July 2021 - openSUSE Security Announce

openSUSE-SU-2021:2147-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2147-1 Rating: moderate References: #1184016 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for freeradius-server fixes the following issues: - Fixed plaintext password entries in logfiles (bsc#1184016). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2147=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): freeradius-server-3.0.21-3.9.1 freeradius-server-debuginfo-3.0.21-3.9.1 freeradius-server-debugsource-3.0.21-3.9.1 freeradius-server-devel-3.0.21-3.9.1 freeradius-server-doc-3.0.21-3.9.1 freeradius-server-krb5-3.0.21-3.9.1 freeradius-server-krb5-debuginfo-3.0.21-3.9.1 freeradius-server-ldap-3.0.21-3.9.1 freeradius-server-ldap-debuginfo-3.0.21-3.9.1 freeradius-server-libs-3.0.21-3.9.1 freeradius-server-libs-debuginfo-3.0.21-3.9.1 freeradius-server-mysql-3.0.21-3.9.1 freeradius-server-mysql-debuginfo-3.0.21-3.9.1 freeradius-server-perl-3.0.21-3.9.1 freeradius-server-perl-debuginfo-3.0.21-3.9.1 freeradius-server-postgresql-3.0.21-3.9.1 freeradius-server-postgresql-debuginfo-3.0.21-3.9.1 freeradius-server-python3-3.0.21-3.9.1 freeradius-server-python3-debuginfo-3.0.21-3.9.1 freeradius-server-sqlite-3.0.21-3.9.1 freeradius-server-sqlite-debuginfo-3.0.21-3.9.1 freeradius-server-utils-3.0.21-3.9.1 freeradius-server-utils-debuginfo-3.0.21-3.9.1 References: https://bugzilla.suse.com/1184016

1 0

openSUSE-SU-2021:1876-1: important: Security update for snakeyaml
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for snakeyaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1876-1 Rating: important References: #1159488 #1186088 Cross-References: CVE-2017-18640 CVSS scores: CVE-2017-18640 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-18640 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for snakeyaml fixes the following issues: - Upgrade to 1.28 - CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1876=1 Package List: - openSUSE Leap 15.3 (noarch): snakeyaml-1.28-3.5.1 snakeyaml-javadoc-1.28-3.5.1 References: https://www.suse.com/security/cve/CVE-2017-18640.html https://bugzilla.suse.com/1159488 https://bugzilla.suse.com/1186088

1 0

openSUSE-SU-2021:1785-1: moderate: Security update for postgresql13
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for postgresql13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1785-1 Rating: moderate References: #1179945 #1183118 #1183168 #1185924 #1185925 #1185926 Cross-References: CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 CVSS scores: CVE-2021-32027 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32027 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-32028 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-32029 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for postgresql13 fixes the following issues: - Upgrade to version 13.3: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924). - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925). - CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926). - Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168). - Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118). - Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1785=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): postgresql13-13.3-5.10.1 postgresql13-contrib-13.3-5.10.1 postgresql13-contrib-debuginfo-13.3-5.10.1 postgresql13-debuginfo-13.3-5.10.1 postgresql13-debugsource-13.3-5.10.1 postgresql13-devel-13.3-5.10.1 postgresql13-devel-debuginfo-13.3-5.10.1 postgresql13-devel-mini-13.3-5.10.1 postgresql13-devel-mini-debuginfo-13.3-5.10.1 postgresql13-llvmjit-13.3-5.10.1 postgresql13-llvmjit-debuginfo-13.3-5.10.1 postgresql13-plperl-13.3-5.10.1 postgresql13-plperl-debuginfo-13.3-5.10.1 postgresql13-plpython-13.3-5.10.1 postgresql13-plpython-debuginfo-13.3-5.10.1 postgresql13-pltcl-13.3-5.10.1 postgresql13-pltcl-debuginfo-13.3-5.10.1 postgresql13-server-13.3-5.10.1 postgresql13-server-debuginfo-13.3-5.10.1 postgresql13-server-devel-13.3-5.10.1 postgresql13-server-devel-debuginfo-13.3-5.10.1 postgresql13-test-13.3-5.10.1 - openSUSE Leap 15.3 (noarch): postgresql13-docs-13.3-5.10.1 References: https://www.suse.com/security/cve/CVE-2021-32027.html https://www.suse.com/security/cve/CVE-2021-32028.html https://www.suse.com/security/cve/CVE-2021-32029.html https://bugzilla.suse.com/1179945 https://bugzilla.suse.com/1183118 https://bugzilla.suse.com/1183168 https://bugzilla.suse.com/1185924 https://bugzilla.suse.com/1185925 https://bugzilla.suse.com/1185926

