July 2021 - openSUSE Security Announce

openSUSE-SU-2021:2404-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2404-1 Rating: moderate References: #1184994 #1188063 Cross-References: CVE-2021-33910 CVSS scores: CVE-2021-33910 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063) - Skip udev rules if 'elevator=' is used (bsc#1184994) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2404=1 Package List: - openSUSE Leap 15.3 (noarch): systemd-bash-completion-234-24.90.1 References: https://www.suse.com/security/cve/CVE-2021-33910.html https://bugzilla.suse.com/1184994 https://bugzilla.suse.com/1188063

1 0

openSUSE-SU-2021:2412-1: moderate: Security update for containerd
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for containerd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2412-1 Rating: moderate References: #1188282 Cross-References: CVE-2021-32760 CVSS scores: CVE-2021-32760 (SUSE): 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for containerd fixes the following issues: - CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. (bsc#1188282) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2412=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): containerd-1.4.4-5.36.1 containerd-ctr-1.4.4-5.36.1 References: https://www.suse.com/security/cve/CVE-2021-32760.html https://bugzilla.suse.com/1188282

1 0

openSUSE-SU-2021:2410-1: important: Security update for systemd
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2410-1 Rating: important References: #1188063 Cross-References: CVE-2021-33910 CVSS scores: CVE-2021-33910 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for systemd fixes the following issues: - CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2410=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsystemd0-246.13-7.8.1 libsystemd0-debuginfo-246.13-7.8.1 libudev-devel-246.13-7.8.1 libudev1-246.13-7.8.1 libudev1-debuginfo-246.13-7.8.1 nss-myhostname-246.13-7.8.1 nss-myhostname-debuginfo-246.13-7.8.1 nss-mymachines-246.13-7.8.1 nss-mymachines-debuginfo-246.13-7.8.1 nss-resolve-246.13-7.8.1 nss-resolve-debuginfo-246.13-7.8.1 nss-systemd-246.13-7.8.1 nss-systemd-debuginfo-246.13-7.8.1 systemd-246.13-7.8.1 systemd-container-246.13-7.8.1 systemd-container-debuginfo-246.13-7.8.1 systemd-coredump-246.13-7.8.1 systemd-coredump-debuginfo-246.13-7.8.1 systemd-debuginfo-246.13-7.8.1 systemd-debugsource-246.13-7.8.1 systemd-devel-246.13-7.8.1 systemd-doc-246.13-7.8.1 systemd-journal-remote-246.13-7.8.1 systemd-journal-remote-debuginfo-246.13-7.8.1 systemd-logger-246.13-7.8.1 systemd-network-246.13-7.8.1 systemd-network-debuginfo-246.13-7.8.1 systemd-sysvinit-246.13-7.8.1 udev-246.13-7.8.1 udev-debuginfo-246.13-7.8.1 - openSUSE Leap 15.3 (noarch): systemd-lang-246.13-7.8.1 - openSUSE Leap 15.3 (x86_64): libsystemd0-32bit-246.13-7.8.1 libsystemd0-32bit-debuginfo-246.13-7.8.1 libudev-devel-32bit-246.13-7.8.1 libudev1-32bit-246.13-7.8.1 libudev1-32bit-debuginfo-246.13-7.8.1 nss-myhostname-32bit-246.13-7.8.1 nss-myhostname-32bit-debuginfo-246.13-7.8.1 nss-mymachines-32bit-246.13-7.8.1 nss-mymachines-32bit-debuginfo-246.13-7.8.1 systemd-32bit-246.13-7.8.1 systemd-32bit-debuginfo-246.13-7.8.1 References: https://www.suse.com/security/cve/CVE-2021-33910.html https://bugzilla.suse.com/1188063

