August 2021 - openSUSE Security Announce

openSUSE-SU-2021:1184-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1184-1 Rating: important References: #1188891 SLE-18626 Cross-References: CVE-2021-29980 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29988 CVE-2021-29989 CVSS scores: CVE-2021-29980 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-29984 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-29985 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29986 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-29988 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-29989 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities, contains one feature is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.13.0 ESR (MFSA 2021-34, bsc#1188891): - CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption - CVE-2021-29988: Memory corruption as a result of incorrect style treatment - CVE-2021-29984: Incorrect instruction reordering during JIT optimization - CVE-2021-29980: Uninitialized memory in a canvas object could have led to memory corruption - CVE-2021-29985: Use-after-free media channels - CVE-2021-29989: Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1184=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.13.0-lp152.2.64.1 MozillaFirefox-branding-upstream-78.13.0-lp152.2.64.1 MozillaFirefox-buildsymbols-78.13.0-lp152.2.64.1 MozillaFirefox-debuginfo-78.13.0-lp152.2.64.1 MozillaFirefox-debugsource-78.13.0-lp152.2.64.1 MozillaFirefox-devel-78.13.0-lp152.2.64.1 MozillaFirefox-translations-common-78.13.0-lp152.2.64.1 MozillaFirefox-translations-other-78.13.0-lp152.2.64.1 References: https://www.suse.com/security/cve/CVE-2021-29980.html https://www.suse.com/security/cve/CVE-2021-29984.html https://www.suse.com/security/cve/CVE-2021-29985.html https://www.suse.com/security/cve/CVE-2021-29986.html https://www.suse.com/security/cve/CVE-2021-29988.html https://www.suse.com/security/cve/CVE-2021-29989.html https://bugzilla.suse.com/1188891

1 0

openSUSE-SU-2021:1183-1: moderate: Security update for fetchmail
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1183-1 Rating: moderate References: #1188034 #1188875 Cross-References: CVE-2021-36386 CVSS scores: CVE-2021-36386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36386 (SUSE): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for fetchmail fixes the following issues: - CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875) - Change PASSWORDLEN from 64 to 256 (bsc#1188034) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1183=1 Package List: - openSUSE Leap 15.2 (x86_64): fetchmail-6.3.26-lp152.6.6.1 fetchmail-debuginfo-6.3.26-lp152.6.6.1 fetchmail-debugsource-6.3.26-lp152.6.6.1 fetchmailconf-6.3.26-lp152.6.6.1 References: https://www.suse.com/security/cve/CVE-2021-36386.html https://bugzilla.suse.com/1188034 https://bugzilla.suse.com/1188875

