August 2021 - openSUSE Security Announce

openSUSE-SU-2021:1177-1: Security update for libhts
by opensuse-security＠opensuse.org 22 Aug '21

22 Aug '21

openSUSE Security Update: Security update for libhts ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1177-1 Rating: low References: #1187917 Cross-References: CVE-2020-36403 CVSS scores: CVE-2020-36403 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libhts fixes the following security issue: - CVE-2020-36403: Fixed an out-of-bounds write access in vcf_parse_format() (bsc#1187917) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1177=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1177=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1177=1 Package List: - openSUSE Leap 15.2 (x86_64): bgzip-1.10.2-lp152.2.4.1 bgzip-debuginfo-1.10.2-lp152.2.4.1 htsfile-1.10.2-lp152.2.4.1 htsfile-debuginfo-1.10.2-lp152.2.4.1 libhts-debugsource-1.10.2-lp152.2.4.1 libhts-devel-1.10.2-lp152.2.4.1 libhts3-1.10.2-lp152.2.4.1 libhts3-debuginfo-1.10.2-lp152.2.4.1 tabix-1.10.2-lp152.2.4.1 tabix-debuginfo-1.10.2-lp152.2.4.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): bgzip-1.10.2-bp153.2.5.1 bgzip-debuginfo-1.10.2-bp153.2.5.1 htsfile-1.10.2-bp153.2.5.1 htsfile-debuginfo-1.10.2-bp153.2.5.1 libhts-debugsource-1.10.2-bp153.2.5.1 libhts-devel-1.10.2-bp153.2.5.1 libhts3-1.10.2-bp153.2.5.1 libhts3-debuginfo-1.10.2-bp153.2.5.1 tabix-1.10.2-bp153.2.5.1 tabix-debuginfo-1.10.2-bp153.2.5.1 - openSUSE Backports SLE-15-SP3 (aarch64_ilp32): libhts-devel-64bit-1.10.2-bp153.2.5.1 libhts3-64bit-1.10.2-bp153.2.5.1 libhts3-64bit-debuginfo-1.10.2-bp153.2.5.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): bgzip-1.10.2-bp152.2.4.1 bgzip-debuginfo-1.10.2-bp152.2.4.1 htsfile-1.10.2-bp152.2.4.1 htsfile-debuginfo-1.10.2-bp152.2.4.1 libhts-debugsource-1.10.2-bp152.2.4.1 libhts-devel-1.10.2-bp152.2.4.1 libhts3-1.10.2-bp152.2.4.1 libhts3-debuginfo-1.10.2-bp152.2.4.1 tabix-1.10.2-bp152.2.4.1 tabix-debuginfo-1.10.2-bp152.2.4.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libhts-devel-64bit-1.10.2-bp152.2.4.1 libhts3-64bit-1.10.2-bp152.2.4.1 libhts3-64bit-debuginfo-1.10.2-bp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-36403.html https://bugzilla.suse.com/1187917

1 0

openSUSE-SU-2021:1176-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 21 Aug '21

21 Aug '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1176-1 Rating: important References: #1185056 #1188564 #1188565 #1188566 Cross-References: CVE-2021-2161 CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 CVSS scores: CVE-2021-2161 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2161 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2341 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2341 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2369 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2369 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2388 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-2388 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u302 (icedtea 3.20.0) - CVE-2021-2341: Improve file transfers. (bsc#1188564) - CVE-2021-2369: Better jar file validation. (bsc#1188565) - CVE-2021-2388: Enhance compiler validation. (bsc#1188566) - CVE-2021-2161: Less ambiguous processing. (bsc#1185056) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1176=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-accessibility-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-debuginfo-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-debugsource-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-demo-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-devel-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-headless-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.302-lp152.2.15.1 java-1_8_0-openjdk-src-1.8.0.302-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.302-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-2161.html https://www.suse.com/security/cve/CVE-2021-2341.html https://www.suse.com/security/cve/CVE-2021-2369.html https://www.suse.com/security/cve/CVE-2021-2388.html https://bugzilla.suse.com/1185056 https://bugzilla.suse.com/1188564 https://bugzilla.suse.com/1188565 https://bugzilla.suse.com/1188566

1 0

openSUSE-SU-2021:1174-1: important: Security update for libass
by opensuse-security＠opensuse.org 21 Aug '21

