September 2021 - openSUSE Security Announce

openSUSE-SU-2021:1255-1: important: Security update for nextcloud
by opensuse-security＠opensuse.org 14 Sep '21

14 Sep '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1255-1 Rating: important References: #1190291 Cross-References: CVE-2021-32766 CVE-2021-32800 CVE-2021-32801 CVE-2021-32802 CVSS scores: CVE-2021-32800 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-32801 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-32802 (NVD) : 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo#1190291 - CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information - CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function - CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File - CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere Changes - Bump vue-router from 3.4.3 to 3.4.9 (server#27224) - Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232) - Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236) - Bump debounce from 1.2.0 to 1.2.1 (server#27646) - Bump vue and vue-template-compiler (server#27701) - Design fixes to app-settings button (server#27745) - Reset checksum when writing files to object store (server#27754) - Run s3 tests again (server#27804) - Fix in locking cache check (server#27829) - Bump dompurify from 2.2.8 to 2.2.9 (server#27836) - Make search popup usable on mobile, too (server#27858) - Cache images on browser (server#27863) - Fix dark theme on public link shares (server#27895) - Make user status usable on mobile (server#27897) - Do not escape display name in dashboard welcome text (server#27913) - Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924) - Fix newfileMenu on public page (server#27941) - Fix svg icons disapearing in app navigation when text overflows (server#27955) - Bump bootstrap from 4.5.2 to 4.5.3 (server#27965) - Show registered breadcrumb detail views in breadcrumb menu (server#27970) - Fix regression in file sidebar (server#27976) - Bump exports-loader from 1.1.0 to 1.1.1 (server#27984) - Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985) - Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988) - Improve notcreatable permissions hint (server#28006) - Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018) - Bump sass-loader from 10.0.2 to 10.0.5 (server#28032) - Increase footer height for longer menus (server#28045) - Mask password for Redis and RedisCluster on connection failure (server#28054) - Fix missing theming for login button (server#28065) - Fix overlapping of elements in certain views (server#28072) - Disable HEIC image preview provider for performance concerns (server#28081) - Improve provider check (server#28087) - Sanitize more functions from the encryption app (server#28091) - Hide download button for public preview of audio files (server#28096) - L10n: HTTP in capital letters (server#28107) - Fix dark theme in file exists dialog (server#28111) - Let memory limit set in tests fit the used amount (server#28125) - User management - Add icon to user groups (server#28172) - Bump marked from 1.1.1 to 1.1.2 (server#28187) - Fix variable override in file view (server#28191) - Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207) - Bump url-loader from 4.1.0 to 4.1.1 (server#28208) - Fix Files breadcrumbs being hidden even if there is enough space (server#28224) - Dont apply jail search filter is on the root (server#28241) - Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289) - Fix preference name when generating notifications (activity#603) - Fix monochrome icon detection for correct dark mode invert (activity#607) - Fix "Enable notification emails" (activity#613) - Show add, del and restored files within by and self filter (activity#616) - Link from app-navigation-settings to personal settings (activity#625) - Fix pdfviewer design (files_pdfviewer#446) - Include version number in firstrunwizard (firstrunwizard#570) - Use notification main link if no parameter has a link (notifications#1040) - Bump sass-loader from 10.1.0 to 10.1.1 (text#1360) - Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548) - Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550) - Bump vue-loader from 15.9.6 to 15.9.7 (text#1592) - Unify error responses and add logging where appropriate (text#1719) - Disable header timeout on mobile (viewer#978) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1255=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): nextcloud-20.0.12-bp153.2.6.1 nextcloud-apache-20.0.12-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-32766.html https://www.suse.com/security/cve/CVE-2021-32800.html https://www.suse.com/security/cve/CVE-2021-32801.html https://www.suse.com/security/cve/CVE-2021-32802.html https://bugzilla.suse.com/1190291

1 0

openSUSE-SU-2021:1253-1: important: Security update for nextcloud
by opensuse-security＠opensuse.org 14 Sep '21