1 0

openSUSE-SU-2021:2817-1: moderate: Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2817-1 Rating: moderate References: #1102408 #1138715 #1138746 #1176389 #1177120 #1182421 #1182422 ECO-3352 PM-2485 Cross-References: CVE-2020-26137 CVSS scores: CVE-2020-26137 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-26137 (SUSE): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability, contains two features and has 6 fixes is now available. Description: This patch updates the Python AWS SDK stack in SLE 15: General: # aws-cli - Version updated to upstream release v1.19.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-boto3 - Version updated to upstream release 1.17.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-botocore - Version updated to upstream release 1.20.9 For a detailed list of all changes, please refer to the changelog file of this package. # python-urllib3 - Version updated to upstream release 1.25.10 For a detailed list of all changes, please refer to the changelog file of this package. # python-service_identity - Added this new package to resolve runtime dependencies for other packages. Version: 18.1.0 # python-trustme - Added this new package to resolve runtime dependencies for other packages. Version: 0.6.0 Security fixes: # python-urllib3: - CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest() (bsc#1177120) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2817=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-cffi-debuginfo-1.13.2-3.2.5 python-cffi-debugsource-1.13.2-3.2.5 python-cryptography-debuginfo-2.8-10.1 python-cryptography-debugsource-2.8-10.1 python2-cffi-1.13.2-3.2.5 python2-cffi-debuginfo-1.13.2-3.2.5 python2-cryptography-2.8-10.1 python2-cryptography-debuginfo-2.8-10.1 python3-cffi-1.13.2-3.2.5 python3-cffi-debuginfo-1.13.2-3.2.5 python3-cryptography-2.8-10.1 python3-cryptography-debuginfo-2.8-10.1 - openSUSE Leap 15.3 (noarch): aws-cli-1.19.9-26.1 python2-asn1crypto-0.24.0-3.2.1 python2-boto3-1.17.9-19.1 python2-botocore-1.20.9-33.1 python2-pyasn1-0.4.2-3.2.1 python2-pycparser-2.17-3.2.1 python2-urllib3-1.25.10-9.14.1 python3-asn1crypto-0.24.0-3.2.1 python3-boto3-1.17.9-19.1 python3-botocore-1.20.9-33.1 python3-pyasn1-0.4.2-3.2.1 python3-pycparser-2.17-3.2.1 References: https://www.suse.com/security/cve/CVE-2020-26137.html https://bugzilla.suse.com/1102408 https://bugzilla.suse.com/1138715 https://bugzilla.suse.com/1138746 https://bugzilla.suse.com/1176389 https://bugzilla.suse.com/1177120 https://bugzilla.suse.com/1182421 https://bugzilla.suse.com/1182422

1 0

openSUSE-SU-2021:1181-1: important: Security update for aspell
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for aspell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1181-1 Rating: important References: #1177523 #1188576 Cross-References: CVE-2019-25051 CVSS scores: CVE-2019-25051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-25051 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for aspell fixes the following issues: - CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1181=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): aspell-0.60.8-lp152.2.3.1 aspell-debuginfo-0.60.8-lp152.2.3.1 aspell-debugsource-0.60.8-lp152.2.3.1 aspell-devel-0.60.8-lp152.2.3.1 aspell-ispell-0.60.8-lp152.2.3.1 aspell-spell-0.60.8-lp152.2.3.1 libaspell15-0.60.8-lp152.2.3.1 libaspell15-debuginfo-0.60.8-lp152.2.3.1 libpspell15-0.60.8-lp152.2.3.1 libpspell15-debuginfo-0.60.8-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libaspell15-32bit-0.60.8-lp152.2.3.1 libaspell15-32bit-debuginfo-0.60.8-lp152.2.3.1 libpspell15-32bit-0.60.8-lp152.2.3.1 libpspell15-32bit-debuginfo-0.60.8-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-25051.html https://bugzilla.suse.com/1177523 https://bugzilla.suse.com/1188576

1 0

openSUSE-SU-2021:1182-1: important: Security update for krb5
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1182-1 Rating: important References: #1188571 Cross-References: CVE-2021-36222 CVSS scores: CVE-2021-36222 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following issues: - CVE-2021-36222: Fixed KDC null deref on bad encrypted challenge. (bsc#1188571) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1182=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): krb5-1.16.3-lp152.5.19.1 krb5-client-1.16.3-lp152.5.19.1 krb5-client-debuginfo-1.16.3-lp152.5.19.1 krb5-debuginfo-1.16.3-lp152.5.19.1 krb5-debugsource-1.16.3-lp152.5.19.1 krb5-devel-1.16.3-lp152.5.19.1 krb5-mini-1.16.3-lp152.5.19.1 krb5-mini-debuginfo-1.16.3-lp152.5.19.1 krb5-mini-debugsource-1.16.3-lp152.5.19.1 krb5-mini-devel-1.16.3-lp152.5.19.1 krb5-plugin-kdb-ldap-1.16.3-lp152.5.19.1 krb5-plugin-kdb-ldap-debuginfo-1.16.3-lp152.5.19.1 krb5-plugin-preauth-otp-1.16.3-lp152.5.19.1 krb5-plugin-preauth-otp-debuginfo-1.16.3-lp152.5.19.1 krb5-plugin-preauth-pkinit-1.16.3-lp152.5.19.1 krb5-plugin-preauth-pkinit-debuginfo-1.16.3-lp152.5.19.1 krb5-server-1.16.3-lp152.5.19.1 krb5-server-debuginfo-1.16.3-lp152.5.19.1 - openSUSE Leap 15.2 (x86_64): krb5-32bit-1.16.3-lp152.5.19.1 krb5-32bit-debuginfo-1.16.3-lp152.5.19.1 krb5-devel-32bit-1.16.3-lp152.5.19.1 References: https://www.suse.com/security/cve/CVE-2021-36222.html https://bugzilla.suse.com/1188571