1 0

openSUSE-SU-2021:2409-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2409-1 Rating: important References: #1152489 #1182470 #1185486 #1187927 #1187972 #1187980 #1188062 #1188116 Cross-References: CVE-2021-22555 CVE-2021-33909 CVSS scores: CVE-2021-22555 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-22555 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33909 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-22555: A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c (bnc#1188116 ). - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges (bsc#1188062). The following non-security bugs were fixed: - ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927). - cgroup1: do not allow '\n' in renaming (bsc#1187972). - qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470 bsc#1185486). - scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980). - usb: dwc3: Fix debugfs creation flow (git-fixes). - x86/pkru: Write hardware init value to PKRU when xstate is init (bsc#1152489). - x86/process: Check PF_KTHREAD and not current->mm for kernel threads (bsc#1152489). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2409=1 Package List: - openSUSE Leap 15.3 (x86_64): cluster-md-kmp-azure-5.3.18-38.14.1 cluster-md-kmp-azure-debuginfo-5.3.18-38.14.1 dlm-kmp-azure-5.3.18-38.14.1 dlm-kmp-azure-debuginfo-5.3.18-38.14.1 gfs2-kmp-azure-5.3.18-38.14.1 gfs2-kmp-azure-debuginfo-5.3.18-38.14.1 kernel-azure-5.3.18-38.14.1 kernel-azure-debuginfo-5.3.18-38.14.1 kernel-azure-debugsource-5.3.18-38.14.1 kernel-azure-devel-5.3.18-38.14.1 kernel-azure-devel-debuginfo-5.3.18-38.14.1 kernel-azure-extra-5.3.18-38.14.1 kernel-azure-extra-debuginfo-5.3.18-38.14.1 kernel-azure-livepatch-devel-5.3.18-38.14.1 kernel-azure-optional-5.3.18-38.14.1 kernel-azure-optional-debuginfo-5.3.18-38.14.1 kernel-syms-azure-5.3.18-38.14.1 kselftests-kmp-azure-5.3.18-38.14.1 kselftests-kmp-azure-debuginfo-5.3.18-38.14.1 ocfs2-kmp-azure-5.3.18-38.14.1 ocfs2-kmp-azure-debuginfo-5.3.18-38.14.1 reiserfs-kmp-azure-5.3.18-38.14.1 reiserfs-kmp-azure-debuginfo-5.3.18-38.14.1 - openSUSE Leap 15.3 (noarch): kernel-devel-azure-5.3.18-38.14.1 kernel-source-azure-5.3.18-38.14.1 References: https://www.suse.com/security/cve/CVE-2021-22555.html https://www.suse.com/security/cve/CVE-2021-33909.html https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1182470 https://bugzilla.suse.com/1185486 https://bugzilla.suse.com/1187927 https://bugzilla.suse.com/1187972 https://bugzilla.suse.com/1187980 https://bugzilla.suse.com/1188062 https://bugzilla.suse.com/1188116

1 0

openSUSE-SU-2021:1066-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1066-1 Rating: important References: #1188275 Cross-References: CVE-2021-29970 CVE-2021-29976 CVE-2021-30547 CVSS scores: CVE-2021-30547 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.12.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-29 (bsc#1188275) * CVE-2021-29970 (bmo#1709976): Use-after-free in accessibility features of a document * CVE-2021-30547 (bmo#1715766): Out of bounds write in ANGLE * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910, bmo#1711576, bmo#1714391): Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1066=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.12.0-lp152.2.61.1 MozillaFirefox-branding-upstream-78.12.0-lp152.2.61.1 MozillaFirefox-buildsymbols-78.12.0-lp152.2.61.1 MozillaFirefox-debuginfo-78.12.0-lp152.2.61.1 MozillaFirefox-debugsource-78.12.0-lp152.2.61.1 MozillaFirefox-devel-78.12.0-lp152.2.61.1 MozillaFirefox-translations-common-78.12.0-lp152.2.61.1 MozillaFirefox-translations-other-78.12.0-lp152.2.61.1 References: https://www.suse.com/security/cve/CVE-2021-29970.html https://www.suse.com/security/cve/CVE-2021-29976.html https://www.suse.com/security/cve/CVE-2021-30547.html https://bugzilla.suse.com/1188275

1 0

openSUSE-SU-2021:1056-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1056-1 Rating: important References: #1187105 Cross-References: CVE-2020-35512 CVSS scores: CVE-2020-35512 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35512 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dbus-1 fixes the following issues: - CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105) This update was imported from the SUSE:SLE-15-SP1:Update update project. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1056=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dbus-1-1.12.2-lp152.6.3.1 dbus-1-debuginfo-1.12.2-lp152.6.3.1 dbus-1-debugsource-1.12.2-lp152.6.3.1 dbus-1-devel-1.12.2-lp152.6.3.1 dbus-1-x11-1.12.2-lp152.6.3.1 dbus-1-x11-debuginfo-1.12.2-lp152.6.3.1 dbus-1-x11-debugsource-1.12.2-lp152.6.3.1 libdbus-1-3-1.12.2-lp152.6.3.1 libdbus-1-3-debuginfo-1.12.2-lp152.6.3.1 - openSUSE Leap 15.2 (noarch): dbus-1-devel-doc-1.12.2-lp152.6.3.1 - openSUSE Leap 15.2 (x86_64): dbus-1-32bit-debuginfo-1.12.2-lp152.6.3.1 dbus-1-devel-32bit-1.12.2-lp152.6.3.1 libdbus-1-3-32bit-1.12.2-lp152.6.3.1 libdbus-1-3-32bit-debuginfo-1.12.2-lp152.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-35512.html https://bugzilla.suse.com/1187105

