September 2021 - openSUSE Security Announce

openSUSE-SU-2021:2939-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 03 Sep '21

03 Sep '21

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2939-1 Rating: moderate References: #1189320 Cross-References: CVE-2021-2372 CVE-2021-2389 CVSS scores: CVE-2021-2372 (NVD) : 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2372 (SUSE): 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-2389 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mariadb fixes the following issues: Update to 10.5.12 [bsc#1189320]: - fixes for the following security vulnerabilities: CVE-2021-2372 and CVE-2021-2389 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2939=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.12-3.6.1 libmariadbd19-10.5.12-3.6.1 libmariadbd19-debuginfo-10.5.12-3.6.1 mariadb-10.5.12-3.6.1 mariadb-bench-10.5.12-3.6.1 mariadb-bench-debuginfo-10.5.12-3.6.1 mariadb-client-10.5.12-3.6.1 mariadb-client-debuginfo-10.5.12-3.6.1 mariadb-debuginfo-10.5.12-3.6.1 mariadb-debugsource-10.5.12-3.6.1 mariadb-rpm-macros-10.5.12-3.6.1 mariadb-test-10.5.12-3.6.1 mariadb-test-debuginfo-10.5.12-3.6.1 mariadb-tools-10.5.12-3.6.1 mariadb-tools-debuginfo-10.5.12-3.6.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.12-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-2372.html https://www.suse.com/security/cve/CVE-2021-2389.html https://bugzilla.suse.com/1189320

1 0

openSUSE-SU-2021:1221-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Sep '21

03 Sep '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1221-1 Rating: important References: Cross-References: CVE-2021-30598 CVE-2021-30599 CVE-2021-30600 CVE-2021-30601 CVE-2021-30602 CVE-2021-30603 CVE-2021-30604 Affected Products: openSUSE Leap 15.3:NonFree openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: opera was updated to version 78.0.4093.184 - CHR-8533 Update chromium on desktop-stable-92-4093 to 92.0.4515.159 - DNA-93472 Reattaching to other browsers - DNA-93741 Multiple hint slots - DNA-93742 Allow displaying unobtrusive external hints - DNA-93744 Add slots in toolbar action view - DNA-94230 Improve text contrast for Speed Dials - DNA-94724 [Mac] Add macOS dark theme wallpaper with easy setup - DNA-94786 Crash at base::SupportsUserData:: SetUserData(void const*, std::__1::unique_ptr) - DNA-94807 Allow scripts access opera version and product info - DNA-94862 Continue on shopping Amazon doesn��t work correct - DNA-94870 Add an addonsPrivate function to install with permissions dialog first - DNA-95064 Revert DNA-93714 on stable - The update to chromium 92.0.4515.159 fixes following issues: CVE-2021-30598, CVE-2021-30599, CVE-2021-30600, CVE-2021-30601, CVE-2021-30602, CVE-2021-30603, CVE-2021-30604 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1221=1 - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1221=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-78.0.4093.184-lp153.2.15.1 - openSUSE Leap 15.2:NonFree (x86_64): opera-78.0.4093.184-lp152.2.61.1 References: https://www.suse.com/security/cve/CVE-2021-30598.html https://www.suse.com/security/cve/CVE-2021-30599.html https://www.suse.com/security/cve/CVE-2021-30600.html https://www.suse.com/security/cve/CVE-2021-30601.html https://www.suse.com/security/cve/CVE-2021-30602.html https://www.suse.com/security/cve/CVE-2021-30603.html https://www.suse.com/security/cve/CVE-2021-30604.html