1 0

openSUSE-SU-2021:1180-1: important: Security update for chromium
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1180-1 Rating: important References: #1189490 Cross-References: CVE-2021-30598 CVE-2021-30599 CVE-2021-30600 CVE-2021-30601 CVE-2021-30602 CVE-2021-30603 CVE-2021-30604 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 92.0.4515.159 (boo#1189490): * CVE-2021-30598: Type Confusion in V8 * CVE-2021-30599: Type Confusion in V8 * CVE-2021-30600: Use after free in Printing * CVE-2021-30601: Use after free in Extensions API * CVE-2021-30602: Use after free in WebRTC * CVE-2021-30603: Race in WebAudio * CVE-2021-30604: Use after free in ANGLE * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1180=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-92.0.4515.159-bp153.2.25.1 chromium-92.0.4515.159-bp153.2.25.1 References: https://www.suse.com/security/cve/CVE-2021-30598.html https://www.suse.com/security/cve/CVE-2021-30599.html https://www.suse.com/security/cve/CVE-2021-30600.html https://www.suse.com/security/cve/CVE-2021-30601.html https://www.suse.com/security/cve/CVE-2021-30602.html https://www.suse.com/security/cve/CVE-2021-30603.html https://www.suse.com/security/cve/CVE-2021-30604.html https://bugzilla.suse.com/1189490

1 0

openSUSE-SU-2021:2809-1: moderate: Security update for systemd
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2809-1 Rating: moderate References: #1166028 #1171962 #1184994 #1185972 #1188063 Cross-References: CVE-2020-13529 CVE-2021-33910 CVSS scores: CVE-2020-13529 (NVD) : 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2020-13529 (SUSE): 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2021-33910 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33910 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for systemd fixes the following issues: - Updated to version 246.15 - CVE-2021-33910: Fixed a denial of service issue in systemd. (bsc#1188063) - CVE-2020-13529: Fixed an issue that allows crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. (bsc#1185972) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2809=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsystemd0-246.15-7.11.1 libsystemd0-debuginfo-246.15-7.11.1 libudev-devel-246.15-7.11.1 libudev1-246.15-7.11.1 libudev1-debuginfo-246.15-7.11.1 nss-myhostname-246.15-7.11.1 nss-myhostname-debuginfo-246.15-7.11.1 nss-mymachines-246.15-7.11.1 nss-mymachines-debuginfo-246.15-7.11.1 nss-resolve-246.15-7.11.1 nss-resolve-debuginfo-246.15-7.11.1 nss-systemd-246.15-7.11.1 nss-systemd-debuginfo-246.15-7.11.1 systemd-246.15-7.11.1 systemd-container-246.15-7.11.1 systemd-container-debuginfo-246.15-7.11.1 systemd-coredump-246.15-7.11.1 systemd-coredump-debuginfo-246.15-7.11.1 systemd-debuginfo-246.15-7.11.1 systemd-debugsource-246.15-7.11.1 systemd-devel-246.15-7.11.1 systemd-doc-246.15-7.11.1 systemd-journal-remote-246.15-7.11.1 systemd-journal-remote-debuginfo-246.15-7.11.1 systemd-logger-246.15-7.11.1 systemd-network-246.15-7.11.1 systemd-network-debuginfo-246.15-7.11.1 systemd-sysvinit-246.15-7.11.1 udev-246.15-7.11.1 udev-debuginfo-246.15-7.11.1 - openSUSE Leap 15.3 (x86_64): libsystemd0-32bit-246.15-7.11.1 libsystemd0-32bit-debuginfo-246.15-7.11.1 libudev-devel-32bit-246.15-7.11.1 libudev1-32bit-246.15-7.11.1 libudev1-32bit-debuginfo-246.15-7.11.1 nss-myhostname-32bit-246.15-7.11.1 nss-myhostname-32bit-debuginfo-246.15-7.11.1 nss-mymachines-32bit-246.15-7.11.1 nss-mymachines-32bit-debuginfo-246.15-7.11.1 systemd-32bit-246.15-7.11.1 systemd-32bit-debuginfo-246.15-7.11.1 - openSUSE Leap 15.3 (noarch): systemd-lang-246.15-7.11.1 References: https://www.suse.com/security/cve/CVE-2020-13529.html https://www.suse.com/security/cve/CVE-2021-33910.html https://bugzilla.suse.com/1166028 https://bugzilla.suse.com/1171962 https://bugzilla.suse.com/1184994 https://bugzilla.suse.com/1185972 https://bugzilla.suse.com/1188063

