July 2021 - openSUSE Security Announce

openSUSE-SU-2021:1057-1: important: Security update for lasso
by opensuse-security＠opensuse.org 20 Jul '21

20 Jul '21

openSUSE Security Update: Security update for lasso ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1057-1 Rating: important References: #1186768 Cross-References: CVE-2021-28091 CVSS scores: CVE-2021-28091 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-28091 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lasso fixes the following issues: - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses (boo#1186768) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1057=1 Package List: - openSUSE Leap 15.2 (x86_64): lasso-debuginfo-2.6.1-lp152.2.3.1 lasso-debugsource-2.6.1-lp152.2.3.1 liblasso-devel-2.6.1-lp152.2.3.1 liblasso3-2.6.1-lp152.2.3.1 liblasso3-debuginfo-2.6.1-lp152.2.3.1 python3-lasso-2.6.1-lp152.2.3.1 python3-lasso-debuginfo-2.6.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-28091.html https://bugzilla.suse.com/1186768

1 0

openSUSE-SU-2021:2398-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 19 Jul '21

19 Jul '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2398-1 Rating: moderate References: #1175132 #1188229 Cross-References: CVE-2021-34558 CVSS scores: CVE-2021-34558 (SUSE): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.15 fixes the following issues: - go1.15.14 (released 2021-07-12) includes a security fix to the crypto/tls package, as well as bug fixes to the linker, and the net package. CVE-2021-34558 Refs bsc#1175132 go1.15 release tracking * bsc#1188229 go#47143 CVE-2021-34558 * go#47144 security: fix CVE-2021-34558 * go#47012 net: LookupMX behaviour broken * go#46994 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3 * go#46768 syscall: TestGroupCleanupUserNamespace test failure on Fedora * go#46684 x/build/cmd/release: linux-armv6l release tests aren't passing * go#46656 runtime: deeply nested struct initialized with non-zero values - Fix extraneous trailing percent character %endif% in spec file. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2398=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.15-1.15.14-1.36.1 go1.15-doc-1.15.14-1.36.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.15-race-1.15.14-1.36.1 References: https://www.suse.com/security/cve/CVE-2021-34558.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1188229

1 0

openSUSE-SU-2021:1054-1: moderate: Security update for icinga2
by opensuse-security＠opensuse.org 19 Jul '21

19 Jul '21

openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1054-1 Rating: moderate References: #1180147 Cross-References: CVE-2020-29663 CVSS scores: CVE-2020-29663 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2020-29663 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icinga2 fixes the following issues: Update to 2.12.4 * Bugfixes - Fix a crash when notification objects are deleted using the API #8782 - Fix crashes that might occur during downtime scheduling if host or downtime objects are deleted using the API #8785 - Fix an issue where notifications may incorrectly be skipped after a downtime ends #8775 - Don't send reminder notification if the notification is still suppressed by a time period #8808 - Fix an issue where attempting to create a duplicate object using the API might result in the original object being deleted #8787 - IDO: prioritize program status updates #8809 - Improve exceptions handling, including a fix for an uncaught exception on Windows #8777 - Retry file rename operations on Windows to avoid intermittent locking issues #8771 * Enhancements - Support Boost 1.74 (Ubuntu 21.04, Fedora 34) #8792 Update to 2.12.3 * Security - Fix that revoked certificates due for renewal will automatically be renewed ignoring the CRL (Advisory / CVE-2020-29663 - fixes boo#1180147 ) * Bugfixes - Improve config sync locking - resolves high load issues on Windows #8511 - Fix runtime config updates being ignored for objects without zone #8549 - Use proper buffer size for OpenSSL error messages #8542 * Enhancements - On checkable recovery: re-check children that have a problem #8506 Update to 2.12.2 * Bugfixes - Fix a connection leak with misconfigured agents #8483 - Properly sync changes of config objects in global zones done via the API #8474 #8470 - Prevent other clients from being disconnected when replaying the cluster log takes very long #8496 - Avoid duplicate connections between endpoints #8465 - Ignore incoming config object updates for unknown zones #8461 - Check timestamps before removing files in config sync #8495 * Enhancements - Include HTTP status codes in log #8467 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1054=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): icinga2-2.12.4-bp152.4.6.1 icinga2-bin-2.12.4-bp152.4.6.1 icinga2-common-2.12.4-bp152.4.6.1 icinga2-doc-2.12.4-bp152.4.6.1 icinga2-ido-mysql-2.12.4-bp152.4.6.1 icinga2-ido-pgsql-2.12.4-bp152.4.6.1 nano-icinga2-2.12.4-bp152.4.6.1 vim-icinga2-2.12.4-bp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-29663.html https://bugzilla.suse.com/1180147