1 0

openSUSE-SU-2021:1759-1: important: Security update for rubygem-actionpack-5_1
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for rubygem-actionpack-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1759-1 Rating: important References: #1185715 Cross-References: CVE-2021-22885 CVSS scores: CVE-2021-22885 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-22885 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionpack-5_1 fixes the following issues: - CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack (bsc#1185715). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1759=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-actionpack-5_1-5.1.4-3.9.1 ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-22885.html https://bugzilla.suse.com/1185715

1 0

openSUSE-SU-2021:2157-1: important: Security update for libgcrypt
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2157-1 Rating: important References: #1187212 Cross-References: CVE-2021-33560 CVSS scores: CVE-2021-33560 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-33560 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgcrypt fixes the following issues: - CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2157=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libgcrypt-cavs-1.8.2-8.39.1 libgcrypt-cavs-debuginfo-1.8.2-8.39.1 libgcrypt-debugsource-1.8.2-8.39.1 libgcrypt-devel-1.8.2-8.39.1 libgcrypt-devel-debuginfo-1.8.2-8.39.1 libgcrypt20-1.8.2-8.39.1 libgcrypt20-debuginfo-1.8.2-8.39.1 libgcrypt20-hmac-1.8.2-8.39.1 - openSUSE Leap 15.3 (x86_64): libgcrypt-devel-32bit-1.8.2-8.39.1 libgcrypt-devel-32bit-debuginfo-1.8.2-8.39.1 libgcrypt20-32bit-1.8.2-8.39.1 libgcrypt20-32bit-debuginfo-1.8.2-8.39.1 libgcrypt20-hmac-32bit-1.8.2-8.39.1 References: https://www.suse.com/security/cve/CVE-2021-33560.html https://bugzilla.suse.com/1187212

1 0

openSUSE-SU-2021:1995-1: important: Security update for xstream
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1995-1 Rating: important References: #1186651 Cross-References: CVE-2021-29505 CVSS scores: CVE-2021-29505 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29505 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1995=1 Package List: - openSUSE Leap 15.3 (noarch): xstream-1.4.17-3.11.2 xstream-benchmark-1.4.17-3.11.2 xstream-javadoc-1.4.17-3.11.2 xstream-parent-1.4.17-3.11.2 References: https://www.suse.com/security/cve/CVE-2021-29505.html https://bugzilla.suse.com/1186651

1 0

openSUSE-SU-2021:2008-1: important: Security update for python-rsa
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for python-rsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2008-1 Rating: important References: #1172389 Cross-References: CVE-2020-13757 CVSS scores: CVE-2020-13757 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-13757 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-rsa fixes the following issues: - CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2008=1 Package List: - openSUSE Leap 15.3 (noarch): python2-rsa-3.4.2-3.4.1 python3-rsa-3.4.2-3.4.1 References: https://www.suse.com/security/cve/CVE-2020-13757.html https://bugzilla.suse.com/1172389