14 Sep '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1253-1 Rating: important References: #1190291 Cross-References: CVE-2021-32766 CVE-2021-32800 CVE-2021-32801 CVE-2021-32802 CVSS scores: CVE-2021-32800 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-32801 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-32802 (NVD) : 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo#1190291 - CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information - CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function - CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File - CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere Changes: - Bump vue-router from 3.4.3 to 3.4.9 (server#27224) - Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232) - Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236) - Bump debounce from 1.2.0 to 1.2.1 (server#27646) - Bump vue and vue-template-compiler (server#27701) - Design fixes to app-settings button (server#27745) - Reset checksum when writing files to object store (server#27754) - Run s3 tests again (server#27804) - Fix in locking cache check (server#27829) - Bump dompurify from 2.2.8 to 2.2.9 (server#27836) - Make search popup usable on mobile, too (server#27858) - Cache images on browser (server#27863) - Fix dark theme on public link shares (server#27895) - Make user status usable on mobile (server#27897) - Do not escape display name in dashboard welcome text (server#27913) - Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924) - Fix newfileMenu on public page (server#27941) - Fix svg icons disapearing in app navigation when text overflows (server#27955) - Bump bootstrap from 4.5.2 to 4.5.3 (server#27965) - Show registered breadcrumb detail views in breadcrumb menu (server#27970) - Fix regression in file sidebar (server#27976) - Bump exports-loader from 1.1.0 to 1.1.1 (server#27984) - Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985) - Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988) - Improve notcreatable permissions hint (server#28006) - Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018) - Bump sass-loader from 10.0.2 to 10.0.5 (server#28032) - Increase footer height for longer menus (server#28045) - Mask password for Redis and RedisCluster on connection failure (server#28054) - Fix missing theming for login button (server#28065) - Fix overlapping of elements in certain views (server#28072) - Disable HEIC image preview provider for performance concerns (server#28081) - Improve provider check (server#28087) - Sanitize more functions from the encryption app (server#28091) - Hide download button for public preview of audio files (server#28096) - L10n: HTTP in capital letters (server#28107) - Fix dark theme in file exists dialog (server#28111) - Let memory limit set in tests fit the used amount (server#28125) - User management - Add icon to user groups (server#28172) - Bump marked from 1.1.1 to 1.1.2 (server#28187) - Fix variable override in file view (server#28191) - Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207) - Bump url-loader from 4.1.0 to 4.1.1 (server#28208) - Fix Files breadcrumbs being hidden even if there is enough space (server#28224) - Dont apply jail search filter is on the root (server#28241) - Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289) - Fix preference name when generating notifications (activity#603) - Fix monochrome icon detection for correct dark mode invert (activity#607) - Fix "Enable notification emails" (activity#613) - Show add, del and restored files within by and self filter (activity#616) - Link from app-navigation-settings to personal settings (activity#625) - Fix pdfviewer design (files_pdfviewer#446) - Include version number in firstrunwizard (firstrunwizard#570) - Use notification main link if no parameter has a link (notifications#1040) - Bump sass-loader from 10.1.0 to 10.1.1 (text#1360) - Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548) - Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550) - Bump vue-loader from 15.9.6 to 15.9.7 (text#1592) - Unify error responses and add logging where appropriate (text#1719) - Disable header timeout on mobile (viewer#978) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1253=1 Package List: - openSUSE Leap 15.2 (noarch): nextcloud-20.0.12-lp152.3.12.1 nextcloud-apache-20.0.12-lp152.3.12.1 References: https://www.suse.com/security/cve/CVE-2021-32766.html https://www.suse.com/security/cve/CVE-2021-32800.html https://www.suse.com/security/cve/CVE-2021-32801.html https://www.suse.com/security/cve/CVE-2021-32802.html https://bugzilla.suse.com/1190291

1 0

openSUSE-SU-2021:1250-1: important: Security update for nextcloud
by opensuse-security＠opensuse.org 13 Sep '21

