upper bound for uncompressed sample size is now established to avoid memory exhaustion from malformed files. * MO3: Avoid certain ModPlug hacks from being fixed up twice, which could lead to e.g. very narrow pan swing range for old OpenMPT IT files saved with a recent MO3 encoder version. * IMF: Instrument sample mapping was off by one octave, notable in the guitar part of Astaris by Karsten Koch. * PLM: Percentage offset (Mxx) was slightly off. Changes in 0.3.24: * PP20: The first few bytes of some files were not decompressed properly, making some files unplayable (depending on the original format). Changes in 0.3.23: * IT: Global volume slides with both nibbles set preferred the ��slide up�� nibble over the ��slide down�� nibble in old OpenMPT versions, unlike other slides. Such old files are now imported correctly again. * IT: Fixed an edge case where, if the filter hit full cutoff / no resonance on the first tick of a row where a new delayed note would be triggered, the filter would be disabled even though it should stay active. Fixes trace.it by maddie. * XM: Out-of-range arpeggio clamping behaviour broke in OpenMPT 1.23.05.00. The arpeggios in Binary World by Dakota now play correctly again. * S3M: Support old-style sample pre-amp value in very early S3M files. * S3M: Only force-enable fast slides for files ST 3.00. Previously, any S3M file made with an ST3 version older than 3.20 enabled them. * M15: Improve tracker detection heuristics to never assume SoundTracker 2.0 if there is a huge number of Dxx commands, as that is a definite hint that they should be treated as volume slides. Fixes Monty On The Run by Master Blaster. Changes in 0.3.22: * IT: Disable retrigger with short notes quirk for modules saved with Chibi Tracker, as it does not implement that quirk. * MOD: Fix early song ending due to ProTracker pattern jump quirk (EEx + Dxx on same row) if infinite looping is disabled. Fixes Haunted Tracks.mod by Triace. * MOD: Vibrato type ��ramp down�� was upside down. Changes in 0.3.21: * IT: Vibrato was too fast in Old Effects mode since libopenmpt 0.3. * XM: Treat 8bitbubsy��s FT2 clone exactly like Fasttracker 2 with respect to compatibility and playback flags. For example, FT2 Pan Law was not applied. * DMF: Some files had a wrong tempo since libopenmpt 0.2.5705-beta15. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1914=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmodplug-devel-0.3.28-2.13.1 libmodplug1-0.3.28-2.13.1 libmodplug1-debuginfo-0.3.28-2.13.1 libopenmpt-debugsource-0.3.28-2.13.1 libopenmpt-devel-0.3.28-2.13.1 libopenmpt0-0.3.28-2.13.1 libopenmpt0-debuginfo-0.3.28-2.13.1 libopenmpt_modplug1-0.3.28-2.13.1 libopenmpt_modplug1-debuginfo-0.3.28-2.13.1 openmpt123-0.3.28-2.13.1 openmpt123-debuginfo-0.3.28-2.13.1 - openSUSE Leap 15.3 (x86_64): libmodplug1-32bit-0.3.28-2.13.1 libmodplug1-32bit-debuginfo-0.3.28-2.13.1 libopenmpt0-32bit-0.3.28-2.13.1 libopenmpt0-32bit-debuginfo-0.3.28-2.13.1 libopenmpt_modplug1-32bit-0.3.28-2.13.1 libopenmpt_modplug1-32bit-debuginfo-0.3.28-2.13.1 References: https://bugzilla.suse.com/1186663

1 0

openSUSE-SU-2021:2011-1: important: Security update for xterm
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for xterm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2011-1 Rating: important References: #1182091 Cross-References: CVE-2021-27135 CVSS scores: CVE-2021-27135 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-27135 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xterm fixes the following issues: - CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2011=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xterm-330-11.3.1 xterm-bin-330-11.3.1 xterm-bin-debuginfo-330-11.3.1 xterm-debugsource-330-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-27135.html https://bugzilla.suse.com/1182091

1 0

openSUSE-SU-2021:2213-1: moderate: Security update for qemu
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2213-1 Rating: moderate References: #1185981 #1185990 #1186010 Cross-References: CVE-2021-3544 CVE-2021-3545 CVE-2021-3546 CVSS scores: CVE-2021-3544 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3544 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3545 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-3545 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3546 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-3546 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for qemu fixes the following issues: - CVE-2021-3546: Fixed out-of-bounds write in virgl_cmd_get_capset (bsc#1185981). - CVE-2021-3544: Fixed memory leaks found in the virtio vhost-user GPU device (bsc#1186010). - CVE-2021-3545: Fixed information disclosure due to uninitialized memory read (bsc#1185990). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2213=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-20.1 qemu-arm-5.2.0-20.1 qemu-arm-debuginfo-5.2.0-20.1 qemu-audio-alsa-5.2.0-20.1 qemu-audio-alsa-debuginfo-5.2.0-20.1 qemu-audio-pa-5.2.0-20.1 qemu-audio-pa-debuginfo-5.2.0-20.1 qemu-audio-spice-5.2.0-20.1 qemu-audio-spice-debuginfo-5.2.0-20.1 qemu-block-curl-5.2.0-20.1 qemu-block-curl-debuginfo-5.2.0-20.1 qemu-block-dmg-5.2.0-20.1 qemu-block-dmg-debuginfo-5.2.0-20.1 qemu-block-gluster-5.2.0-20.1 qemu-block-gluster-debuginfo-5.2.0-20.1 qemu-block-iscsi-5.2.0-20.1 qemu-block-iscsi-debuginfo-5.2.0-20.1 qemu-block-nfs-5.2.0-20.1 qemu-block-nfs-debuginfo-5.2.0-20.1 qemu-block-rbd-5.2.0-20.1 qemu-block-rbd-debuginfo-5.2.0-20.1 qemu-block-ssh-5.2.0-20.1 qemu-block-ssh-debuginfo-5.2.0-20.1 qemu-chardev-baum-5.2.0-20.1 qemu-chardev-baum-debuginfo-5.2.0-20.1 qemu-chardev-spice-5.2.0-20.1 qemu-chardev-spice-debuginfo-5.2.0-20.1 qemu-debuginfo-5.2.0-20.1 qemu-debugsource-5.2.0-20.1 qemu-extra-5.2.0-20.1 qemu-extra-debuginfo-5.2.0-20.1 qemu-guest-agent-5.2.0-20.1 qemu-guest-agent-debuginfo-5.2.0-20.1 qemu-hw-display-qxl-5.2.0-20.1 qemu-hw-display-qxl-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-gpu-5.2.0-20.1 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-gpu-pci-5.2.0-20.1 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-vga-5.2.0-20.1 qemu-hw-display-virtio-vga-debuginfo-5.2.0-20.1 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-20.1 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-20.1 qemu-hw-usb-redirect-5.2.0-20.1 qemu-hw-usb-redirect-debuginfo-5.2.0-20.1 qemu-hw-usb-smartcard-5.2.0-20.1 qemu-hw-usb-smartcard-debuginfo-5.2.0-20.1 qemu-ivshmem-tools-5.2.0-20.1 qemu-ivshmem-tools-debuginfo-5.2.0-20.1 qemu-ksm-5.2.0-20.1 qemu-lang-5.2.0-20.1 qemu-ppc-5.2.0-20.1 qemu-ppc-debuginfo-5.2.0-20.1 qemu-s390x-5.2.0-20.1 qemu-s390x-debuginfo-5.2.0-20.1 qemu-tools-5.2.0-20.1 qemu-tools-debuginfo-5.2.0-20.1 qemu-ui-curses-5.2.0-20.1 qemu-ui-curses-debuginfo-5.2.0-20.1 qemu-ui-gtk-5.2.0-20.1 qemu-ui-gtk-debuginfo-5.2.0-20.1 qemu-ui-opengl-5.2.0-20.1 qemu-ui-opengl-debuginfo-5.2.0-20.1 qemu-ui-spice-app-5.2.0-20.1 qemu-ui-spice-app-debuginfo-5.2.0-20.1 qemu-ui-spice-core-5.2.0-20.1 qemu-ui-spice-core-debuginfo-5.2.0-20.1 qemu-vhost-user-gpu-5.2.0-20.1 qemu-vhost-user-gpu-debuginfo-5.2.0-20.1 qemu-x86-5.2.0-20.1 qemu-x86-debuginfo-5.2.0-20.1 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-20.1 - openSUSE Leap 15.3 (noarch): qemu-ipxe-1.0.0+-20.1 qemu-microvm-5.2.0-20.1 qemu-seabios-1.14.0_0_g155821a-20.1 qemu-sgabios-8-20.1 qemu-skiboot-5.2.0-20.1 qemu-vgabios-1.14.0_0_g155821a-20.1 References: https://www.suse.com/security/cve/CVE-2021-3544.html https://www.suse.com/security/cve/CVE-2021-3545.html https://www.suse.com/security/cve/CVE-2021-3546.html https://bugzilla.suse.com/1185981 https://bugzilla.suse.com/1185990 https://bugzilla.suse.com/1186010