1 0

openSUSE-SU-2021:2812-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2812-1 Rating: moderate References: #1184253 #1187871 #1188232 #1188843 Cross-References: CVE-2021-3631 CVE-2021-3667 CVSS scores: CVE-2021-3631 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-3667 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for libvirt fixes the following issues: Security issues fixed: - CVE-2021-3631: fix SELinux label generation logic (bsc#1187871) - CVE-2021-3667: Unlock object on ACL fail in storagePoolLookupByTargetPath (bsc#1188843) Non-security issues fixed: - virtlockd: Don't report error if lockspace exists (bsc#1184253) - Don't forcibly remove '--listen' arg from /etc/sysconfig/libvirtd. Add '--timeout 120' if '--listen' is not specified. (bsc#1188232) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2812=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libvirt-7.1.0-6.5.1 libvirt-admin-7.1.0-6.5.1 libvirt-admin-debuginfo-7.1.0-6.5.1 libvirt-client-7.1.0-6.5.1 libvirt-client-debuginfo-7.1.0-6.5.1 libvirt-daemon-7.1.0-6.5.1 libvirt-daemon-config-network-7.1.0-6.5.1 libvirt-daemon-config-nwfilter-7.1.0-6.5.1 libvirt-daemon-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-interface-7.1.0-6.5.1 libvirt-daemon-driver-interface-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-lxc-7.1.0-6.5.1 libvirt-daemon-driver-lxc-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-network-7.1.0-6.5.1 libvirt-daemon-driver-network-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-nodedev-7.1.0-6.5.1 libvirt-daemon-driver-nodedev-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-nwfilter-7.1.0-6.5.1 libvirt-daemon-driver-nwfilter-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-qemu-7.1.0-6.5.1 libvirt-daemon-driver-qemu-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-secret-7.1.0-6.5.1 libvirt-daemon-driver-secret-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-7.1.0-6.5.1 libvirt-daemon-driver-storage-core-7.1.0-6.5.1 libvirt-daemon-driver-storage-core-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-disk-7.1.0-6.5.1 libvirt-daemon-driver-storage-disk-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-gluster-7.1.0-6.5.1 libvirt-daemon-driver-storage-gluster-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-iscsi-7.1.0-6.5.1 libvirt-daemon-driver-storage-iscsi-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-iscsi-direct-7.1.0-6.5.1 libvirt-daemon-driver-storage-iscsi-direct-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-logical-7.1.0-6.5.1 libvirt-daemon-driver-storage-logical-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-mpath-7.1.0-6.5.1 libvirt-daemon-driver-storage-mpath-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-storage-scsi-7.1.0-6.5.1 libvirt-daemon-driver-storage-scsi-debuginfo-7.1.0-6.5.1 libvirt-daemon-hooks-7.1.0-6.5.1 libvirt-daemon-lxc-7.1.0-6.5.1 libvirt-daemon-qemu-7.1.0-6.5.1 libvirt-debugsource-7.1.0-6.5.1 libvirt-devel-7.1.0-6.5.1 libvirt-libs-7.1.0-6.5.1 libvirt-libs-debuginfo-7.1.0-6.5.1 libvirt-lock-sanlock-7.1.0-6.5.1 libvirt-lock-sanlock-debuginfo-7.1.0-6.5.1 libvirt-nss-7.1.0-6.5.1 libvirt-nss-debuginfo-7.1.0-6.5.1 wireshark-plugin-libvirt-7.1.0-6.5.1 wireshark-plugin-libvirt-debuginfo-7.1.0-6.5.1 - openSUSE Leap 15.3 (aarch64 x86_64): libvirt-daemon-driver-storage-rbd-7.1.0-6.5.1 libvirt-daemon-driver-storage-rbd-debuginfo-7.1.0-6.5.1 - openSUSE Leap 15.3 (noarch): libvirt-bash-completion-7.1.0-6.5.1 libvirt-doc-7.1.0-6.5.1 - openSUSE Leap 15.3 (x86_64): libvirt-client-32bit-debuginfo-7.1.0-6.5.1 libvirt-daemon-driver-libxl-7.1.0-6.5.1 libvirt-daemon-driver-libxl-debuginfo-7.1.0-6.5.1 libvirt-daemon-xen-7.1.0-6.5.1 libvirt-devel-32bit-7.1.0-6.5.1 References: https://www.suse.com/security/cve/CVE-2021-3631.html https://www.suse.com/security/cve/CVE-2021-3667.html https://bugzilla.suse.com/1184253 https://bugzilla.suse.com/1187871 https://bugzilla.suse.com/1188232 https://bugzilla.suse.com/1188843

