August 2021 - openSUSE Security Announce

openSUSE-SU-2021:1169-1: important: Security update for tor
by opensuse-security＠opensuse.org 19 Aug '21

19 Aug '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1169-1 Rating: important References: #1189489 Cross-References: CVE-2021-38385 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: tor 0.4.6.7: * Fix a DoS via a remotely triggerable assertion failure (boo#1189489, TROVE-2021-007, CVE-2021-38385) tor 0.4.6.6: * Fix a compilation error with gcc 7, drop tor-0.4.6.5-gcc7.patch * Enable the deterministic RNG for unit tests that covers the address set bloomfilter-based API's tor 0.4.6.5 * Add controller support for creating v3 onion services with client auth * When voting on a relay with a Sybil-like appearance, add the Sybil flag when clearing out the other flags. This lets a relay operator know why their relay hasn't been included in the consensus * Relays now report how overloaded they are * Add a new DoS subsystem to control the rate of client connections for relays * Relays now publish statistics about v3 onions services * Improve circuit timeout algorithm for client performance Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1169=1 Package List: - openSUSE Leap 15.2 (x86_64): tor-0.4.6.7-lp152.2.15.1 tor-debuginfo-0.4.6.7-lp152.2.15.1 tor-debugsource-0.4.6.7-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-38385.html https://bugzilla.suse.com/1189489

1 0

openSUSE-SU-2021:1167-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 19 Aug '21

19 Aug '21

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1167-1 Rating: important References: #1189366 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for haproxy fixes the following issues: - Fixes HAProxy vulnerabilities on H2 (bsc#1189366). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1167=1 Package List: - openSUSE Leap 15.2 (x86_64): haproxy-2.0.14-lp152.2.3.1 haproxy-debuginfo-2.0.14-lp152.2.3.1 haproxy-debugsource-2.0.14-lp152.2.3.1 References: https://bugzilla.suse.com/1189366

1 0

openSUSE-SU-2021:2774-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Aug '21

19 Aug '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2774-1 Rating: important References: #1188891 SLE-18626 Cross-References: CVE-2021-29980 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29988 CVE-2021-29989 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities, contains one feature is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.13.0 ESR (MFSA 2021-34, bsc#1188891): - CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption - CVE-2021-29988: Memory corruption as a result of incorrect style treatment - CVE-2021-29984: Incorrect instruction reordering during JIT optimization - CVE-2021-29980: Uninitialized memory in a canvas object could have led to memory corruption - CVE-2021-29985: Use-after-free media channels - CVE-2021-29989: Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2774=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.13.0-8.49.1 MozillaFirefox-branding-upstream-78.13.0-8.49.1 MozillaFirefox-debuginfo-78.13.0-8.49.1 MozillaFirefox-debugsource-78.13.0-8.49.1 MozillaFirefox-devel-78.13.0-8.49.1 MozillaFirefox-translations-common-78.13.0-8.49.1 MozillaFirefox-translations-other-78.13.0-8.49.1 - openSUSE Leap 15.3 (x86_64): MozillaFirefox-buildsymbols-78.13.0-8.49.1 References: https://www.suse.com/security/cve/CVE-2021-29980.html https://www.suse.com/security/cve/CVE-2021-29984.html https://www.suse.com/security/cve/CVE-2021-29985.html https://www.suse.com/security/cve/CVE-2021-29986.html https://www.suse.com/security/cve/CVE-2021-29988.html https://www.suse.com/security/cve/CVE-2021-29989.html https://bugzilla.suse.com/1188891

1 0

openSUSE-SU-2021:2773-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 18 Aug '21

18 Aug '21

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2773-1 Rating: important References: #1189366 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for haproxy fixes the following issues: - Fixes HAProxy vulnerabilities on H2 (bsc#1189366). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2773=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): haproxy-2.0.14-11.7.1 haproxy-debuginfo-2.0.14-11.7.1 haproxy-debugsource-2.0.14-11.7.1 References: https://bugzilla.suse.com/1189366

1 0

openSUSE-SU-2021:2764-1: critical: Security update for libsndfile
by opensuse-security＠opensuse.org 17 Aug '21