1 0

openSUSE-SU-2021:1016-1: important: Security update for libqt5-qtwebengine
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for libqt5-qtwebengine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1016-1 Rating: important References: #1130395 #1158516 #1163744 #1163766 #1182233 Cross-References: CVE-2020-16044 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21135 CVE-2021-21137 CVE-2021-21140 CVE-2021-21141 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 CVE-2021-21149 CVE-2021-21150 CVE-2021-21152 CVE-2021-21153 CVE-2021-21156 CVE-2021-21157 CVSS scores: CVE-2020-16044 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21118 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21119 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21120 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21121 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21122 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21123 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21125 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-21126 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21127 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21128 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21129 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21130 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21131 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21132 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21135 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21137 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21140 (NVD) : 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21141 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21148 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for libqt5-qtwebengine fixes the following issues: Update to version 5.15.3 CVE fixes backported in chromium updates: - CVE-2020-16044: Use after free in WebRTC - CVE-2021-21118: Heap buffer overflow in Blink - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in WebSQL - CVE-2021-21121: Use after free in Omnibox - CVE-2021-21122: Use after free in Blink - CVE-2021-21123: Insufficient data validation in File System API - CVE-2021-21125: Insufficient policy enforcement in File System API - CVE-2021-21126: Insufficient policy enforcement in extensions - CVE-2021-21127: Insufficient policy enforcement in extensions - CVE-2021-21128: Heap buffer overflow in Blink - CVE-2021-21129: Insufficient policy enforcement in File System API - CVE-2021-21130: Insufficient policy enforcement in File System API - CVE-2021-21131: Insufficient policy enforcement in File System API - CVE-2021-21132: Inappropriate implementation in DevTools - CVE-2021-21135: Inappropriate implementation in Performance API - CVE-2021-21137: Inappropriate implementation in DevTools - CVE-2021-21140: Uninitialized Use in USB - CVE-2021-21141: Insufficient policy enforcement in File System API - CVE-2021-21145: Use after free in Fonts - CVE-2021-21146: Use after free in Navigation - CVE-2021-21147: Inappropriate implementation in Skia - CVE-2021-21148: Heap buffer overflow in V8 - CVE-2021-21149: Stack overflow in Data Transfer - CVE-2021-21150: Use after free in Downloads - CVE-2021-21152: Heap buffer overflow in Media - CVE-2021-21153: Stack overflow in GPU Process - CVE-2021-21156: Heap buffer overflow in V8 - CVE-2021-21157: Use after free in Web Sockets This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1016=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): libQt5Pdf5-5.15.3-bp152.3.3.1 libQt5PdfWidgets5-5.15.3-bp152.3.3.1 libqt5-qtpdf-devel-5.15.3-bp152.3.3.1 libqt5-qtpdf-examples-5.15.3-bp152.3.3.1 libqt5-qtpdf-imports-5.15.3-bp152.3.3.1 libqt5-qtwebengine-5.15.3-bp152.3.3.1 libqt5-qtwebengine-devel-5.15.3-bp152.3.3.1 libqt5-qtwebengine-examples-5.15.3-bp152.3.3.1 - openSUSE Backports SLE-15-SP2 (noarch): libqt5-qtpdf-private-headers-devel-5.15.3-bp152.3.3.1 libqt5-qtwebengine-private-headers-devel-5.15.3-bp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://www.suse.com/security/cve/CVE-2021-21118.html https://www.suse.com/security/cve/CVE-2021-21119.html https://www.suse.com/security/cve/CVE-2021-21120.html https://www.suse.com/security/cve/CVE-2021-21121.html https://www.suse.com/security/cve/CVE-2021-21122.html https://www.suse.com/security/cve/CVE-2021-21123.html https://www.suse.com/security/cve/CVE-2021-21125.html https://www.suse.com/security/cve/CVE-2021-21126.html https://www.suse.com/security/cve/CVE-2021-21127.html https://www.suse.com/security/cve/CVE-2021-21128.html https://www.suse.com/security/cve/CVE-2021-21129.html https://www.suse.com/security/cve/CVE-2021-21130.html https://www.suse.com/security/cve/CVE-2021-21131.html https://www.suse.com/security/cve/CVE-2021-21132.html https://www.suse.com/security/cve/CVE-2021-21135.html https://www.suse.com/security/cve/CVE-2021-21137.html https://www.suse.com/security/cve/CVE-2021-21140.html https://www.suse.com/security/cve/CVE-2021-21141.html https://www.suse.com/security/cve/CVE-2021-21145.html https://www.suse.com/security/cve/CVE-2021-21146.html https://www.suse.com/security/cve/CVE-2021-21147.html https://www.suse.com/security/cve/CVE-2021-21148.html https://www.suse.com/security/cve/CVE-2021-21149.html https://www.suse.com/security/cve/CVE-2021-21150.html https://www.suse.com/security/cve/CVE-2021-21152.html https://www.suse.com/security/cve/CVE-2021-21153.html https://www.suse.com/security/cve/CVE-2021-21156.html https://www.suse.com/security/cve/CVE-2021-21157.html https://bugzilla.suse.com/1130395 https://bugzilla.suse.com/1158516 https://bugzilla.suse.com/1163744 https://bugzilla.suse.com/1163766 https://bugzilla.suse.com/1182233

1 0

openSUSE-SU-2021:1014-1: important: Security update for roundcubemail
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1014-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-18670 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-18671 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1014=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): roundcubemail-1.3.16-bp152.4.18.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707

1 0

openSUSE-SU-2021:1012-1: important: Security update for gstreamer-plugins-bad
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for gstreamer-plugins-bad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1012-1 Rating: important References: #1181255 Cross-References: CVE-2021-3185 CVSS scores: CVE-2021-3185 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3185 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-plugins-bad fixes the following issues: - Update to version 1.16.3: - CVE-2021-3185: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking() (bsc#1181255) - amcvideodec: fix sync meta copying not taking a reference - audiobuffersplit: Perform discont tracking on running time - audiobuffersplit: Specify in the template caps that only interleaved audio is supported - audiobuffersplit: Unset DISCONT flag if not discontinuous - autoconvert: Fix lock-less exchange or free condition - autoconvert: fix compiler warnings with g_atomic on recent GLib versions - avfvideosrc: element requests camera permissions even with capture-screen property is true - codecparsers: h264parser: guard against ref_pic_markings overflow - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated - dtls/connection: fix EOF handling with openssl 1.1.1e - fdkaacdec: add support for mpegversion=2 - hls: Check nettle version to ensure AES128 support - ipcpipeline: Rework compiler checks - interlace: Increment phase_index before checking if we're at the end of the phase - h264parser: Do not allocate too large size of memory for registered user data SEI - ladspa: fix unbounded integer properties - modplug: avoid division by zero - msdkdec: Fix GstMsdkContext leak - msdkenc: fix leaks on windows - musepackdec: Don't fail all queries if no sample rate is known yet - openslessink: Allow openslessink to handle 48kHz streams. - opencv: allow compilation against 4.2.x - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc - vulkan: Drop use of VK_RESULT_BEGIN_RANGE - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset - wasapi: Fix possible deadlock while downwards state change - waylandsink: Clear window when pipeline is stopped - webrtc: Support non-trickle ICE candidates in the SDP - webrtc: Unmap all non-binary buffers received via the datachannel Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-1012=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): gstreamer-plugins-bad-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-debugsource-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-devel-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-doc-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-debuginfo-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-debuginfo-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-debuginfo-1.16.3-lp153.3.3.1 typelib-1_0-GstInsertBin-1_0-1.16.3-lp153.3.3.1 typelib-1_0-GstMpegts-1_0-1.16.3-lp153.3.3.1 typelib-1_0-GstPlayer-1_0-1.16.3-lp153.3.3.1 typelib-1_0-GstWebRTC-1_0-1.16.3-lp153.3.3.1 - openSUSE Leap 15.3 (aarch64_ilp32): gstreamer-plugins-bad-64bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-64bit-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-64bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-64bit-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-64bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-64bit-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-64bit-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-64bit-debuginfo-1.16.3-lp153.3.3.1 - openSUSE Leap 15.3 (x86_64): gstreamer-plugins-bad-32bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-32bit-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-1.16.3-lp153.3.3.1 gstreamer-plugins-bad-fluidsynth-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstadaptivedemux-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstbadaudio-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstcodecparsers-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstinsertbin-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstisoff-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstmpegts-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstphotography-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstplayer-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstsctp-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-32bit-1.16.3-lp153.3.3.1 libgsturidownloader-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstwayland-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-32bit-1.16.3-lp153.3.3.1 libgstwebrtc-1_0-0-32bit-debuginfo-1.16.3-lp153.3.3.1 - openSUSE Leap 15.3 (noarch): gstreamer-plugins-bad-lang-1.16.3-lp153.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3185.html https://bugzilla.suse.com/1181255

1 0

openSUSE-SU-2021:1884-1: important: Security update for MozillaFirefox
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1884-1 Rating: important References: #1185633 #1186696 Cross-References: CVE-2021-29951 CVE-2021-29964 CVE-2021-29967 CVSS scores: CVE-2021-29951 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2021-29951 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.11.0 ESR (bsc#1186696) * CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message * CVE-2021-29967: Memory safety bugs fixed in Firefox Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1884=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.11.0-8.43.1 MozillaFirefox-branding-upstream-78.11.0-8.43.1 MozillaFirefox-debuginfo-78.11.0-8.43.1 MozillaFirefox-debugsource-78.11.0-8.43.1 MozillaFirefox-devel-78.11.0-8.43.1 MozillaFirefox-translations-common-78.11.0-8.43.1 MozillaFirefox-translations-other-78.11.0-8.43.1 - openSUSE Leap 15.3 (x86_64): MozillaFirefox-buildsymbols-78.11.0-8.43.1 References: https://www.suse.com/security/cve/CVE-2021-29951.html https://www.suse.com/security/cve/CVE-2021-29964.html https://www.suse.com/security/cve/CVE-2021-29967.html https://bugzilla.suse.com/1185633 https://bugzilla.suse.com/1186696