13 Sep '21

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1250-1 Rating: important References: #1190291 Cross-References: CVE-2021-32766 CVE-2021-32800 CVE-2021-32801 CVE-2021-32802 CVSS scores: CVE-2021-32800 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-32801 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-32802 (NVD) : 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo#1190291: - CVE-2021-32766 (CWE-209): Generation of Error Message Containing Sensitive Information - CVE-2021-32800 (CWE-306): Missing Authentication for Critical Function - CVE-2021-32801 (CWE-532): Insertion of Sensitive Information into Log File - CVE-2021-32802 (CWE-829): Inclusion of Functionality from Untrusted Control Sphere Changes - Bump vue-router from 3.4.3 to 3.4.9 (server#27224) - Bump v-click-outside from 3.1.1 to 3.1.2 (server#27232) - Bump url-search-params-polyfill from 8.1.0 to 8.1.1 (server#27236) - Bump debounce from 1.2.0 to 1.2.1 (server#27646) - Bump vue and vue-template-compiler (server#27701) - Design fixes to app-settings button (server#27745) - Reset checksum when writing files to object store (server#27754) - Run s3 tests again (server#27804) - Fix in locking cache check (server#27829) - Bump dompurify from 2.2.8 to 2.2.9 (server#27836) - Make search popup usable on mobile, too (server#27858) - Cache images on browser (server#27863) - Fix dark theme on public link shares (server#27895) - Make user status usable on mobile (server#27897) - Do not escape display name in dashboard welcome text (server#27913) - Bump moment-timezone from 0.5.31 to 0.5.33 (server#27924) - Fix newfileMenu on public page (server#27941) - Fix svg icons disapearing in app navigation when text overflows (server#27955) - Bump bootstrap from 4.5.2 to 4.5.3 (server#27965) - Show registered breadcrumb detail views in breadcrumb menu (server#27970) - Fix regression in file sidebar (server#27976) - Bump exports-loader from 1.1.0 to 1.1.1 (server#27984) - Bump @nextcloud/capabilities from 1.0.2 to 1.0.4 (server#27985) - Bump @nextcloud/vue-dashboard from 1.0.0 to 1.0.1 (server#27988) - Improve notcreatable permissions hint (server#28006) - Update CRL due to revoked twofactor_nextcloud_notification.crt (server#28018) - Bump sass-loader from 10.0.2 to 10.0.5 (server#28032) - Increase footer height for longer menus (server#28045) - Mask password for Redis and RedisCluster on connection failure (server#28054) - Fix missing theming for login button (server#28065) - Fix overlapping of elements in certain views (server#28072) - Disable HEIC image preview provider for performance concerns (server#28081) - Improve provider check (server#28087) - Sanitize more functions from the encryption app (server#28091) - Hide download button for public preview of audio files (server#28096) - L10n: HTTP in capital letters (server#28107) - Fix dark theme in file exists dialog (server#28111) - Let memory limit set in tests fit the used amount (server#28125) - User management - Add icon to user groups (server#28172) - Bump marked from 1.1.1 to 1.1.2 (server#28187) - Fix variable override in file view (server#28191) - Bump regenerator-runtime from 0.13.7 to 0.13.9 (server#28207) - Bump url-loader from 4.1.0 to 4.1.1 (server#28208) - Fix Files breadcrumbs being hidden even if there is enough space (server#28224) - Dont apply jail search filter is on the root (server#28241) - Check that php was compiled with argon2 support or that the php-sodium extensions is installed (server#28289) - Fix preference name when generating notifications (activity#603) - Fix monochrome icon detection for correct dark mode invert (activity#607) - Fix "Enable notification emails" (activity#613) - Show add, del and restored files within by and self filter (activity#616) - Link from app-navigation-settings to personal settings (activity#625) - Fix pdfviewer design (files_pdfviewer#446) - Include version number in firstrunwizard (firstrunwizard#570) - Use notification main link if no parameter has a link (notifications#1040) - Bump sass-loader from 10.1.0 to 10.1.1 (text#1360) - Bump @babel/plugin-transform-runtime from 7.13.9 to 7.13.15 (text#1548) - Bump @babel/preset-env from 7.13.9 to 7.13.15 (text#1550) - Bump vue-loader from 15.9.6 to 15.9.7 (text#1592) - Unify error responses and add logging where appropriate (text#1719) - Disable header timeout on mobile (viewer#978) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1250=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-20.0.12-bp151.3.18.1 nextcloud-apache-20.0.12-bp151.3.18.1 References: https://www.suse.com/security/cve/CVE-2021-32766.html https://www.suse.com/security/cve/CVE-2021-32800.html https://www.suse.com/security/cve/CVE-2021-32801.html https://www.suse.com/security/cve/CVE-2021-32802.html https://bugzilla.suse.com/1190291

1 0

openSUSE-SU-2021:1249-1: moderate: Security update for gifsicle
by opensuse-security＠opensuse.org 13 Sep '21