21 Aug '21

openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1174-1 Rating: important References: #1188539 Cross-References: CVE-2020-36430 CVSS scores: CVE-2020-36430 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-36430 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-36430: Fixed heap-based buffer overflow in decode_chars (bsc#1188539). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1174=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libass-debugsource-0.14.0-lp152.4.9.1 libass-devel-0.14.0-lp152.4.9.1 libass9-0.14.0-lp152.4.9.1 libass9-debuginfo-0.14.0-lp152.4.9.1 - openSUSE Leap 15.2 (x86_64): libass9-32bit-0.14.0-lp152.4.9.1 libass9-32bit-debuginfo-0.14.0-lp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2020-36430.html https://bugzilla.suse.com/1188539

1 0

openSUSE-SU-2021:1173-1: moderate: Security update for prosody
by opensuse-security＠opensuse.org 21 Aug '21

21 Aug '21

openSUSE Security Update: Security update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1173-1 Rating: moderate References: #1188976 Cross-References: CVE-2021-37601 CVSS scores: CVE-2021-37601 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prosody fixes the following issues: prosody was updated to 0.11.10: Security: * MUC: Fix logic for access to affiliation lists CVE-2021-37601 (boo#1188976) https://prosody.im/security/advisory_20210722/ Minor changes: * prosodyctl: Add ��limits�� to known globals to warn about misplacing it * util.ip: Fix netmask for link-local address range * mod_pep: Remove obsolete node restoration code * util.pubsub: Fix traceback if node data not initialized Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1173=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): prosody-0.11.10-bp153.2.6.2 References: https://www.suse.com/security/cve/CVE-2021-37601.html https://bugzilla.suse.com/1188976

1 0

openSUSE-SU-2021:1172-1: important: Security update for chromium
by opensuse-security＠opensuse.org 21 Aug '21

21 Aug '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1172-1 Rating: important References: #1189490 Cross-References: CVE-2021-30598 CVE-2021-30599 CVE-2021-30600 CVE-2021-30601 CVE-2021-30602 CVE-2021-30603 CVE-2021-30604 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 92.0.4515.159 (boo#1189490): * CVE-2021-30598: Type Confusion in V8 * CVE-2021-30599: Type Confusion in V8 * CVE-2021-30600: Use after free in Printing * CVE-2021-30601: Use after free in Extensions API * CVE-2021-30602: Use after free in WebRTC * CVE-2021-30603: Race in WebAudio * CVE-2021-30604: Use after free in ANGLE * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1172=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-92.0.4515.159-lp152.2.122.1 chromedriver-debuginfo-92.0.4515.159-lp152.2.122.1 chromium-92.0.4515.159-lp152.2.122.1 chromium-debuginfo-92.0.4515.159-lp152.2.122.1 References: https://www.suse.com/security/cve/CVE-2021-30598.html https://www.suse.com/security/cve/CVE-2021-30599.html https://www.suse.com/security/cve/CVE-2021-30600.html https://www.suse.com/security/cve/CVE-2021-30601.html https://www.suse.com/security/cve/CVE-2021-30602.html https://www.suse.com/security/cve/CVE-2021-30603.html https://www.suse.com/security/cve/CVE-2021-30604.html https://bugzilla.suse.com/1189490

1 0

openSUSE-SU-2021:1170-1: moderate: Security update for isync
by opensuse-security＠opensuse.org 20 Aug '21

20 Aug '21

openSUSE Security Update: Security update for isync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1170-1 Rating: moderate References: #1186939 Cross-References: CVE-2021-3578 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for isync fixes the following issues: Update to version 1.3.6 * This is a security release that fixes CVE-2021-3578. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1170=1 Package List: - openSUSE Leap 15.2 (x86_64): isync-1.3.6-lp152.4.6.1 isync-debuginfo-1.3.6-lp152.4.6.1 isync-debugsource-1.3.6-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-3578.html https://bugzilla.suse.com/1186939

1 0

openSUSE-SU-2021:2798-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 20 Aug '21

20 Aug '21

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2798-1 Rating: important References: #1185056 #1188564 #1188565 #1188566 Cross-References: CVE-2021-2161 CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 CVSS scores: CVE-2021-2161 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2161 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-2341 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2341 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2369 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2369 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2388 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-2388 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u302 (icedtea 3.20.0) - CVE-2021-2341: Improve file transfers. (bsc#1188564) - CVE-2021-2369: Better jar file validation. (bsc#1188565) - CVE-2021-2388: Enhance compiler validation. (bsc#1188566) - CVE-2021-2161: Less ambiguous processing. (bsc#1185056) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2798=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.302-3.55.2 java-1_8_0-openjdk-accessibility-1.8.0.302-3.55.2 java-1_8_0-openjdk-debuginfo-1.8.0.302-3.55.2 java-1_8_0-openjdk-debugsource-1.8.0.302-3.55.2 java-1_8_0-openjdk-demo-1.8.0.302-3.55.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.302-3.55.2 java-1_8_0-openjdk-devel-1.8.0.302-3.55.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.302-3.55.2 java-1_8_0-openjdk-headless-1.8.0.302-3.55.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.302-3.55.2 java-1_8_0-openjdk-src-1.8.0.302-3.55.2 - openSUSE Leap 15.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.302-3.55.2 References: https://www.suse.com/security/cve/CVE-2021-2161.html https://www.suse.com/security/cve/CVE-2021-2341.html https://www.suse.com/security/cve/CVE-2021-2369.html https://www.suse.com/security/cve/CVE-2021-2388.html https://bugzilla.suse.com/1185056 https://bugzilla.suse.com/1188564 https://bugzilla.suse.com/1188565 https://bugzilla.suse.com/1188566