1 0

openSUSE-SU-2021:0977-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 06 Jul '21

06 Jul '21

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0977-1 Rating: important References: #1182918 #1186361 Cross-References: CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312 CVSS scores: CVE-2021-2145 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-2250 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-2264 (NVD) : 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVE-2021-2266 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2021-2279 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-2280 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-2281 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVE-2021-2282 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-2283 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-2284 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVE-2021-2285 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-2286 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVE-2021-2287 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-2291 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-2296 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2021-2297 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2021-2306 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2021-2309 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-2310 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-2312 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for virtualbox fixes the following issues: - Update vboxdrv.sh per boo#1186361 Version bump to 6.1.22 (released April 29 2021 by Oracle) - This is a maintenance release. The following items were fixed and/or added: - VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts - VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used - GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305) - Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323) - Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320) - Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312 - Improve autostart security boo#1182918. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-977=1 Package List: - openSUSE Leap 15.3 (x86_64): python3-virtualbox-6.1.22-lp153.2.3.2 python3-virtualbox-debuginfo-6.1.22-lp153.2.3.2 virtualbox-6.1.22-lp153.2.3.2 virtualbox-debuginfo-6.1.22-lp153.2.3.2 virtualbox-debugsource-6.1.22-lp153.2.3.2 virtualbox-devel-6.1.22-lp153.2.3.2 virtualbox-guest-tools-6.1.22-lp153.2.3.2 virtualbox-guest-tools-debuginfo-6.1.22-lp153.2.3.2 virtualbox-guest-x11-6.1.22-lp153.2.3.2 virtualbox-guest-x11-debuginfo-6.1.22-lp153.2.3.2 virtualbox-kmp-debugsource-6.1.22-lp153.2.3.2 virtualbox-kmp-default-6.1.22_k5.3.18_59.5-lp153.2.3.2 virtualbox-kmp-default-debuginfo-6.1.22_k5.3.18_59.5-lp153.2.3.2 virtualbox-kmp-preempt-6.1.22_k5.3.18_59.5-lp153.2.3.2 virtualbox-kmp-preempt-debuginfo-6.1.22_k5.3.18_59.5-lp153.2.3.2 virtualbox-qt-6.1.22-lp153.2.3.2 virtualbox-qt-debuginfo-6.1.22-lp153.2.3.2 virtualbox-vnc-6.1.22-lp153.2.3.2 virtualbox-websrv-6.1.22-lp153.2.3.2 virtualbox-websrv-debuginfo-6.1.22-lp153.2.3.2 - openSUSE Leap 15.3 (noarch): virtualbox-guest-desktop-icons-6.1.22-lp153.2.3.2 virtualbox-guest-source-6.1.22-lp153.2.3.2 virtualbox-host-source-6.1.22-lp153.2.3.2 References: https://www.suse.com/security/cve/CVE-2021-2145.html https://www.suse.com/security/cve/CVE-2021-2250.html https://www.suse.com/security/cve/CVE-2021-2264.html https://www.suse.com/security/cve/CVE-2021-2266.html https://www.suse.com/security/cve/CVE-2021-2279.html https://www.suse.com/security/cve/CVE-2021-2280.html https://www.suse.com/security/cve/CVE-2021-2281.html https://www.suse.com/security/cve/CVE-2021-2282.html https://www.suse.com/security/cve/CVE-2021-2283.html https://www.suse.com/security/cve/CVE-2021-2284.html https://www.suse.com/security/cve/CVE-2021-2285.html https://www.suse.com/security/cve/CVE-2021-2286.html https://www.suse.com/security/cve/CVE-2021-2287.html https://www.suse.com/security/cve/CVE-2021-2291.html https://www.suse.com/security/cve/CVE-2021-2296.html https://www.suse.com/security/cve/CVE-2021-2297.html https://www.suse.com/security/cve/CVE-2021-2306.html https://www.suse.com/security/cve/CVE-2021-2309.html https://www.suse.com/security/cve/CVE-2021-2310.html https://www.suse.com/security/cve/CVE-2021-2312.html https://bugzilla.suse.com/1182918 https://bugzilla.suse.com/1186361

1 0

openSUSE-SU-2021:0974-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 06 Jul '21

06 Jul '21

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0974-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-18670 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-18671 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-974=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): roundcubemail-1.3.16-bp152.4.14.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707

1 0

openSUSE-SU-2021:0973-1: important: Security update for libqt5-qtwebengine
by opensuse-security＠opensuse.org 06 Jul '21

06 Jul '21

openSUSE Security Update: Security update for libqt5-qtwebengine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0973-1 Rating: important References: #1130395 #1158516 #1163744 #1163766 #1182233 Cross-References: CVE-2020-16044 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21135 CVE-2021-21137 CVE-2021-21140 CVE-2021-21141 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 CVE-2021-21149 CVE-2021-21150 CVE-2021-21152 CVE-2021-21153 CVE-2021-21156 CVE-2021-21157 CVSS scores: CVE-2020-16044 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21118 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21119 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21120 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21121 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21122 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21123 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21125 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-21126 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21127 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21128 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21129 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21130 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21131 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21132 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21135 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21137 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21140 (NVD) : 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21141 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21148 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for libqt5-qtwebengine fixes the following issues: Update to version 5.15.3 CVE fixes backported in chromium updates: - CVE-2020-16044: Use after free in WebRTC - CVE-2021-21118: Heap buffer overflow in Blink - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in WebSQL - CVE-2021-21121: Use after free in Omnibox - CVE-2021-21122: Use after free in Blink - CVE-2021-21123: Insufficient data validation in File System API - CVE-2021-21125: Insufficient policy enforcement in File System API - CVE-2021-21126: Insufficient policy enforcement in extensions - CVE-2021-21127: Insufficient policy enforcement in extensions - CVE-2021-21128: Heap buffer overflow in Blink - CVE-2021-21129: Insufficient policy enforcement in File System API - CVE-2021-21130: Insufficient policy enforcement in File System API - CVE-2021-21131: Insufficient policy enforcement in File System API - CVE-2021-21132: Inappropriate implementation in DevTools - CVE-2021-21135: Inappropriate implementation in Performance API - CVE-2021-21137: Inappropriate implementation in DevTools - CVE-2021-21140: Uninitialized Use in USB - CVE-2021-21141: Insufficient policy enforcement in File System API - CVE-2021-21145: Use after free in Fonts - CVE-2021-21146: Use after free in Navigation - CVE-2021-21147: Inappropriate implementation in Skia - CVE-2021-21148: Heap buffer overflow in V8 - CVE-2021-21149: Stack overflow in Data Transfer - CVE-2021-21150: Use after free in Downloads - CVE-2021-21152: Heap buffer overflow in Media - CVE-2021-21153: Stack overflow in GPU Process - CVE-2021-21156: Heap buffer overflow in V8 - CVE-2021-21157: Use after free in Web Sockets Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-973=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libQt5Pdf5-5.15.3-lp152.3.3.4 libQt5Pdf5-debuginfo-5.15.3-lp152.3.3.4 libQt5PdfWidgets5-5.15.3-lp152.3.3.4 libQt5PdfWidgets5-debuginfo-5.15.3-lp152.3.3.4 libqt5-qtpdf-devel-5.15.3-lp152.3.3.4 libqt5-qtpdf-examples-5.15.3-lp152.3.3.4 libqt5-qtpdf-examples-debuginfo-5.15.3-lp152.3.3.4 libqt5-qtpdf-imports-5.15.3-lp152.3.3.4 libqt5-qtpdf-imports-debuginfo-5.15.3-lp152.3.3.4 libqt5-qtwebengine-5.15.3-lp152.3.3.4 libqt5-qtwebengine-debuginfo-5.15.3-lp152.3.3.4 libqt5-qtwebengine-debugsource-5.15.3-lp152.3.3.4 libqt5-qtwebengine-devel-5.15.3-lp152.3.3.4 libqt5-qtwebengine-devel-debuginfo-5.15.3-lp152.3.3.4 libqt5-qtwebengine-examples-5.15.3-lp152.3.3.4 libqt5-qtwebengine-examples-debuginfo-5.15.3-lp152.3.3.4 - openSUSE Leap 15.2 (noarch): libqt5-qtpdf-private-headers-devel-5.15.3-lp152.3.3.4 libqt5-qtwebengine-private-headers-devel-5.15.3-lp152.3.3.4 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://www.suse.com/security/cve/CVE-2021-21118.html https://www.suse.com/security/cve/CVE-2021-21119.html https://www.suse.com/security/cve/CVE-2021-21120.html https://www.suse.com/security/cve/CVE-2021-21121.html https://www.suse.com/security/cve/CVE-2021-21122.html https://www.suse.com/security/cve/CVE-2021-21123.html https://www.suse.com/security/cve/CVE-2021-21125.html https://www.suse.com/security/cve/CVE-2021-21126.html https://www.suse.com/security/cve/CVE-2021-21127.html https://www.suse.com/security/cve/CVE-2021-21128.html https://www.suse.com/security/cve/CVE-2021-21129.html https://www.suse.com/security/cve/CVE-2021-21130.html https://www.suse.com/security/cve/CVE-2021-21131.html https://www.suse.com/security/cve/CVE-2021-21132.html https://www.suse.com/security/cve/CVE-2021-21135.html https://www.suse.com/security/cve/CVE-2021-21137.html https://www.suse.com/security/cve/CVE-2021-21140.html https://www.suse.com/security/cve/CVE-2021-21141.html https://www.suse.com/security/cve/CVE-2021-21145.html https://www.suse.com/security/cve/CVE-2021-21146.html https://www.suse.com/security/cve/CVE-2021-21147.html https://www.suse.com/security/cve/CVE-2021-21148.html https://www.suse.com/security/cve/CVE-2021-21149.html https://www.suse.com/security/cve/CVE-2021-21150.html https://www.suse.com/security/cve/CVE-2021-21152.html https://www.suse.com/security/cve/CVE-2021-21153.html https://www.suse.com/security/cve/CVE-2021-21156.html https://www.suse.com/security/cve/CVE-2021-21157.html https://bugzilla.suse.com/1130395 https://bugzilla.suse.com/1158516 https://bugzilla.suse.com/1163744 https://bugzilla.suse.com/1163766 https://bugzilla.suse.com/1182233