1 0

openSUSE-SU-2021:2005-1: important: Security update for jetty-minimal
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for jetty-minimal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2005-1 Rating: important References: #1184366 #1184367 #1184368 #1187117 Cross-References: CVE-2021-28163 CVE-2021-28164 CVE-2021-28165 CVE-2021-28169 CVSS scores: CVE-2021-28163 (NVD) : 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVE-2021-28163 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-28164 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-28164 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-28165 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28165 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28169 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-28169 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for jetty-minimal fixes the following issues: Update to version 9.4.42.v20210604 - Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory - Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408 - Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs - Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2005=1 Package List: - openSUSE Leap 15.3 (noarch): jetty-annotations-9.4.42-3.9.1 jetty-client-9.4.42-3.9.1 jetty-continuation-9.4.42-3.9.1 jetty-http-9.4.42-3.9.1 jetty-io-9.4.42-3.9.1 jetty-jaas-9.4.42-3.9.1 jetty-javax-websocket-client-impl-9.4.42-3.9.1 jetty-javax-websocket-server-impl-9.4.42-3.9.1 jetty-jmx-9.4.42-3.9.1 jetty-jndi-9.4.42-3.9.1 jetty-jsp-9.4.42-3.9.1 jetty-minimal-javadoc-9.4.42-3.9.1 jetty-openid-9.4.42-3.9.1 jetty-plus-9.4.42-3.9.1 jetty-proxy-9.4.42-3.9.1 jetty-security-9.4.42-3.9.1 jetty-server-9.4.42-3.9.1 jetty-servlet-9.4.42-3.9.1 jetty-util-9.4.42-3.9.1 jetty-util-ajax-9.4.42-3.9.1 jetty-webapp-9.4.42-3.9.1 jetty-websocket-api-9.4.42-3.9.1 jetty-websocket-client-9.4.42-3.9.1 jetty-websocket-common-9.4.42-3.9.1 jetty-websocket-javadoc-9.4.42-3.9.1 jetty-websocket-server-9.4.42-3.9.1 jetty-websocket-servlet-9.4.42-3.9.1 jetty-xml-9.4.42-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-28163.html https://www.suse.com/security/cve/CVE-2021-28164.html https://www.suse.com/security/cve/CVE-2021-28165.html https://www.suse.com/security/cve/CVE-2021-28169.html https://bugzilla.suse.com/1184366 https://bugzilla.suse.com/1184367 https://bugzilla.suse.com/1184368 https://bugzilla.suse.com/1187117

1 0

openSUSE-SU-2021:1961-1: important: Security update for squid
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1961-1 Rating: important References: #1171164 #1171569 #1183436 #1185916 #1185918 #1185919 #1185921 #1185923 Cross-References: CVE-2020-25097 CVE-2021-28651 CVE-2021-28652 CVE-2021-28662 CVE-2021-31806 CVSS scores: CVE-2020-25097 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2020-25097 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-28651 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28651 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H CVE-2021-28652 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-28652 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2021-28662 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-28662 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-31806 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-31806 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for squid fixes the following issues: - update to 4.15: - CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918) - CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921) - CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919) - CVE-2021-31806: Handle more Range requests (bsc#1185916) - CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436) - Handle more partial responses (bsc#1185923) - fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569). - use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164). - Reinstate permissions macros for pinger binary, because the permissions package is also responsible for setting up the cap_net_raw capability, currently a fresh squid install doesn't get a capability bit at all (bsc#1171569). - Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1961=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): squid-4.15-5.26.1 squid-debuginfo-4.15-5.26.1 squid-debugsource-4.15-5.26.1 References: https://www.suse.com/security/cve/CVE-2020-25097.html https://www.suse.com/security/cve/CVE-2021-28651.html https://www.suse.com/security/cve/CVE-2021-28652.html https://www.suse.com/security/cve/CVE-2021-28662.html https://www.suse.com/security/cve/CVE-2021-31806.html https://bugzilla.suse.com/1171164 https://bugzilla.suse.com/1171569 https://bugzilla.suse.com/1183436 https://bugzilla.suse.com/1185916 https://bugzilla.suse.com/1185918 https://bugzilla.suse.com/1185919 https://bugzilla.suse.com/1185921 https://bugzilla.suse.com/1185923

1 0

openSUSE-SU-2021:1655-1: important: Security update for fribidi
by opensuse-security＠opensuse.org 11 Jul '21

11 Jul '21

openSUSE Security Update: Security update for fribidi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1655-1 Rating: important References: #1156260 Cross-References: CVE-2019-18397 CVSS scores: CVE-2019-18397 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-18397 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fribidi fixes the following issues: Security issues fixed: - CVE-2019-18397: Avoid buffer overflow. (bsc#1156260) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1655=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fribidi-1.0.5-3.3.1 fribidi-debuginfo-1.0.5-3.3.1 fribidi-debugsource-1.0.5-3.3.1 fribidi-devel-1.0.5-3.3.1 libfribidi0-1.0.5-3.3.1 libfribidi0-debuginfo-1.0.5-3.3.1 - openSUSE Leap 15.3 (x86_64): libfribidi0-32bit-1.0.5-3.3.1 libfribidi0-32bit-debuginfo-1.0.5-3.3.1 References: https://www.suse.com/security/cve/CVE-2019-18397.html https://bugzilla.suse.com/1156260

1 0