1 0

openSUSE-SU-2021:1053-1: moderate: Security update for icinga2
by opensuse-security＠opensuse.org 19 Jul '21

19 Jul '21

openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1053-1 Rating: moderate References: #1180147 Cross-References: CVE-2020-29663 CVSS scores: CVE-2020-29663 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2020-29663 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icinga2 fixes the following issues: icinga2 was updated to 2.12.4 * Bugfixes - Fix a crash when notification objects are deleted using the API #8782 - Fix crashes that might occur during downtime scheduling if host or downtime objects are deleted using the API #8785 - Fix an issue where notifications may incorrectly be skipped after a downtime ends #8775 - Don't send reminder notification if the notification is still suppressed by a time period #8808 - Fix an issue where attempting to create a duplicate object using the API might result in the original object being deleted #8787 - IDO: prioritize program status updates #8809 - Improve exceptions handling, including a fix for an uncaught exception on Windows #8777 - Retry file rename operations on Windows to avoid intermittent locking issues #8771 Update to 2.12.3 * Security - Fix that revoked certificates due for renewal will automatically be renewed ignoring the CRL (Advisory / CVE-2020-29663 - fixes boo#1180147 ) * Bugfixes - Improve config sync locking - resolves high load issues on Windows #8511 - Fix runtime config updates being ignored for objects without zone #8549 - Use proper buffer size for OpenSSL error messages #8542 * Enhancements - On checkable recovery: re-check children that have a problem #8506 Update to 2.12.2 * Bugfixes - Fix a connection leak with misconfigured agents #8483 - Properly sync changes of config objects in global zones done via the API #8474 #8470 - Prevent other clients from being disconnected when replaying the cluster log takes very long #8496 - Avoid duplicate connections between endpoints #8465 - Ignore incoming config object updates for unknown zones #8461 - Check timestamps before removing files in config sync #8495 * Enhancements - Include HTTP status codes in log #8467 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1053=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): icinga2-2.12.4-bp151.3.6.1 icinga2-bin-2.12.4-bp151.3.6.1 icinga2-common-2.12.4-bp151.3.6.1 icinga2-doc-2.12.4-bp151.3.6.1 icinga2-ido-mysql-2.12.4-bp151.3.6.1 icinga2-ido-pgsql-2.12.4-bp151.3.6.1 nano-icinga2-2.12.4-bp151.3.6.1 vim-icinga2-2.12.4-bp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-29663.html https://bugzilla.suse.com/1180147

1 0

openSUSE-SU-2021:2393-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jul '21

19 Jul '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2393-1 Rating: important References: #1188275 Cross-References: CVE-2021-29970 CVE-2021-29976 CVE-2021-30547 CVSS scores: CVE-2021-30547 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.12.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-29 (bsc#1188275) * CVE-2021-29970 (bmo#1709976): Use-after-free in accessibility features of a document * CVE-2021-30547 (bmo#1715766): Out of bounds write in ANGLE * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910, bmo#1711576, bmo#1714391): Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2393=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.12.0-8.46.1 MozillaFirefox-branding-upstream-78.12.0-8.46.1 MozillaFirefox-debuginfo-78.12.0-8.46.1 MozillaFirefox-debugsource-78.12.0-8.46.1 MozillaFirefox-devel-78.12.0-8.46.1 MozillaFirefox-translations-common-78.12.0-8.46.1 MozillaFirefox-translations-other-78.12.0-8.46.1 - openSUSE Leap 15.3 (x86_64): MozillaFirefox-buildsymbols-78.12.0-8.46.1 References: https://www.suse.com/security/cve/CVE-2021-29970.html https://www.suse.com/security/cve/CVE-2021-29976.html https://www.suse.com/security/cve/CVE-2021-30547.html https://bugzilla.suse.com/1188275

1 0

openSUSE-SU-2021:2392-1: important: Security update for go1.16
by opensuse-security＠opensuse.org 19 Jul '21

19 Jul '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2392-1 Rating: important References: #1182345 #1188229 Cross-References: CVE-2021-34558 CVSS scores: CVE-2021-34558 (SUSE): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.16 fixes the following issues: go1.16.6 (released 2021-07-12, bsc#1182345) includes a security fix to the crypto/tls package, as well as bug fixes to the compiler, and the net and net/http packages. Security issue fixed: CVE-2021-34558: Fixed crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters (bsc#1188229) go1.16 release: * bsc#1188229 go#47143 CVE-2021-34558 * go#47145 security: fix CVE-2021-34558 * go#46999 net: LookupMX behaviour broken * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3 * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora * go#46657 runtime: deeply nested struct initialized with non-zero values * go#44984 net/http: server not setting Content-Length in certain cases Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2392=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.6-1.20.1 go1.16-doc-1.16.6-1.20.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.6-1.20.1 References: https://www.suse.com/security/cve/CVE-2021-34558.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1188229