1 0

openSUSE-SU-2021:2242-1: important: Security update for clamav-database
by opensuse-security＠opensuse.org 05 Jul '21

05 Jul '21

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2242-1 Rating: important References: #1084929 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav-database fixes the following issues: Changes in clamav-database: - database refresh on 2021-07-05 (bsc#1084929) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2242=1 Package List: - openSUSE Leap 15.3 (noarch): clamav-database-202107050018-3.480.1 References: https://bugzilla.suse.com/1084929

1 0

openSUSE-SU-2021:0959-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0959-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-18670 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-18671 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-959=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): roundcubemail-1.3.16-bp152.4.10.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707

1 0

openSUSE-SU-2021:0962-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0962-1 Rating: moderate References: #1175448 #1175449 Cross-References: CVE-2020-24370 CVE-2020-24371 CVSS scores: CVE-2020-24370 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24370 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for lua53 fixes the following issues: Update to version 5.3.6: - CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449) - CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448) - Long brackets with a huge number of '=' overflow some internal buffer arithmetic. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-962=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): liblua5_3-5-5.3.6-lp152.5.3.1 liblua5_3-5-debuginfo-5.3.6-lp152.5.3.1 lua53-5.3.6-lp152.5.3.1 lua53-debuginfo-5.3.6-lp152.5.3.1 lua53-debugsource-5.3.6-lp152.5.3.1 lua53-devel-5.3.6-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): lua53-doc-5.3.6-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): liblua5_3-5-32bit-5.3.6-lp152.5.3.1 liblua5_3-5-32bit-debuginfo-5.3.6-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-24370.html https://www.suse.com/security/cve/CVE-2020-24371.html https://bugzilla.suse.com/1175448 https://bugzilla.suse.com/1175449

1 0

openSUSE-SU-2021:0950-1: important: Security update for go1.15
by opensuse-security＠opensuse.org 01 Jul '21

01 Jul '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0950-1 Rating: important References: #1175132 #1186622 #1187443 #1187444 #1187445 Cross-References: CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 CVSS scores: CVE-2021-33195 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N CVE-2021-33196 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-33197 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-33198 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for go1.15 fixes the following issues: Update to 1.15.13. Includes these security fixes - CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443). - CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622). - CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444) - CVE-2021-33198: math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range" (bsc#1187445). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-950=1 Package List: - openSUSE Leap 15.2 (x86_64): go1.15-1.15.13-lp152.20.1 go1.15-doc-1.15.13-lp152.20.1 go1.15-race-1.15.13-lp152.20.1 References: https://www.suse.com/security/cve/CVE-2021-33195.html https://www.suse.com/security/cve/CVE-2021-33196.html https://www.suse.com/security/cve/CVE-2021-33197.html https://www.suse.com/security/cve/CVE-2021-33198.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1186622 https://bugzilla.suse.com/1187443 https://bugzilla.suse.com/1187444 https://bugzilla.suse.com/1187445

1 0

openSUSE-SU-2021:0948-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Jul '21

01 Jul '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0948-1 Rating: important References: Cross-References: CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 CVSS scores: CVE-2021-30544 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30545 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30546 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30547 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30548 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30549 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30550 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30551 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30552 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30553 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 77.0.4054.146 - CHR-8458 Update chromium on desktop-stable-91-4054 to 91.0.4472.114 - DNA-92171 Create active linkdiscovery service - DNA-92388 Fix and unskip WorkspacesEmoji.testChooseEmojiAsWorkspaceIcon when possible - DNA-93101 Tabs are being snoozed when tab snoozing is disabled - DNA-93386 Update pinboard view when item changes - DNA-93448 Make browser ready for Developer release - DNA-93491 Fix failing tests after enabling #pinboard flag - DNA-93498 Add additional music services - DNA-93503 Blank popup on clicking toolbar icon with popup open - DNA-93561 Do not allow zoom different from 100% in Pinboard popup - DNA-93637 ctrl+9 shortcut is inconsistent with other browsers - DNA-93644 Create route for `import open tabs` to `pinboard` - DNA-93664 Adapt popup to design - DNA-93702 Turn on flags on developer - DNA-93737 [Pinboard] Remove Mock API - DNA-93745 Unable to open the popup after opening it several times - DNA-93776 Popup closes and reopens when clicking the toolbar button - DNA-93786 DCHECK after opening popup - DNA-93802 Crash at views::Widget::GetNativeView() const - DNA-93810 Add pinboard icon to sidebar - DNA-93825 Add pinboard to Opera menu - DNA-93833 [Player] Implement seeking for new services - DNA-93845 Do not log output of snapcraft on console - DNA-93864 Create feature flag for start page sync banner - DNA-93865 Implement start page banner - DNA-93867 Use version from package instead of repository - DNA-93878 [Player] Crash when current player service becomes unavailable when user location changes - DNA-93953 ��Send image to Pinboard�� has the wrong position in the context menu - DNA-93987 Disable zooming popup contents like in other popups - DNA-93989 Change internal URL to opera://pinboards - DNA-93990 Update strings to reflect new standards - DNA-93992 Add Pinboards to Opera settings - DNA-93993 Pinboard translations from Master - DNA-94011 Enable feature flags for Reborn 5 on stable - DNA-94019 Add a direct link to settings - DNA-94088 Internal pages provoke not saving other pages to the Pinboard - DNA-94111 [O77] Sidebar setup does not open - DNA-94139 Crash at opera::(anonymous namespace)::PinboardPopupWebView::RemovedFromWidget() - The update to chromium 91.0.4472.114 fixes following issues: CVE-2021-30554, CVE-2021-30555, CVE-2021-30556, CVE-2021-30557 CVE-2021-30544, CVE-2021-30545, CVE-2021-30546, CVE-2021-30547, CVE-2021-30548, CVE-2021-30549, CVE-2021-30550, CVE-2021-30551, CVE-2021-30552, CVE-2021-30553 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-948=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-77.0.4054.146-lp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-30544.html https://www.suse.com/security/cve/CVE-2021-30545.html https://www.suse.com/security/cve/CVE-2021-30546.html https://www.suse.com/security/cve/CVE-2021-30547.html https://www.suse.com/security/cve/CVE-2021-30548.html https://www.suse.com/security/cve/CVE-2021-30549.html https://www.suse.com/security/cve/CVE-2021-30550.html https://www.suse.com/security/cve/CVE-2021-30551.html https://www.suse.com/security/cve/CVE-2021-30552.html https://www.suse.com/security/cve/CVE-2021-30553.html https://www.suse.com/security/cve/CVE-2021-30554.html https://www.suse.com/security/cve/CVE-2021-30555.html https://www.suse.com/security/cve/CVE-2021-30556.html https://www.suse.com/security/cve/CVE-2021-30557.html

1 0

openSUSE-SU-2021:0949-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Jul '21