17 Aug '21

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2764-1 Rating: critical References: #1100167 #1116993 #1117954 #1188540 Cross-References: CVE-2018-13139 CVE-2018-19432 CVE-2018-19758 CVE-2021-3246 CVSS scores: CVE-2018-13139 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-13139 (SUSE): 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-19432 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19432 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2018-19758 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19758 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3246 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3246 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libsndfile fixes the following issues: - CVE-2018-13139: Fixed a stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. (bsc#1100167) - CVE-2018-19432: Fixed a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service. (bsc#1116993) - CVE-2021-3246: Fixed a heap buffer overflow vulnerability in msadpcm_decode_block. (bsc#1188540) - CVE-2018-19758: Fixed a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of service. (bsc#1117954) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2764=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsndfile-debugsource-1.0.28-5.12.1 libsndfile-devel-1.0.28-5.12.1 libsndfile-progs-1.0.28-5.12.1 libsndfile-progs-debuginfo-1.0.28-5.12.1 libsndfile-progs-debugsource-1.0.28-5.12.1 libsndfile1-1.0.28-5.12.1 libsndfile1-debuginfo-1.0.28-5.12.1 - openSUSE Leap 15.3 (x86_64): libsndfile1-32bit-1.0.28-5.12.1 libsndfile1-32bit-debuginfo-1.0.28-5.12.1 References: https://www.suse.com/security/cve/CVE-2018-13139.html https://www.suse.com/security/cve/CVE-2018-19432.html https://www.suse.com/security/cve/CVE-2018-19758.html https://www.suse.com/security/cve/CVE-2021-3246.html https://bugzilla.suse.com/1100167 https://bugzilla.suse.com/1116993 https://bugzilla.suse.com/1117954 https://bugzilla.suse.com/1188540

1 0

openSUSE-SU-2021:2760-1: important: Security update for c-ares
by opensuse-security＠opensuse.org 17 Aug '21

17 Aug '21

openSUSE Security Update: Security update for c-ares ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2760-1 Rating: important References: #1188881 Cross-References: CVE-2021-3672 CVSS scores: CVE-2021-3672 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881) - If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash - Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response - Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing - Use unbuffered /dev/urandom for random data to prevent early startup performance issues Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2760=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): c-ares-debugsource-1.17.1+20200724-3.14.1 c-ares-devel-1.17.1+20200724-3.14.1 c-ares-utils-1.17.1+20200724-3.14.1 c-ares-utils-debuginfo-1.17.1+20200724-3.14.1 libcares2-1.17.1+20200724-3.14.1 libcares2-debuginfo-1.17.1+20200724-3.14.1 - openSUSE Leap 15.3 (x86_64): libcares2-32bit-1.17.1+20200724-3.14.1 libcares2-32bit-debuginfo-1.17.1+20200724-3.14.1 References: https://www.suse.com/security/cve/CVE-2021-3672.html https://bugzilla.suse.com/1188881

1 0

openSUSE-SU-2021:1162-1: moderate: Security update for SUSE Manager Client Tools
by opensuse-security＠opensuse.org 17 Aug '21

17 Aug '21

openSUSE Security Update: Security update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1162-1 Rating: moderate References: #1175478 #1186242 #1186508 #1186581 #1186650 #1188846 SLE-18254 Cross-References: CVE-2021-27962 CVE-2021-28146 CVE-2021-28147 CVE-2021-28148 CVE-2021-29622 CVSS scores: CVE-2021-27962 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE-2021-27962 (SUSE): 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-28148 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-29622 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities, contains one feature and has one errata is now available. Description: This update fixes the following issues: ansible: - The support level for ansible is l2, not l3 dracut-saltboot: - Force installation of libexpat.so.1 (bsc#1188846) - Use kernel parameters from PXE formula also for local boot golang-github-prometheus-prometheus: - Provide and reload firewalld configuration only for: + openSUSE Leap 15.0, 15.1, 15.2 + SUSE Linux Enterprise 15, 15 SP1, 15 SP2 - Upgrade to upstream version 2.27.1 (jsc#SLE-18254) + Bugfix: * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242) * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659 * TSDB: Do not panic when writing very large records to the WAL. #8790 * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723 * Scaleway Discovery: Fix nil pointer dereference. #8737 * Consul Discovery: Restart no longer required after config update with no targets. #8766 + Features: * Promtool: Retroactive rule evaluation functionality. * Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag. * Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances. * UI: Add a dark theme. * AWS Lightsail Discovery: Add AWS Lightsail Discovery. * Docker Discovery: Add Docker Service Discovery. * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. * Remote Write: Send exemplars via remote write. Experimental and disabled by default. + Enhancements: * Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label. * Scaleway Discovery: Read Scaleway secret from a file. * Scrape: Add configurable limits for label size and count. * UI: Add 16w and 26w time range steps. * Templating: Enable parsing strings in humanize functions. - Update package with changes from `server:monitoring` (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's `firewalld` package does not contain 'prometheus' configuration yet. mgr-cfg: - No visible impact for the user mgr-custom-info: - No visible impact for the user mgr-osad: - No visible impact for the user mgr-push: - No visible impact for the user mgr-virtualization: - No visible impact for the user rhnlib: - No visible impact for the user spacecmd: - Make spacecmd aware of retracted patches/packages - Enhance help for installation types when creating distributions (bsc#1186581) - Parse empty argument when nothing in between the separator spacewalk-client-tools: - Update translation strings spacewalk-koan: - Fix for spacewalk-koan tests after switching to the new Docker images spacewalk-oscap: - No visible impact for the user suseRegisterInfo: - No visible impact for the user uyuni-common-libs: - Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650) - Maintainer field in debian packages are only recommended (bsc#1186508) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1162=1 Package List: - openSUSE Leap 15.2 (x86_64): golang-github-prometheus-prometheus-2.27.1-lp152.3.13.1 - openSUSE Leap 15.2 (noarch): ansible-2.9.21-lp152.2.7.1 ansible-doc-2.9.21-lp152.2.7.1 ansible-test-2.9.21-lp152.2.7.1 dracut-saltboot-0.1.1627546504.96a0b3e-lp152.2.26.1 References: https://www.suse.com/security/cve/CVE-2021-27962.html https://www.suse.com/security/cve/CVE-2021-28146.html https://www.suse.com/security/cve/CVE-2021-28147.html https://www.suse.com/security/cve/CVE-2021-28148.html https://www.suse.com/security/cve/CVE-2021-29622.html https://bugzilla.suse.com/1175478 https://bugzilla.suse.com/1186242 https://bugzilla.suse.com/1186508 https://bugzilla.suse.com/1186581 https://bugzilla.suse.com/1186650 https://bugzilla.suse.com/1188846