1 0

openSUSE-SU-2021:1050-1: moderate: Security update for fossil
by opensuse-security＠opensuse.org 17 Jul '21

17 Jul '21

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1050-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1050=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp153.2.3.1 References: https://bugzilla.suse.com/1187988

1 0

openSUSE-SU-2021:1051-1: moderate: Security update for fossil
by opensuse-security＠opensuse.org 17 Jul '21

17 Jul '21

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1051-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1051=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp152.2.6.1 References: https://bugzilla.suse.com/1187988

1 0

openSUSE-SU-2021:1052-1: moderate: Security update for fossil
by opensuse-security＠opensuse.org 17 Jul '21

17 Jul '21

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1052=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp151.4.9.1 References: https://bugzilla.suse.com/1187988

1 0

openSUSE-SU-2021:1045-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 16 Jul '21

16 Jul '21

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1045-1 Rating: moderate References: #1174457 Cross-References: CVE-2020-15917 CVSS scores: CVE-2020-15917 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: Update to 3.18.0 * Support for the OAuth2 authorisation protocol has been added for IMAP, POP and SMTP using custom, user-generated client IDs. OAuth2 preferences are found in the Account Preferences on the Receive page (for POP: Authenticate before POP connection, for IMAP: Authentication method); the Send page (SMTP authentication: Authentication method); and on a dedicated OAuth2 page. * The option 'Save (X-)Face in address book if possible' has been added to the /Message View/Text Options preferences page. Previously the (X-)Face would be saved automatically, therefore this option is turned on by default. * The Image Viewer has been reworked. New options have been added to /Message View/Image Viewer: when resizing images, either fit the image width or fit the image height to the available space. Fitting the image height is the default. Regardless of this setting, when displaying images inline they will fit the height. When displaying an image, left-clicking the image will toggle between full size and reduced size; right-clicking will toggle between fitting the height and fitting the width. * When re-editing a saved message, it is now possible to use /Options/Remove References. * It is now possible to attempt to retrieve a missing GPG key via WKD. * The man page has been updated. * Updated translations: Brazilian Portuguese, British English, Catalan, Czech, Danish, Dutch, French, Polish, Romanian, Russian, Slovak, Spanish, Traditional Chinese, Turkish. * bug fixes: claws#2411, claws#4326, claws#4394, claws#4431, claws#4445, claws#4447, claws#4455, claws#4473 - stop WM's X button from causing GPG key fetch attempt - Make fancy respect default font size for messageview - harden link checker before accepting click - non-display of (X-)Face when prefs_common.enable_avatars is AVATARS_ENABLE_RENDER (2) - debian bug #983778, 'Segfault on selecting empty 'X-Face' custom header' * It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues. * A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL). * The progress window when importing an mbox file is now more responsive. * A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled. * Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3. Bug fixes: * bug 3922, 'minimize to tray on startup not working' * bug 4220, 'generates files in cache without content' * bug 4325, 'Following redirects when retrieving image' * bug 4342, 'Import mbox file command doesn't work twice on a row' * fix STARTTLS protocol violation CVE-2020-15917 boo#1174457) * fix initial debug line * fix fat-fingered crash when v (hiding msgview) is pressed just before c (check signature) * fix non-translation of some Templates strings Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1045=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1045=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1045=1 Package List: - openSUSE Leap 15.2 (noarch): claws-mail-lang-3.18.0-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): claws-mail-3.18.0-lp152.3.9.1 claws-mail-debuginfo-3.18.0-lp152.3.9.1 claws-mail-debugsource-3.18.0-lp152.3.9.1 claws-mail-devel-3.18.0-lp152.3.9.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): claws-mail-3.18.0-bp153.2.3.1 claws-mail-debuginfo-3.18.0-bp153.2.3.1 claws-mail-debugsource-3.18.0-bp153.2.3.1 claws-mail-devel-3.18.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): claws-mail-lang-3.18.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): claws-mail-3.18.0-bp152.3.9.1 claws-mail-devel-3.18.0-bp152.3.9.1 - openSUSE Backports SLE-15-SP2 (noarch): claws-mail-lang-3.18.0-bp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-15917.html https://bugzilla.suse.com/1174457

1 0