01 Jul '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0949-1 Rating: important References: Cross-References: CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 CVSS scores: CVE-2021-30544 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30545 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30546 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30547 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30548 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30549 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30550 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30551 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30552 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30553 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 77.0.4054.146 - CHR-8458 Update chromium on desktop-stable-91-4054 to 91.0.4472.114 - DNA-92171 Create active linkdiscovery service - DNA-92388 Fix and unskip WorkspacesEmoji.testChooseEmojiAsWorkspaceIcon when possible - DNA-93101 Tabs are being snoozed when tab snoozing is disabled - DNA-93386 Update pinboard view when item changes - DNA-93448 Make browser ready for Developer release - DNA-93491 Fix failing tests after enabling #pinboard flag - DNA-93498 Add additional music services - DNA-93503 Blank popup on clicking toolbar icon with popup open - DNA-93561 Do not allow zoom different from 100% in Pinboard popup - DNA-93637 ctrl+9 shortcut is inconsistent with other browsers - DNA-93644 Create route for `import open tabs` to `pinboard` - DNA-93664 Adapt popup to design - DNA-93702 Turn on flags on developer - DNA-93737 [Pinboard] Remove Mock API - DNA-93745 Unable to open the popup after opening it several times - DNA-93776 Popup closes and reopens when clicking the toolbar button - DNA-93786 DCHECK after opening popup - DNA-93802 Crash at views::Widget::GetNativeView() const - DNA-93810 Add pinboard icon to sidebar - DNA-93825 Add pinboard to Opera menu - DNA-93833 [Player] Implement seeking for new services - DNA-93845 Do not log output of snapcraft on console - DNA-93864 Create feature flag for start page sync banner - DNA-93865 Implement start page banner - DNA-93867 Use version from package instead of repository - DNA-93878 [Player] Crash when current player service becomes unavailable when user location changes - DNA-93953 ��Send image to Pinboard�� has the wrong position in the context menu - DNA-93987 Disable zooming popup contents like in other popups - DNA-93989 Change internal URL to opera://pinboards - DNA-93990 Update strings to reflect new standards - DNA-93992 Add Pinboards to Opera settings - DNA-93993 Pinboard translations from Master - DNA-94011 Enable feature flags for Reborn 5 on stable - DNA-94019 Add a direct link to settings - DNA-94088 Internal pages provoke not saving other pages to the Pinboard - DNA-94111 [O77] Sidebar setup does not open - DNA-94139 Crash at opera::(anonymous namespace)::PinboardPopupWebView::RemovedFromWidget() - The update to chromium 91.0.4472.114 fixes following issues: CVE-2021-30554, CVE-2021-30555, CVE-2021-30556, CVE-2021-30557, CVE-2021-30544, CVE-2021-30545, CVE-2021-30546, CVE-2021-30547, CVE-2021-30548, CVE-2021-30549, CVE-2021-30550, CVE-2021-30551, CVE-2021-30552, CVE-2021-30553 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-949=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-77.0.4054.146-lp152.2.52.1 References: https://www.suse.com/security/cve/CVE-2021-30544.html https://www.suse.com/security/cve/CVE-2021-30545.html https://www.suse.com/security/cve/CVE-2021-30546.html https://www.suse.com/security/cve/CVE-2021-30547.html https://www.suse.com/security/cve/CVE-2021-30548.html https://www.suse.com/security/cve/CVE-2021-30549.html https://www.suse.com/security/cve/CVE-2021-30550.html https://www.suse.com/security/cve/CVE-2021-30551.html https://www.suse.com/security/cve/CVE-2021-30552.html https://www.suse.com/security/cve/CVE-2021-30553.html https://www.suse.com/security/cve/CVE-2021-30554.html https://www.suse.com/security/cve/CVE-2021-30555.html https://www.suse.com/security/cve/CVE-2021-30556.html https://www.suse.com/security/cve/CVE-2021-30557.html

1 0

openSUSE-SU-2021:0947-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 01 Jul '21