1 0

openSUSE-SU-2021:2794-1: important: Security update for aspell
by opensuse-security＠opensuse.org 20 Aug '21

20 Aug '21

openSUSE Security Update: Security update for aspell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2794-1 Rating: important References: #1177523 #1188576 Cross-References: CVE-2019-25051 CVSS scores: CVE-2019-25051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-25051 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for aspell fixes the following issues: - CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2794=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aspell-0.60.8-3.3.1 aspell-debuginfo-0.60.8-3.3.1 aspell-debugsource-0.60.8-3.3.1 aspell-devel-0.60.8-3.3.1 aspell-ispell-0.60.8-3.3.1 aspell-spell-0.60.8-3.3.1 libaspell15-0.60.8-3.3.1 libaspell15-debuginfo-0.60.8-3.3.1 libpspell15-0.60.8-3.3.1 libpspell15-debuginfo-0.60.8-3.3.1 - openSUSE Leap 15.3 (x86_64): libaspell15-32bit-0.60.8-3.3.1 libaspell15-32bit-debuginfo-0.60.8-3.3.1 libpspell15-32bit-0.60.8-3.3.1 libpspell15-32bit-debuginfo-0.60.8-3.3.1 References: https://www.suse.com/security/cve/CVE-2019-25051.html https://bugzilla.suse.com/1177523 https://bugzilla.suse.com/1188576

1 0

openSUSE-SU-2021:2787-1: moderate: Security update for go1.15
by opensuse-security＠opensuse.org 20 Aug '21

20 Aug '21

openSUSE Security Update: Security update for go1.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2787-1 Rating: moderate References: #1175132 #1188906 #1189162 Cross-References: CVE-2021-36221 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for go1.15 fixes the following issues: Update to go1.15.15: - go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162) - go#47347 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports - go#47014 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied. - go#46927 cmd/compile: register conflict between external linker and duffzero on arm64 - go#46857 runtime: ppc64x binaries randomly segfault on linux 5.13rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2787=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.15-1.15.15-1.39.1 go1.15-doc-1.15.15-1.39.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.15-race-1.15.15-1.39.1 References: https://www.suse.com/security/cve/CVE-2021-36221.html https://bugzilla.suse.com/1175132 https://bugzilla.suse.com/1188906 https://bugzilla.suse.com/1189162

1 0

openSUSE-SU-2021:2789-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 20 Aug '21

20 Aug '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2789-1 Rating: moderate References: #1180432 #1180433 #1180434 #1180435 #1182651 #1186012 #1189145 Cross-References: CVE-2020-35503 CVE-2020-35504 CVE-2020-35505 CVE-2020-35506 CVE-2021-20255 CVE-2021-3527 CVE-2021-3682 CVSS scores: CVE-2020-35503 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35503 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35504 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2020-35504 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35505 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2020-35506 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-35506 (SUSE): 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H CVE-2021-20255 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-20255 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3527 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3527 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2021-3682 (SUSE): 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682) - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506) - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503) - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255) - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2789=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-s390-4.2.1-11.28.1 qemu-s390-debuginfo-4.2.1-11.28.1 References: https://www.suse.com/security/cve/CVE-2020-35503.html https://www.suse.com/security/cve/CVE-2020-35504.html https://www.suse.com/security/cve/CVE-2020-35505.html https://www.suse.com/security/cve/CVE-2020-35506.html https://www.suse.com/security/cve/CVE-2021-20255.html https://www.suse.com/security/cve/CVE-2021-3527.html https://www.suse.com/security/cve/CVE-2021-3682.html https://bugzilla.suse.com/1180432 https://bugzilla.suse.com/1180433 https://bugzilla.suse.com/1180434 https://bugzilla.suse.com/1180435 https://bugzilla.suse.com/1182651 https://bugzilla.suse.com/1186012 https://bugzilla.suse.com/1189145

1 0