1 0

openSUSE-SU-2021:1058-1: important: Security update for sqlite3
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1058-1 Rating: important References: #1157818 #1158812 #1158958 #1158959 #1158960 #1159491 #1159715 #1159847 #1159850 #1160309 #1160438 #1160439 #1164719 #1172091 #1172115 #1172234 #1172236 #1172240 #1173641 #928700 #928701 SLE-16032 Cross-References: CVE-2015-3414 CVE-2015-3415 CVE-2019-19244 CVE-2019-19317 CVE-2019-19603 CVE-2019-19645 CVE-2019-19646 CVE-2019-19880 CVE-2019-19923 CVE-2019-19924 CVE-2019-19925 CVE-2019-19926 CVE-2019-19959 CVE-2019-20218 CVE-2020-13434 CVE-2020-13435 CVE-2020-13630 CVE-2020-13631 CVE-2020-13632 CVE-2020-15358 CVE-2020-9327 CVSS scores: CVE-2019-19244 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19244 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19317 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-19317 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2019-19603 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19603 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19645 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2019-19645 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19646 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-19646 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2019-19880 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19923 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19923 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2019-19924 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2019-19924 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2019-19925 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19925 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-19926 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19926 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-19959 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-19959 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2019-20218 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-20218 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-13434 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-13434 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-13435 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-13435 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2020-13630 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-13630 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2020-13631 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2020-13631 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2020-13632 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-13632 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2020-15358 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-15358 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2020-9327 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-9327 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities, contains one feature is now available. Description: This update for sqlite3 fixes the following issues: - Update to version 3.36.0 - CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization (bsc#1173641) - CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator (bsc#1164719) - CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error (bsc#1160439) - CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input (bsc#1160438) - CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference (bsc#1160309) - CVE-2019-19924: improper error handling in sqlite3WindowRewrite() (bsc#1159850) - CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive (bsc#1159847) - CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c (bsc#1159715) - CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference (bsc#1159491) - CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name (bsc#1158960) - CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns (bsc#1158959) - CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements (bsc#1158958) - CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service (bsc#1158812) - CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage (bsc#1157818) - CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability (bsc#928701) - CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names (bsc#928700) - CVE-2020-13434: integer overflow in sqlite3_str_vappendf (bsc#1172115) - CVE-2020-13630: (bsc#1172234: use-after-free in fts3EvalNextRow - CVE-2020-13631: virtual table allowed to be renamed to one of its shadow tables (bsc#1172236) - CVE-2020-13632: NULL pointer dereference via crafted matchinfo() query (bsc#1172240) - CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (bsc#1172091) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1058=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsqlite3-0-3.36.0-lp152.4.3.1 libsqlite3-0-debuginfo-3.36.0-lp152.4.3.1 sqlite3-3.36.0-lp152.4.3.1 sqlite3-debuginfo-3.36.0-lp152.4.3.1 sqlite3-debugsource-3.36.0-lp152.4.3.1 sqlite3-devel-3.36.0-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libsqlite3-0-32bit-3.36.0-lp152.4.3.1 libsqlite3-0-32bit-debuginfo-3.36.0-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): sqlite3-doc-3.36.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2015-3414.html https://www.suse.com/security/cve/CVE-2015-3415.html https://www.suse.com/security/cve/CVE-2019-19244.html https://www.suse.com/security/cve/CVE-2019-19317.html https://www.suse.com/security/cve/CVE-2019-19603.html https://www.suse.com/security/cve/CVE-2019-19645.html https://www.suse.com/security/cve/CVE-2019-19646.html https://www.suse.com/security/cve/CVE-2019-19880.html https://www.suse.com/security/cve/CVE-2019-19923.html https://www.suse.com/security/cve/CVE-2019-19924.html https://www.suse.com/security/cve/CVE-2019-19925.html https://www.suse.com/security/cve/CVE-2019-19926.html https://www.suse.com/security/cve/CVE-2019-19959.html https://www.suse.com/security/cve/CVE-2019-20218.html https://www.suse.com/security/cve/CVE-2020-13434.html https://www.suse.com/security/cve/CVE-2020-13435.html https://www.suse.com/security/cve/CVE-2020-13630.html https://www.suse.com/security/cve/CVE-2020-13631.html https://www.suse.com/security/cve/CVE-2020-13632.html https://www.suse.com/security/cve/CVE-2020-15358.html https://www.suse.com/security/cve/CVE-2020-9327.html https://bugzilla.suse.com/1157818 https://bugzilla.suse.com/1158812 https://bugzilla.suse.com/1158958 https://bugzilla.suse.com/1158959 https://bugzilla.suse.com/1158960 https://bugzilla.suse.com/1159491 https://bugzilla.suse.com/1159715 https://bugzilla.suse.com/1159847 https://bugzilla.suse.com/1159850 https://bugzilla.suse.com/1160309 https://bugzilla.suse.com/1160438 https://bugzilla.suse.com/1160439 https://bugzilla.suse.com/1164719 https://bugzilla.suse.com/1172091 https://bugzilla.suse.com/1172115 https://bugzilla.suse.com/1172234 https://bugzilla.suse.com/1172236 https://bugzilla.suse.com/1172240 https://bugzilla.suse.com/1173641 https://bugzilla.suse.com/928700 https://bugzilla.suse.com/928701