1 0

openSUSE-SU-2021:2682-1: important: Security update for rpm
by opensuse-security＠opensuse.org 17 Aug '21

17 Aug '21

openSUSE Security Update: Security update for rpm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2682-1 Rating: important References: #1179416 #1181805 #1183543 #1183545 ECO-3622 SLE-17817 Cross-References: CVE-2021-20266 CVE-2021-20271 CVE-2021-3421 CVSS scores: CVE-2021-20266 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-20266 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-20271 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-20271 (SUSE): 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L CVE-2021-3421 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-3421 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities, contains two features and has one errata is now available. Description: This update for rpm fixes the following issues: - Changed default package verification level to 'none' to be compatible to rpm-4.14.1 - Made illegal obsoletes a warning - Fixed a potential access of freed mem in ndb's glue code (bsc#1179416) - Added support for enforcing signature policy and payload verification step to transactions (jsc#SLE-17817) - Added :humansi and :hmaniec query formatters for human readable output - Added query selectors for whatobsoletes and whatconflicts - Added support for sorting caret higher than base version - rpm does no longer require the signature header to be in a contiguous region when signing (bsc#1181805) Security fixes: - CVE-2021-3421: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity (bsc#1183543) - CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability (bsc#1183545) - CVE-2021-20266: A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2682=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-rpm-debugsource-4.14.3-37.2 python2-rpm-4.14.3-37.2 python2-rpm-debuginfo-4.14.3-37.2 python3-rpm-4.14.3-37.2 python3-rpm-debuginfo-4.14.3-37.2 rpm-4.14.3-37.2 rpm-build-4.14.3-37.2 rpm-build-debuginfo-4.14.3-37.2 rpm-debuginfo-4.14.3-37.2 rpm-debugsource-4.14.3-37.2 rpm-devel-4.14.3-37.2 rpm-ndb-4.14.3-37.2 rpm-ndb-debuginfo-4.14.3-37.2 rpm-ndb-debugsource-4.14.3-37.2 - openSUSE Leap 15.3 (x86_64): rpm-32bit-4.14.3-37.2 rpm-32bit-debuginfo-4.14.3-37.2 rpm-ndb-32bit-4.14.3-37.2 rpm-ndb-32bit-debuginfo-4.14.3-37.2 References: https://www.suse.com/security/cve/CVE-2021-20266.html https://www.suse.com/security/cve/CVE-2021-20271.html https://www.suse.com/security/cve/CVE-2021-3421.html https://bugzilla.suse.com/1179416 https://bugzilla.suse.com/1181805 https://bugzilla.suse.com/1183543 https://bugzilla.suse.com/1183545

1 0

openSUSE-SU-2021:2689-1: important: Security update for cpio
by opensuse-security＠opensuse.org 16 Aug '21

16 Aug '21

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2689-1 Rating: important References: #1189206 Cross-References: CVE-2021-38185 CVSS scores: CVE-2021-38185 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cpio fixes the following issues: It was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206) UPDATE: This update was buggy and could lead to hangs, so it has been retracted. There will be a follow up update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2689=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cpio-2.12-3.6.1 cpio-debuginfo-2.12-3.6.1 cpio-debugsource-2.12-3.6.1 cpio-mt-2.12-3.6.1 cpio-mt-debuginfo-2.12-3.6.1 - openSUSE Leap 15.3 (noarch): cpio-lang-2.12-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-38185.html https://bugzilla.suse.com/1189206

1 0

openSUSE-SU-2021:1158-1: moderate: Security update for openscad
by opensuse-security＠opensuse.org 15 Aug '21

15 Aug '21

openSUSE Security Update: Security update for openscad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1158-1 Rating: moderate References: #1185975 Cross-References: CVE-2020-28600 CVSS scores: CVE-2020-28600 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openscad fixes the following issues: - CVE-2020-28600: A specially crafted STL file could lead to code execution via out-of-bounds write in import_stl.cc:import_stl() (bsc#1185975) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1158=1 Package List: - openSUSE Backports SLE-15-SP2 (ppc64le s390x x86_64): openscad-2019.05-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-28600.html https://bugzilla.suse.com/1185975

1 0