01 Jul '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0947-1 Rating: important References: #1087082 #1133021 #1152457 #1152489 #1155518 #1156395 #1162702 #1164648 #1176564 #1177666 #1178418 #1178612 #1179827 #1179851 #1182378 #1182999 #1183346 #1183868 #1183873 #1183932 #1183947 #1184081 #1184082 #1184611 #1184855 #1185428 #1185497 #1185589 #1185606 #1185645 #1185677 #1185680 #1185696 #1185703 #1185725 #1185758 #1185859 #1185861 #1185863 #1185898 #1185899 #1185911 #1185938 #1185987 #1185988 #1186061 #1186285 #1186320 #1186439 #1186441 #1186460 #1186498 #1186501 #1186573 Cross-References: CVE-2020-24586 CVE-2020-24587 CVE-2020-24588 CVE-2020-26139 CVE-2020-26141 CVE-2020-26145 CVE-2020-26147 CVE-2021-23134 CVE-2021-32399 CVE-2021-33034 CVE-2021-33200 CVE-2021-3491 CVSS scores: CVE-2020-24586 (NVD) : 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2020-24586 (SUSE): 4.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVE-2020-24587 (NVD) : 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2020-24587 (SUSE): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-24588 (NVD) : 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2020-24588 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-26139 (NVD) : 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26139 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-26141 (SUSE): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26145 (SUSE): 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26147 (NVD) : 5.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N CVE-2021-23134 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-23134 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32399 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32399 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-33034 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33034 (SUSE): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-33200 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33200 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3491 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-3491 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 42 fixes is now available. Description: The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484). - CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an arbitrary values. (bsc#1186111) - CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062) - CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their privileges. (bnc#1186060) - CVE-2021-3491: Fixed a potential heap overflow in mem_rw(). This vulnerability is related to the PROVIDE_BUFFERS operation, which allowed the MAX_RW_COUNT limit to be bypassed (bsc#1185642). - CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611). - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network packets and/or exfiltrate user data (bnc#1185859). - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862). - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (bnc#1185859). - CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. (bnc#1185861) - CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. (bnc#1185860) - CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bnc#1185987) The following non-security bugs were fixed: - ACPI / hotplug / PCI: Fix reference count leak in enable_slot() (git-fixes). - ACPI: GTDT: Do not corrupt interrupt mappings on watchdow probe failure (git-fixes). - ACPI: custom_method: fix a possible memory leak (git-fixes). - ACPI: custom_method: fix potential use-after-free issue (git-fixes). - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro (git-fixes). - ALSA: bebob: enable to deliver MIDI messages for multiple ports (git-fixes). - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 (git-fixes). - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency (git-fixes). - ALSA: firewire-lib: fix calculation for size of IR context payload (git-fixes). - ALSA: firewire-lib: fix check for the size of isochronous packet payload (git-fixes). - ALSA: hda/conexant: Re-order CX5066 quirk table entries (git-fixes). - ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable (git-fixes). - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 (git-fixes). - ALSA: hda/realtek: Headphone volume is controlled by Front mixer (git-fixes). - ALSA: hda/realtek: reset eapd coeff to default value for alc287 (git-fixes). - ALSA: hda: fixup headset for ASUS GU502 laptop (git-fixes). - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP (git-fixes). - ALSA: hdsp: do not disable if not enabled (git-fixes). - ALSA: hdspm: do not disable if not enabled (git-fixes). - ALSA: intel8x0: Do not update period unless prepared (git-fixes). - ALSA: line6: Fix racy initialization of LINE6 MIDI (git-fixes). - ALSA: rme9652: do not disable if not enabled (git-fixes). - ALSA: usb-audio: Validate MS endpoint descriptors (git-fixes). - ALSA: usb-audio: fix control-request direction (git-fixes). - ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci (git-fixes). - ALSA: usb-audio: scarlett2: Improve driver startup messages (git-fixes). - ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static (git-fixes). - ARM64: vdso32: Install vdso32 from vdso_install (git-fixes). - ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet (git-fixes). - ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF (git-fixes). - ASoC: cs35l33: fix an error code in probe() (git-fixes). - ASoC: cs42l42: Regmap must use_single_read/write (git-fixes). - ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() (git-fixes). - ASoC: rsnd: core: Check convert rate in rsnd_hw_params (git-fixes). - ASoC: rt286: Generalize support for ALC3263 codec (git-fixes). - ASoC: rt286: Make RT286_SET_GPIO_* readable and writable (git-fixes). - Bluetooth: L2CAP: Fix handling LE modes by L2CAP_OPTIONS (git-fixes). - Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes). - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default (git-fixes). - Bluetooth: check for zapped sk before connecting (git-fixes). - Bluetooth: initialize skb_queue_head at l2cap_chan_create() (git-fixes). - Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM (git-fixes). - Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185725). - Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185725). - Drivers: hv: vmbus: Use after free in __vmbus_open() (git-fixes). - Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices (git-fixes). - Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state (git-fixes). - KVM: s390: fix guarded storage control register handling (bsc#1133021). - Move upstreamed media fixes into sorted section - NFC: nci: fix memory leak in nci_allocate_device (git-fixes). - PCI/RCEC: Fix RCiEP device to RCEC association (git-fixes). - PCI: Allow VPD access for QLogic ISP2722 (git-fixes). - PCI: PM: Do not read power state in pci_enable_device_flags() (git-fixes). - PCI: Release OF node in pci_scan_device()'s error path (git-fixes). - PCI: endpoint: Fix missing destroy_workqueue() (git-fixes). - PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() (git-fixes). - PCI: thunder: Fix compile testing (git-fixes). - PM / devfreq: Use more accurate returned new_freq as resume_freq (git-fixes). - RDMA/addr: create addr_wq with WQ_MEM_RECLAIM flag (bsc#1183346). - RDMA/core: create ib_cm with WQ_MEM_RECLAIM flag (bsc#1183346). - RDMA/hns: Delete redundant abnormal interrupt status (git-fixes). - RDMA/hns: Delete redundant condition judgment related to eq (git-fixes). - RDMA/qedr: Fix error return code in qedr_iw_connect() (jsc#SLE-8215). - RDMA/srpt: Fix error return code in srpt_cm_req_recv() (git-fixes). - SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428). - SUNRPC: More fixes for backlog congestion (bsc#1185428). - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet (git-fixes). - USB: Add reset-resume quirk for WD19's Realtek Hub (git-fixes). - USB: serial: pl2303: add support for PL2303HXN (bsc#1186320). - USB: serial: pl2303: fix line-speed handling on newer chips (bsc#1186320). - USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check (git-fixes). - USB: trancevibrator: fix control-request direction (git-fixes). - amdgpu: avoid incorrect %hu format string (git-fixes). - arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes). - arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes). - arm64: avoid -Woverride-init warning (git-fixes). - arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes). - arm64: kdump: update ppos when reading elfcorehdr (git-fixes). - arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes). - arm64: link with -z norelro for LLD or aarch64-elf (git-fixes). - arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes). - arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes). - arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes). - arm64: vdso32: make vdso32 install conditional (git-fixes). - arm: mm: use __pfn_to_section() to get mem_section (git-fixes). - ata: ahci: Disable SXS for Hisilicon Kunpeng920 (git-fixes). - blk-iocost: ioc_pd_free() shouldn't assume irq disabled (git-fixes). - blk-mq: Swap two calls in blk_mq_exit_queue() (git-fixes). - block/genhd: use atomic_t for disk_event->block (bsc#1185497). - block: Fix three kernel-doc warnings (git-fixes). - block: fix get_max_io_size() (git-fixes). - bnxt_en: Fix RX consumer index logic in the error path (git-fixes). - bnxt_en: fix ternary sign extension bug in bnxt_show_temp() (git-fixes). - bpf: Fix leakage of uninitialized bpf stack under speculation (bsc#1155518). - bpf: Fix masking negation logic upon negative dst register (bsc#1155518). - btrfs: fix race between transaction aborts and fsyncs leading to use-after-free (bsc#1186441). - btrfs: fix race when picking most recent mod log operation for an old root (bsc#1186439). - cdc-wdm: untangle a circular dependency between callback and softint (git-fixes). - cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom (git-fixes). - cdrom: gdrom: initialize global variable at init time (git-fixes). - ceph: do not clobber i_snap_caps on non-I_NEW inode (bsc#1186501). - ceph: fix inode leak on getattr error in __fh_to_dentry (bsc#1186501). - ceph: fix up error handling with snapdirs (bsc#1186501). - ceph: only check pool permissions for regular files (bsc#1186501). - cfg80211: scan: drop entry from hidden_list on overflow (git-fixes). - clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return (git-fixes). - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (bsc#1185758). - crypto: api - check for ERR pointers in crypto_destroy_tfm() (git-fixes). - crypto: mips/poly1305 - enable for all MIPS processors (git-fixes). - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (git-fixes). - crypto: qat - Fix a double free in adf_create_ring (git-fixes). - crypto: qat - do not release uninitialized resources (git-fixes). - crypto: qat - fix error path in adf_isr_resource_alloc() (git-fixes). - crypto: qat - fix unmap invalid dma address (git-fixes). - crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c (git-fixes). - crypto: stm32/hash - Fix PM reference leak on stm32-hash.c (git-fixes). - cxgb4: Fix unintentional sign extension issues (git-fixes). - dm: avoid filesystem lookup in dm_get_dev_t() (git-fixes). - dmaengine: dw-edma: Fix crash on loading/unloading driver (git-fixes). - docs: kernel-parameters: Add gpio_mockup_named_lines (git-fixes). - docs: kernel-parameters: Move gpio-mockup for alphabetic order (git-fixes). - drivers: hv: Fix whitespace errors (bsc#1185725). - drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool' (git-fixes). - drm/amd/display: Fix two cursor duplication when using overlay (git-fixes). - drm/amd/display: Force vsync flip when reconfiguring MPCC (git-fixes). - drm/amd/display: Reject non-zero src_y and src_x for video planes (git-fixes). - drm/amd/display: fix dml prefetch validation (git-fixes). - drm/amd/display: fixed divide by zero kernel crash during dsc enablement (git-fixes). - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f (git-fixes). - drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang (git-fixes). - drm/amdgpu: fix NULL pointer dereference (git-fixes). - drm/amdgpu: mask the xgmi number of hops reported from psp to kfd (git-fixes). - drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug (git-fixes). - drm/i915: Avoid div-by-zero on gen2 (git-fixes). - drm/meson: fix shutdown crash when component not probed (git-fixes). - drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal (git-fixes). - drm/msm/mdp5: Do not multiply vclk line count by 100 (git-fixes). - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected (git-fixes). - drm/radeon: Avoid power table parsing memory leaks (git-fixes). - drm/radeon: Fix off-by-one power_state index heap overwrite (git-fixes). - drm/vkms: fix misuse of WARN_ON (git-fixes). - drm: Added orientation quirk for OneGX1 Pro (git-fixes). - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit (git-fixes). - extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged (git-fixes). - extcon: arizona: Fix various races on driver unbind (git-fixes). - fbdev: zero-fill colormap in fbcmap.c (git-fixes). - firmware: arm_scpi: Prevent the ternary sign expansion bug (git-fixes). - fs/epoll: restore waking from ep_done_scan() (bsc#1183868). - ftrace: Handle commands when closing set_ftrace_filter file (git-fixes). - futex: Change utime parameter to be 'const ... *' (git-fixes). - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI (bsc#1164648). - futex: Get rid of the val2 conditional dance (git-fixes). - futex: Make syscall entry points less convoluted (git-fixes). - genirq/irqdomain: Do not try to free an interrupt that has no (git-fixes) - genirq: Disable interrupts for force threaded handlers (git-fixes) - genirq: Reduce irqdebug cacheline bouncing (bsc#1185703 ltc#192641). - gpio: xilinx: Correct kernel doc for xgpio_probe() (git-fixes). - gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 (git-fixes). - hrtimer: Update softirq_expires_next correctly after (git-fixes) - hwmon: (occ) Fix poll rate limiting (git-fixes). - i2c: Add I2C_AQ_NO_REP_START adapter quirk (git-fixes). - i2c: bail out early when RDWR parameters are wrong (git-fixes). - i2c: i801: Do not generate an interrupt on bus reset (git-fixes). - i2c: s3c2410: fix possible NULL pointer deref on read message after write (git-fixes). - i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E (git-fixes). - i40e: Fix PHY type identifiers for 2.5G and 5G adapters (git-fixes). - i40e: Fix use-after-free in i40e_client_subtask() (git-fixes). - i40e: fix broken XDP support (git-fixes). - i40e: fix the restart auto-negotiation after FEC modified (git-fixes). - ibmvfc: Avoid move login if fast fail is enabled (bsc#1185938 ltc#192043). - ibmvfc: Handle move login failure (bsc#1185938 ltc#192043). - ibmvfc: Reinit target retries (bsc#1185938 ltc#192043). - ibmvnic: remove default label from to_string switch (bsc#1152457 ltc#174432 git-fixes). - ics932s401: fix broken handling of errors when word reading fails (git-fixes). - iio: adc: ad7124: Fix missbalanced regulator enable / disable on error (git-fixes). - iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers (git-fixes). - iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: ad7793: Add missing error code in ad7793_setup() (git-fixes). - iio: gyro: fxas21002c: balance runtime power in error path (git-fixes). - iio: gyro: mpu3050: Fix reported temperature value (git-fixes). - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error (git-fixes). - iio: tsl2583: Fix division by a zero lux_val (git-fixes). - intel_th: Consistency and off-by-one fix (git-fixes). - iommu/amd: Add support for map/unmap_resource (jsc#ECO-3482). - ipc/mqueue, msg, sem: Avoid relying on a stack reference past its expiry (bsc#1185988). - ipmi/watchdog: Stop watchdog timer when the current action is 'none' (bsc#1184855). - kernel-docs.spec.in: Build using an utf-8 locale. Sphinx cannot handle UTF-8 input in non-UTF-8 locale. - leds: lp5523: check return value of lp5xx_read and jump to cleanup code (git-fixes). - locking/seqlock: Tweak DEFINE_SEQLOCK() kernel doc (bsc#1176564 bsc#1162702). - lpfc: Decouple port_template and vport_template (bsc#185032). - mac80211: clear the beacon's CRC after channel switch (git-fixes). - md-cluster: fix use-after-free issue when removing rdev (bsc#1184082). - md/raid1: properly indicate failure when ending a failed write request (bsc#1185680). - md: do not flush workqueue unconditionally in md_open (bsc#1184081). - md: factor out a mddev_find_locked helper from mddev_find (bsc#1184081). - md: md_open returns -EBUSY when entering racing area (bsc#1184081). - md: split mddev_find (bsc#1184081). - media: adv7604: fix possible use-after-free in adv76xx_remove() (git-fixes). - media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB (git-fixes). - media: dvb-usb: fix memory leak in dvb_usb_adapter_init (git-fixes). - media: em28xx: fix memory leak (git-fixes). - media: gspca/sq905.c: fix uninitialized variable (git-fixes). - media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() (git-fixes). - media: i2c: adv7842: fix possible use-after-free in adv7842_remove() (git-fixes). - media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() (git-fixes). - media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() (git-fixes). - media: ite-cir: check for receive overflow (git-fixes). - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs (git-fixes). - media: platform: sti: Fix runtime PM imbalance in regs_show (git-fixes). - media: tc358743: fix possible use-after-free in tc358743_remove() (git-fixes). - mfd: arizona: Fix rumtime PM imbalance on error (git-fixes). - misc/uss720: fix memory leak in uss720_probe (git-fixes). - mlxsw: spectrum_mr: Update egress RIF list before route's action (git-fixes). - mm: memcontrol: fix cpuhotplug statistics flushing (bsc#1185606). - mmc: block: Update ext_csd.cache_ctrl if it was written (git-fixes). - mmc: core: Do a power cycle when the CMD11 fails (git-fixes). - mmc: core: Set read only for SD cards with permanent write protect bit (git-fixes). - mmc: sdhci-pci-gli: increase 1.8V regulator wait (git-fixes). - mmc: sdhci-pci: Add PCI IDs for Intel LKF (git-fixes). - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers (git-fixes). - mmc: sdhci: Check for reset prior to DMA address unmap (git-fixes). - net, xdp: Update pkt_type if generic XDP changes unicast MAC (git-fixes). - net: enetc: fix link error again (git-fixes). - net: hns3: Fix for geneve tx checksum bug (git-fixes). - net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet() (git-fixes). - net: hns3: clear unnecessary reset request in hclge_reset_rebuild (git-fixes). - net: hns3: disable phy loopback setting in hclge_mac_start_phy (git-fixes). - net: hns3: fix for vxlan gpe tx checksum bug (git-fixes). - net: hns3: fix incorrect configuration for igu_egu_hw_err (git-fixes). - net: hns3: initialize the message content in hclge_get_link_mode() (git-fixes). - net: hns3: use netif_tx_disable to stop the transmit queue (git-fixes). - net: thunderx: Fix unintentional sign extension issue (git-fixes). - net: usb: fix memory leak in smsc75xx_bind (git-fixes). - net: xfrm: Localize sequence counter per network namespace (bsc#1185696). - net: xfrm: Use sequence counter with associated spinlock (bsc#1185696). - netdevice: Add missing IFF_PHONY_HEADROOM self-definition (git-fixes). - netfilter: conntrack: add new sysctl to disable RST check (bsc#1183947 bsc#1185950). - netfilter: conntrack: avoid misleading 'invalid' in log message (bsc#1183947 bsc#1185950). - netfilter: conntrack: improve RST handling when tuple is re-used (bsc#1183947 bsc#1185950). - nvme-core: add cancel tagset helpers (bsc#1183976). - nvme-fabrics: decode host pathing error for connect (bsc#1179827). - nvme-fc: check sgl supported by target (bsc#1179827). - nvme-fc: clear q_live at beginning of association teardown (bsc#1186479). - nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted (bsc#1184259). - nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() (bsc#1184259). - nvme-fc: short-circuit reconnect retries (bsc#1179827). - nvme-multipath: fix double initialization of ANA state (bsc#1178612, bsc#1184259). - nvme-multipath: reset bdev to ns head when failover (bsc#178378 bsc#1182999). - nvme-pci: Remove tag from process cq (git-fixes). - nvme-pci: Remove two-pass completions (git-fixes). - nvme-pci: Simplify nvme_poll_irqdisable (git-fixes). - nvme-pci: align io queue count with allocted nvme_queue in (git-fixes). - nvme-pci: avoid race between nvme_reap_pending_cqes() and nvme_poll() (git-fixes). - nvme-pci: dma read memory barrier for completions (git-fixes). - nvme-pci: fix "slimmer CQ head update" (git-fixes). - nvme-pci: make sure write/poll_queues less or equal then cpu (git-fixes). - nvme-pci: remove last_sq_tail (git-fixes). - nvme-pci: remove volatile cqes (git-fixes). - nvme-pci: slimmer CQ head update (git-fixes). - nvme-pci: use simple suspend when a HMB is enabled (git-fixes). - nvme-tcp: Fix possible race of io_work and direct send (git-fixes). - nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT (git-fixes). - nvme-tcp: add clean action for failed reconnection (bsc#1183976). - nvme-tcp: fix kconfig dependency warning when !CRYPTO (git-fixes). - nvme-tcp: fix misuse of __smp_processor_id with preemption (git-fixes). - nvme-tcp: fix possible hang waiting for icresp response (bsc#1179519). - nvme-tcp: use cancel tagset helper for tear down (bsc#1183976). - nvme: Fix NULL dereference for pci nvme controllers (bsc#1182378). - nvme: add 'kato' sysfs attribute (bsc#1179825). - nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() (bsc#1184259). - nvme: define constants for identification values (git-fixes). - nvme: do not intialize hwmon for discovery controllers (bsc#1184259). - nvme: do not intialize hwmon for discovery controllers (git-fixes). - nvme: document nvme controller states (git-fixes). - nvme: explicitly update mpath disk capacity on revalidation (git-fixes). - nvme: expose reconnect_delay and ctrl_loss_tmo via sysfs (bsc#1182378). - nvme: fix controller instance leak (git-fixes). - nvme: fix deadlock in disconnect during scan_work and/or ana_work (git-fixes). - nvme: fix possible deadlock when I/O is blocked (git-fixes). - nvme: remove superfluous else in nvme_ctrl_loss_tmo_store (bsc#1182378). - nvme: retrigger ANA log update if group descriptor isn't found (git-fixes) - nvme: sanitize KATO setting (bsc#1179825). - nvme: simplify error logic in nvme_validate_ns() (bsc#1184259). - nvmet: fix a memory leak (git-fixes). - nvmet: seset ns->file when open fails (bsc#1183873). - nvmet: use new ana_log_size instead the old one (bsc#1184259). - nxp-i2c: restore includes for kABI (bsc#1185589). - nxp-nci: add NXP1002 id (bsc#1185589). - phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() (git-fixes). - pinctrl: ingenic: Improve unreachable code generation (git-fixes). - pinctrl: samsung: use 'int' for register masks in Exynos (git-fixes). - platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue (git-fixes). - platform/x86: intel_pmc_core: Do not use global pmcdev in quirks (git-fixes). - platform/x86: thinkpad_acpi: Correct thermal sensor allocation (git-fixes). - posix-timers: Preserve return value in clock_adjtime32() (git-fixes) - power: supply: Use IRQF_ONESHOT (git-fixes). - power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() (git-fixes). - power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() (git-fixes). - powerpc/64s: Fix crashes when toggling entry flush barrier (bsc#1177666 git-fixes). - powerpc/64s: Fix crashes when toggling stf barrier (bsc#1087082 git-fixes). - qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth (git-fixes). - rtc: pcf2127: handle timestamp interrupts (bsc#1185495). - s390/dasd: fix hanging DASD driver unbind (bsc#1183932 LTC#192153). - s390/entry: save the caller of psw_idle (bsc#1185677). - s390/kdump: fix out-of-memory with PCI (bsc#1182257 LTC#191375). - sched/eas: Do not update misfit status if the task is pinned (git-fixes) - sched/fair: Avoid stale CPU util_est value for schedutil in (git-fixes) - sched/fair: Fix unfairness caused by missing load decay (git-fixes) - scripts/git_sort/git_sort.py: add bpf git repo - scsi: core: Run queue in case of I/O resource contention failure (bsc#1186416). - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (bsc#1179851). - scsi: libfc: Avoid invoking response handler twice if ep is already completed (bsc#1186573). - scsi: lpfc: Add a option to enable interlocked ABTS before job completion (bsc#1186451). - scsi: lpfc: Add ndlp kref accounting for resume RPI path (bsc#1186451). - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology (bsc#1186451). - scsi: lpfc: Fix Node recovery when driver is handling simultaneous PLOGIs (bsc#1186451). - scsi: lpfc: Fix bad memory access during VPD DUMP mailbox command (bsc#1186451). - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the SGLs (bsc#1186451). - scsi: lpfc: Fix node handling for Fabric Controller and Domain Controller (bsc#1186451). - scsi: lpfc: Fix non-optimized ERSP handling (bsc#1186451). - scsi: lpfc: Fix unreleased RPIs when NPIV ports are created (bsc#1186451). - scsi: lpfc: Ignore GID-FT response that may be received after a link flip (bsc#1186451). - scsi: lpfc: Reregister FPIN types if ELS_RDF is received from fabric controller (bsc#1186451). - scsi: lpfc: Update lpfc version to 12.8.0.10 (bsc#1186451). - sctp: delay auto_asconf init until binding the first addr - seqlock,lockdep: Fix seqcount_latch_init() (bsc#1176564 bsc#1162702). - serial: core: fix suspicious security_locked_down() call (git-fixes). - serial: core: return early on unsupported ioctls (git-fixes). - serial: sh-sci: Fix off-by-one error in FIFO threshold register setting (git-fixes). - serial: stm32: fix incorrect characters on console (git-fixes). - serial: stm32: fix tx_empty condition (git-fixes). - serial: tegra: Fix a mask operation that is always true (git-fixes). - smc: disallow TCP_ULP in smc_setsockopt() (git-fixes). - spi: ath79: always call chipselect function (git-fixes). - spi: ath79: remove spi-master setup and cleanup assignment (git-fixes). - spi: dln2: Fix reference leak to master (git-fixes). - spi: omap-100k: Fix reference leak to master (git-fixes). - spi: qup: fix PM reference leak in spi_qup_remove() (git-fixes). - spi: spi-fsl-dspi: Fix a resource leak in an error handling path (git-fixes). - staging: emxx_udc: fix loop in _nbu2ss_nuke() (git-fixes). - staging: iio: cdc: ad7746: avoid overwrite of num_channels (git-fixes). - tcp: fix to update snd_wl1 in bulk receiver fast path - thermal/drivers/ti-soc-thermal/bandgap Remove unused variable 'val' (git-fixes). - thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue (git-fixes). - tracing: Map all PIDs to command lines (git-fixes). - tty: amiserial: fix TIOCSSERIAL permission check (git-fixes). - tty: fix memory leak in vc_deallocate (git-fixes). - tty: moxa: fix TIOCSSERIAL jiffies conversions (git-fixes). - tty: moxa: fix TIOCSSERIAL permission check (git-fixes). - uio: uio_hv_generic: use devm_kzalloc() for private data alloc (git-fixes). - uio_hv_generic: Fix a memory leak in error handling paths (git-fixes). - uio_hv_generic: Fix another memory leak in error handling paths (git-fixes). - uio_hv_generic: add missed sysfs_remove_bin_file (git-fixes). - usb: core: hub: Fix PM reference leak in usb_port_resume() (git-fixes). - usb: core: hub: fix race condition about TRSMRCY of resume (git-fixes). - usb: dwc2: Fix gadget DMA unmap direction (git-fixes). - usb: dwc3: gadget: Enable suspend events (git-fixes). - usb: dwc3: gadget: Return success always for kick transfer in ep queue (git-fixes). - usb: dwc3: omap: improve extcon initialization (git-fixes). - usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield (git-fixes). - usb: fotg210-hcd: Fix an error message (git-fixes). - usb: gadget/function/f_fs string table fix for multiple languages (git-fixes). - usb: gadget: dummy_hcd: fix gpf in gadget_setup (git-fixes). - usb: gadget: f_uac1: validate input parameters (git-fixes). - usb: gadget: f_uac2: validate input parameters (git-fixes). - usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() (git-fixes). - usb: gadget: uvc: add bInterval checking for HS mode (git-fixes). - usb: musb: fix PM reference leak in musb_irq_work() (git-fixes). - usb: sl811-hcd: improve misleading indentation (git-fixes). - usb: webcam: Invalid size of Processing Unit Descriptor (git-fixes). - usb: xhci: Fix port minor revision (git-fixes). - usb: xhci: Increase timeout for HC halt (git-fixes). - vgacon: Record video mode changes with VT_RESIZEX (git-fixes). - video: hyperv_fb: Add ratelimit on error message (bsc#1185725). - vrf: fix a comment about loopback device (git-fixes). - watchdog/softlockup: Remove obsolete check of last reported task (bsc#1185982). - watchdog/softlockup: report the overall time of softlockups (bsc#1185982). - watchdog: explicitly update timestamp when reporting softlockup (bsc#1185982). - watchdog: rename __touch_watchdog() to a better descriptive name (bsc#1185982). - whitespace cleanup - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join (git-fixes). - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt (git-fixes). - workqueue: Minor follow-ups to the rescuer destruction change (bsc#1185911). - workqueue: more destroy_workqueue() fixes (bsc#1185911). - x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported (bsc#1152489). - xhci: Do not use GFP_KERNEL in (potentially) atomic context (git-fixes). - xhci: check control context is valid before dereferencing it (git-fixes). - xhci: fix potential array out of bounds with several interrupters (git-fixes). - xsk: Respect device's headroom and tailroom on generic xmit path (git-fixes). This update was imported from the SUSE:SLE-15-SP2:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-947=1 Package List: - openSUSE Leap 15.2 (x86_64): cluster-md-kmp-rt-5.3.18-lp152.3.14.1 cluster-md-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 cluster-md-kmp-rt_debug-5.3.18-lp152.3.14.1 cluster-md-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 dlm-kmp-rt-5.3.18-lp152.3.14.1 dlm-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 dlm-kmp-rt_debug-5.3.18-lp152.3.14.1 dlm-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 gfs2-kmp-rt-5.3.18-lp152.3.14.1 gfs2-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 gfs2-kmp-rt_debug-5.3.18-lp152.3.14.1 gfs2-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 kernel-rt-5.3.18-lp152.3.14.1 kernel-rt-debuginfo-5.3.18-lp152.3.14.1 kernel-rt-debugsource-5.3.18-lp152.3.14.1 kernel-rt-devel-5.3.18-lp152.3.14.1 kernel-rt-devel-debuginfo-5.3.18-lp152.3.14.1 kernel-rt-extra-5.3.18-lp152.3.14.1 kernel-rt-extra-debuginfo-5.3.18-lp152.3.14.1 kernel-rt_debug-5.3.18-lp152.3.14.1 kernel-rt_debug-debuginfo-5.3.18-lp152.3.14.1 kernel-rt_debug-debugsource-5.3.18-lp152.3.14.1 kernel-rt_debug-devel-5.3.18-lp152.3.14.1 kernel-rt_debug-devel-debuginfo-5.3.18-lp152.3.14.1 kernel-rt_debug-extra-5.3.18-lp152.3.14.1 kernel-rt_debug-extra-debuginfo-5.3.18-lp152.3.14.1 kernel-syms-rt-5.3.18-lp152.3.14.1 kselftests-kmp-rt-5.3.18-lp152.3.14.1 kselftests-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 kselftests-kmp-rt_debug-5.3.18-lp152.3.14.1 kselftests-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 ocfs2-kmp-rt-5.3.18-lp152.3.14.1 ocfs2-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 ocfs2-kmp-rt_debug-5.3.18-lp152.3.14.1 ocfs2-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 reiserfs-kmp-rt-5.3.18-lp152.3.14.1 reiserfs-kmp-rt-debuginfo-5.3.18-lp152.3.14.1 reiserfs-kmp-rt_debug-5.3.18-lp152.3.14.1 reiserfs-kmp-rt_debug-debuginfo-5.3.18-lp152.3.14.1 - openSUSE Leap 15.2 (noarch): kernel-devel-rt-5.3.18-lp152.3.14.1 kernel-source-rt-5.3.18-lp152.3.14.1 References: https://www.suse.com/security/cve/CVE-2020-24586.html https://www.suse.com/security/cve/CVE-2020-24587.html https://www.suse.com/security/cve/CVE-2020-24588.html https://www.suse.com/security/cve/CVE-2020-26139.html https://www.suse.com/security/cve/CVE-2020-26141.html https://www.suse.com/security/cve/CVE-2020-26145.html https://www.suse.com/security/cve/CVE-2020-26147.html https://www.suse.com/security/cve/CVE-2021-23134.html https://www.suse.com/security/cve/CVE-2021-32399.html https://www.suse.com/security/cve/CVE-2021-33034.html https://www.suse.com/security/cve/CVE-2021-33200.html https://www.suse.com/security/cve/CVE-2021-3491.html https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1133021 https://bugzilla.suse.com/1152457 https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1155518 https://bugzilla.suse.com/1156395 https://bugzilla.suse.com/1162702 https://bugzilla.suse.com/1164648 https://bugzilla.suse.com/1176564 https://bugzilla.suse.com/1177666 https://bugzilla.suse.com/1178418 https://bugzilla.suse.com/1178612 https://bugzilla.suse.com/1179827 https://bugzilla.suse.com/1179851 https://bugzilla.suse.com/1182378 https://bugzilla.suse.com/1182999 https://bugzilla.suse.com/1183346 https://bugzilla.suse.com/1183868 https://bugzilla.suse.com/1183873 https://bugzilla.suse.com/1183932 https://bugzilla.suse.com/1183947 https://bugzilla.suse.com/1184081 https://bugzilla.suse.com/1184082 https://bugzilla.suse.com/1184611 https://bugzilla.suse.com/1184855 https://bugzilla.suse.com/1185428 https://bugzilla.suse.com/1185497 https://bugzilla.suse.com/1185589 https://bugzilla.suse.com/1185606 https://bugzilla.suse.com/1185645 https://bugzilla.suse.com/1185677 https://bugzilla.suse.com/1185680 https://bugzilla.suse.com/1185696 https://bugzilla.suse.com/1185703 https://bugzilla.suse.com/1185725 https://bugzilla.suse.com/1185758 https://bugzilla.suse.com/1185859 https://bugzilla.suse.com/1185861 https://bugzilla.suse.com/1185863 https://bugzilla.suse.com/1185898 https://bugzilla.suse.com/1185899 https://bugzilla.suse.com/1185911 https://bugzilla.suse.com/1185938 https://bugzilla.suse.com/1185987 https://bugzilla.suse.com/1185988 https://bugzilla.suse.com/1186061 https://bugzilla.suse.com/1186285 https://bugzilla.suse.com/1186320 https://bugzilla.suse.com/1186439 https://bugzilla.suse.com/1186441 https://bugzilla.suse.com/1186460 https://bugzilla.suse.com/1186498 https://bugzilla.suse.com/1186501 https://bugzilla.suse.com/1186573

1 0

openSUSE-SU-2021:0945-1: important: Security update for arpwatch
by opensuse-security＠opensuse.org 01 Jul '21

01 Jul '21

openSUSE Security Update: Security update for arpwatch ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0945-1 Rating: important References: #1186240 Cross-References: CVE-2021-25321 CVSS scores: CVE-2021-25321 (SUSE): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for arpwatch fixes the following issues: - CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-945=1 Package List: - openSUSE Leap 15.2 (x86_64): arpwatch-2.1a15-lp152.6.9.1 arpwatch-debuginfo-2.1a15-lp152.6.9.1 arpwatch-debugsource-2.1a15-lp152.6.9.1 arpwatch-ethercodes-build-2.1a15-lp152.6.9.1 References: https://www.suse.com/security/cve/CVE-2021-25321.html https://bugzilla.suse.com/1186240

1 0