13 Sep '21

openSUSE Security Update: Security update for gifsicle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1249-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gifsicle fixes the following issues: Update to version 1.93: * Fix security bug on certain resize operations with `--resize-method=box` * Fix problems with colormapless GIFs. Update to version 1.92 * Add `--lossy` option from Kornel Lipi��ski. * Remove an assertion failure possible with `--conserve-memory` + `--colors` + `--careful`. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1249=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1249=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1249=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1249=1 Package List: - openSUSE Leap 15.2 (x86_64): gifsicle-1.93-lp152.5.3.1 gifsicle-debuginfo-1.93-lp152.5.3.1 gifsicle-debugsource-1.93-lp152.5.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): gifsicle-1.93-bp153.2.3.1 gifsicle-debuginfo-1.93-bp153.2.3.1 gifsicle-debugsource-1.93-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): gifsicle-1.93-bp152.4.3.1 gifsicle-debuginfo-1.93-bp152.4.3.1 gifsicle-debugsource-1.93-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): gifsicle-1.93-bp151.4.3.1 References:

1 0

openSUSE-SU-2021:3017-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 13 Sep '21

13 Sep '21

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3017-1 Rating: moderate References: #1188375 Cross-References: CVE-2021-22235 CVSS scores: CVE-2021-22235 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wireshark fixes the following issues: - Update to Wireshark 3.4.7 - CVE-2021-22235: Fixed DNP dissector crash (bsc#1188375). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3017=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwireshark14-3.4.7-3.59.1 libwireshark14-debuginfo-3.4.7-3.59.1 libwiretap11-3.4.7-3.59.1 libwiretap11-debuginfo-3.4.7-3.59.1 libwsutil12-3.4.7-3.59.1 libwsutil12-debuginfo-3.4.7-3.59.1 wireshark-3.4.7-3.59.1 wireshark-debuginfo-3.4.7-3.59.1 wireshark-debugsource-3.4.7-3.59.1 wireshark-devel-3.4.7-3.59.1 wireshark-ui-qt-3.4.7-3.59.1 wireshark-ui-qt-debuginfo-3.4.7-3.59.1 References: https://www.suse.com/security/cve/CVE-2021-22235.html https://bugzilla.suse.com/1188375

1 0

openSUSE-SU-2021:3020-1: moderate: Security update for apache2-mod_auth_openidc
by opensuse-security＠opensuse.org 13 Sep '21

13 Sep '21

openSUSE Security Update: Security update for apache2-mod_auth_openidc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3020-1 Rating: moderate References: #1188638 #1188639 #1188848 #1188849 Cross-References: CVE-2021-32785 CVE-2021-32786 CVE-2021-32791 CVE-2021-32792 CVSS scores: CVE-2021-32785 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32786 (SUSE): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVE-2021-32791 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-32792 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for apache2-mod_auth_openidc fixes the following issues: - CVE-2021-32785: format string bug via hiredis (bsc#1188638) - CVE-2021-32786: open redirect in logout functionality (bsc#1188639) - CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849) - CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3020=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_auth_openidc-2.3.8-3.15.1 apache2-mod_auth_openidc-debuginfo-2.3.8-3.15.1 apache2-mod_auth_openidc-debugsource-2.3.8-3.15.1 References: https://www.suse.com/security/cve/CVE-2021-32785.html https://www.suse.com/security/cve/CVE-2021-32786.html https://www.suse.com/security/cve/CVE-2021-32791.html https://www.suse.com/security/cve/CVE-2021-32792.html https://bugzilla.suse.com/1188638 https://bugzilla.suse.com/1188639 https://bugzilla.suse.com/1188848 https://bugzilla.suse.com/1188849

1 0

openSUSE-SU-2021:3018-1: important: Security update for php7-pear
by opensuse-security＠opensuse.org 13 Sep '21

13 Sep '21

openSUSE Security Update: Security update for php7-pear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3018-1 Rating: important References: #1189591 Cross-References: CVE-2020-36193 CVSS scores: CVE-2020-36193 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-36193 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7-pear fixes the following issues: - CVE-2020-36193: Fixed Archive_Tar directory traversal due to inadequate checking of symbolic links (bsc#1189591). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3018=1 Package List: - openSUSE Leap 15.3 (noarch): php7-pear-1.10.21-3.6.1 php7-pecl-1.10.21-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-36193.html https://bugzilla.suse.com/1189591