1 0

openSUSE-SU-2021:1060-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1060-1 Rating: important References: #1184450 #1187973 #1187976 #1187977 Cross-References: CVE-2020-7774 CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 CVSS scores: CVE-2020-7774 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-22918 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2021-23362 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23362 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-27290 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27290 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: Update nodejs14 to 14.17.2. Including fixes for: - CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973) - CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976) - CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977) - CVE-2020-7774: y18n Prototype Pollution (bsc#1184450) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1060=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.17.2-lp152.11.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.17.2-lp152.11.1 nodejs14-debuginfo-14.17.2-lp152.11.1 nodejs14-debugsource-14.17.2-lp152.11.1 nodejs14-devel-14.17.2-lp152.11.1 npm14-14.17.2-lp152.11.1 References: https://www.suse.com/security/cve/CVE-2020-7774.html https://www.suse.com/security/cve/CVE-2021-22918.html https://www.suse.com/security/cve/CVE-2021-23362.html https://www.suse.com/security/cve/CVE-2021-27290.html https://bugzilla.suse.com/1184450 https://bugzilla.suse.com/1187973 https://bugzilla.suse.com/1187976 https://bugzilla.suse.com/1187977

1 0

openSUSE-SU-2021:1061-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1061-1 Rating: important References: #1183155 #1183851 #1183852 #1184450 #1187973 #1187976 #1187977 Cross-References: CVE-2020-7774 CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 CVE-2021-3449 CVE-2021-3450 CVSS scores: CVE-2020-7774 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-22918 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2021-23362 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23362 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-27290 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27290 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3450 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3450 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for nodejs10 fixes the following issues: Update nodejs10 to 10.24.1. Including fixes for - CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973) - CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976) - CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977) - CVE-2020-7774: y18n Prototype Pollution (bsc#1184450) - CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851) - CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852) - reduce memory footprint of test-worker-stdio (bsc#1183155) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1061=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs10-10.24.1-lp152.2.15.1 nodejs10-debuginfo-10.24.1-lp152.2.15.1 nodejs10-debugsource-10.24.1-lp152.2.15.1 nodejs10-devel-10.24.1-lp152.2.15.1 npm10-10.24.1-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): nodejs10-docs-10.24.1-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2020-7774.html https://www.suse.com/security/cve/CVE-2021-22918.html https://www.suse.com/security/cve/CVE-2021-23362.html https://www.suse.com/security/cve/CVE-2021-27290.html https://www.suse.com/security/cve/CVE-2021-3449.html https://www.suse.com/security/cve/CVE-2021-3450.html https://bugzilla.suse.com/1183155 https://bugzilla.suse.com/1183851 https://bugzilla.suse.com/1183852 https://bugzilla.suse.com/1184450 https://bugzilla.suse.com/1187973 https://bugzilla.suse.com/1187976 https://bugzilla.suse.com/1187977

1 0

openSUSE-SU-2021:1059-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1059-1 Rating: important References: #1183851 #1183852 #1184450 #1187973 #1187976 #1187977 Cross-References: CVE-2020-7774 CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 CVE-2021-3449 CVE-2021-3450 CVSS scores: CVE-2020-7774 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-22918 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2021-23362 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23362 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-27290 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27290 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3450 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3450 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - update to 12.22.2: - CVE-2021-22918: Out of bounds read (bsc#1187973) - CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977) - CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976) - CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851) - CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852) - CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1059=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nodejs12-12.22.2-lp152.3.15.1 nodejs12-debuginfo-12.22.2-lp152.3.15.1 nodejs12-debugsource-12.22.2-lp152.3.15.1 nodejs12-devel-12.22.2-lp152.3.15.1 npm12-12.22.2-lp152.3.15.1 - openSUSE Leap 15.2 (noarch): nodejs12-docs-12.22.2-lp152.3.15.1 References: https://www.suse.com/security/cve/CVE-2020-7774.html https://www.suse.com/security/cve/CVE-2021-22918.html https://www.suse.com/security/cve/CVE-2021-23362.html https://www.suse.com/security/cve/CVE-2021-27290.html https://www.suse.com/security/cve/CVE-2021-3449.html https://www.suse.com/security/cve/CVE-2021-3450.html https://bugzilla.suse.com/1183851 https://bugzilla.suse.com/1183852 https://bugzilla.suse.com/1184450 https://bugzilla.suse.com/1187973 https://bugzilla.suse.com/1187976 https://bugzilla.suse.com/1187977

1 0