1 0

openSUSE-SU-2021:2810-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2810-1 Rating: moderate References: #1172505 Cross-References: CVE-2020-12049 CVSS scores: CVE-2020-12049 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-12049 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dbus-1 fixes the following issues: - CVE-2020-12049: truncated messages lead to resource exhaustion. (bsc#1172505) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2810=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-8.11.2 dbus-1-debuginfo-1.12.2-8.11.2 dbus-1-debugsource-1.12.2-8.11.2 dbus-1-devel-1.12.2-8.11.2 dbus-1-x11-1.12.2-8.11.1 dbus-1-x11-debuginfo-1.12.2-8.11.1 dbus-1-x11-debugsource-1.12.2-8.11.1 libdbus-1-3-1.12.2-8.11.2 libdbus-1-3-debuginfo-1.12.2-8.11.2 - openSUSE Leap 15.3 (x86_64): dbus-1-32bit-debuginfo-1.12.2-8.11.2 dbus-1-devel-32bit-1.12.2-8.11.2 libdbus-1-3-32bit-1.12.2-8.11.2 libdbus-1-3-32bit-debuginfo-1.12.2-8.11.2 - openSUSE Leap 15.3 (noarch): dbus-1-devel-doc-1.12.2-8.11.2 References: https://www.suse.com/security/cve/CVE-2020-12049.html https://bugzilla.suse.com/1172505

1 0

openSUSE-SU-2021:1178-1: important: Security update for tor
by opensuse-security＠opensuse.org 23 Aug '21

23 Aug '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1178-1 Rating: important References: #1189489 Cross-References: CVE-2021-38385 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: tor 0.4.6.7: * Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385) tor 0.4.6.6: * Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch * Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's tor 0.4.6.5 * Add controller support for creating v3 onion services with client auth * When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus * Relays now report how overloaded they are * Add a new DoS subsystem to control the rate of client connections for relays * Relays now publish statistics about v3 onions services * Improve circuit timeout algorithm for client performance This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1178=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.6.7-bp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-38385.html https://bugzilla.suse.com/1189489

1 0