1 0

openSUSE-SU-2021:1248-1: Security update for openssl-1_1
by opensuse-security＠opensuse.org 12 Sep '21

12 Sep '21

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1248-1 Rating: low References: #1189521 Cross-References: CVE-2021-3712 CVSS scores: CVE-2021-3712 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_1 fixes the following issues: - CVE-2021-3712: This is an update for the incomplete fix for CVE-2021-3712. Read buffer overruns processing ASN.1 strings (bsc#1189521). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1248=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_1-devel-1.1.1d-lp152.7.24.1 libopenssl1_1-1.1.1d-lp152.7.24.1 libopenssl1_1-debuginfo-1.1.1d-lp152.7.24.1 libopenssl1_1-hmac-1.1.1d-lp152.7.24.1 openssl-1_1-1.1.1d-lp152.7.24.1 openssl-1_1-debuginfo-1.1.1d-lp152.7.24.1 openssl-1_1-debugsource-1.1.1d-lp152.7.24.1 - openSUSE Leap 15.2 (noarch): openssl-1_1-doc-1.1.1d-lp152.7.24.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-lp152.7.24.1 libopenssl1_1-32bit-1.1.1d-lp152.7.24.1 libopenssl1_1-32bit-debuginfo-1.1.1d-lp152.7.24.1 libopenssl1_1-hmac-32bit-1.1.1d-lp152.7.24.1 References: https://www.suse.com/security/cve/CVE-2021-3712.html https://bugzilla.suse.com/1189521

1 0

openSUSE-SU-2021:3005-1: important: Security update for libaom
by opensuse-security＠opensuse.org 09 Sep '21

09 Sep '21

openSUSE Security Update: Security update for libaom ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3005-1 Rating: important References: #1189497 Cross-References: CVE-2021-30475 CVSS scores: CVE-2021-30475 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30475 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libaom fixes the following issues: - CVE-2021-30475: Fixed buffer overflow in aom_dsp/noise_model.c (bsc#1189497). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3005=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-3.3.1 aom-tools-debuginfo-1.0.0-3.3.1 libaom-debugsource-1.0.0-3.3.1 libaom-devel-1.0.0-3.3.1 libaom0-1.0.0-3.3.1 libaom0-debuginfo-1.0.0-3.3.1 - openSUSE Leap 15.3 (noarch): libaom-devel-doc-1.0.0-3.3.1 - openSUSE Leap 15.3 (x86_64): libaom0-32bit-1.0.0-3.3.1 libaom0-32bit-debuginfo-1.0.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-30475.html https://bugzilla.suse.com/1189497

1 0

openSUSE-SU-2021:2994-1: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 09 Sep '21

09 Sep '21

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2994-1 Rating: low References: #1189521 Cross-References: CVE-2021-3712 CVSS scores: CVE-2021-3712 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2021-3712: This is an update for the incomplete fix for CVE-2021-3712. Read buffer overruns processing ASN.1 strings (bsc#1189521). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2994=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-3.43.1 libopenssl10-1.0.2p-3.43.1 libopenssl10-debuginfo-1.0.2p-3.43.1 libopenssl1_0_0-1.0.2p-3.43.1 libopenssl1_0_0-debuginfo-1.0.2p-3.43.1 libopenssl1_0_0-hmac-1.0.2p-3.43.1 libopenssl1_0_0-steam-1.0.2p-3.43.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-3.43.1 openssl-1_0_0-1.0.2p-3.43.1 openssl-1_0_0-cavs-1.0.2p-3.43.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-3.43.1 openssl-1_0_0-debuginfo-1.0.2p-3.43.1 openssl-1_0_0-debugsource-1.0.2p-3.43.1 - openSUSE Leap 15.3 (noarch): openssl-1_0_0-doc-1.0.2p-3.43.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-3.43.1 libopenssl1_0_0-32bit-1.0.2p-3.43.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-3.43.1 libopenssl1_0_0-hmac-32bit-1.0.2p-3.43.1 libopenssl1_0_0-steam-32bit-1.0.2p-3.43.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-3.43.1 References: https://www.suse.com/security/cve/CVE-2021-3712.html https://bugzilla.suse.com/1189521

1 0