1 0

openSUSE-SU-2021:2923-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2923-1 Rating: important References: #1027519 #1176189 #1179246 #1183243 #1183877 #1185682 #1186428 #1186429 #1186433 #1186434 #1187406 #1188050 #1189373 #1189376 #1189378 #1189380 #1189381 #1189882 Cross-References: CVE-2021-0089 CVE-2021-28690 CVE-2021-28692 CVE-2021-28693 CVE-2021-28694 CVE-2021-28695 CVE-2021-28696 CVE-2021-28697 CVE-2021-28698 CVE-2021-28699 CVE-2021-28700 CVSS scores: CVE-2021-0089 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-28694 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28695 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28696 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28697 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28698 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28699 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28700 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes the following issues: Update to Xen 4.13.3 general bug fix release (bsc#1027519). Security issues fixed: - CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428) - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429) - CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433) - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434) - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373). - CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376). - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378). - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380). - CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381). Other issues fixed: - Fixed "Panic on CPU 0: IO-APIC + timer doesn't work!" (bsc#1180491) - Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682) - Fixed shell macro expansion in the spec file, so that ExecStart= in xendomains-wait-disks.service is created correctly (bsc#1183877) - Upstream bug fixes (bsc#1027519) - Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050). - xl monitoring process exits during xl save -p|-c keep the monitoring process running to cleanup the domU during shutdown (bsc#1176189). - Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246). - Some long deprecated commands were finally removed in qemu6. Adjust libxl to use supported commands (bsc#1183243). - Update logrotate.conf, move global options into per-file sections to prevent globbering of global state (bsc#1187406). - Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2923=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.2_04-3.9.1 xen-debugsource-4.14.2_04-3.9.1 xen-devel-4.14.2_04-3.9.1 xen-doc-html-4.14.2_04-3.9.1 xen-libs-4.14.2_04-3.9.1 xen-libs-debuginfo-4.14.2_04-3.9.1 xen-tools-4.14.2_04-3.9.1 xen-tools-debuginfo-4.14.2_04-3.9.1 xen-tools-domU-4.14.2_04-3.9.1 xen-tools-domU-debuginfo-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.2_04-3.9.1 xen-libs-32bit-debuginfo-4.14.2_04-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0089.html https://www.suse.com/security/cve/CVE-2021-28690.html https://www.suse.com/security/cve/CVE-2021-28692.html https://www.suse.com/security/cve/CVE-2021-28693.html https://www.suse.com/security/cve/CVE-2021-28694.html https://www.suse.com/security/cve/CVE-2021-28695.html https://www.suse.com/security/cve/CVE-2021-28696.html https://www.suse.com/security/cve/CVE-2021-28697.html https://www.suse.com/security/cve/CVE-2021-28698.html https://www.suse.com/security/cve/CVE-2021-28699.html https://www.suse.com/security/cve/CVE-2021-28700.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176189 https://bugzilla.suse.com/1179246 https://bugzilla.suse.com/1183243 https://bugzilla.suse.com/1183877 https://bugzilla.suse.com/1185682 https://bugzilla.suse.com/1186428 https://bugzilla.suse.com/1186429 https://bugzilla.suse.com/1186433 https://bugzilla.suse.com/1186434 https://bugzilla.suse.com/1187406 https://bugzilla.suse.com/1188050 https://bugzilla.suse.com/1189373 https://bugzilla.suse.com/1189376 https://bugzilla.suse.com/1189378 https://bugzilla.suse.com/1189380 https://bugzilla.suse.com/1189381 https://bugzilla.suse.com/1189882

1 0

openSUSE-SU-2021:2915-1: moderate: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2915-1 Rating: moderate References: #1184735 #1184739 Cross-References: CVE-2021-3497 CVE-2021-3498 CVSS scores: CVE-2021-3497 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3497 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3498 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3498 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735). - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2915=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gstreamer-plugins-good-1.16.3-3.6.1 gstreamer-plugins-good-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-debugsource-1.16.3-3.6.1 gstreamer-plugins-good-doc-1.16.3-3.6.1 gstreamer-plugins-good-extra-1.16.3-3.6.1 gstreamer-plugins-good-extra-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-gtk-1.16.3-3.6.1 gstreamer-plugins-good-gtk-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-jack-1.16.3-3.6.1 gstreamer-plugins-good-jack-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-qtqml-1.16.3-3.6.1 gstreamer-plugins-good-qtqml-debuginfo-1.16.3-3.6.1 - openSUSE Leap 15.3 (noarch): gstreamer-plugins-good-lang-1.16.3-3.6.1 - openSUSE Leap 15.3 (x86_64): gstreamer-plugins-good-32bit-1.16.3-3.6.1 gstreamer-plugins-good-32bit-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-extra-32bit-1.16.3-3.6.1 gstreamer-plugins-good-extra-32bit-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-jack-32bit-1.16.3-3.6.1 gstreamer-plugins-good-jack-32bit-debuginfo-1.16.3-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-3497.html https://www.suse.com/security/cve/CVE-2021-3498.html https://bugzilla.suse.com/1184735 https://bugzilla.suse.com/1184739

1 0

openSUSE-SU-2021:2919-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2919-1 Rating: important References: #1129714 #1186849 #1186859 #1186861 #1186863 #1189142 #1189348 #1189350 Cross-References: CVE-2019-9721 CVE-2020-21688 CVE-2020-21697 CVE-2020-22046 CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2021-38114 CVSS scores: CVE-2019-9721 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-9721 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-21688 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21697 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22046 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22046 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22048 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22048 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22049 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22049 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22054 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22054 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38114 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for ffmpeg fixes the following issues: - CVE-2019-9721: Fix denial of service in the subtitle decoder in handle_open_brace from libavcodec/htmlsubtitles.c (bsc#1129714). - CVE-2020-22046: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c (bsc#1186849). - CVE-2020-22048: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c (bsc#1186859). - CVE-2020-22049: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c (bsc#1186861). - CVE-2020-22054: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c (bsc#1186863). - CVE-2020-21688: Fixed a heap-use-after-free in the av_freep function in libavutil/mem.c (bsc#1189348). - CVE-2020-21697: Fixed a heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c (bsc#1189350). - CVE-2021-38114: Fixed a not checked return value of the init_vlc function (bsc#1189142). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2919=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ffmpeg-3.4.2-11.8.2 ffmpeg-debuginfo-3.4.2-11.8.2 ffmpeg-debugsource-3.4.2-11.8.2 ffmpeg-private-devel-3.4.2-11.8.2 libavcodec-devel-3.4.2-11.8.2 libavcodec57-3.4.2-11.8.2 libavcodec57-debuginfo-3.4.2-11.8.2 libavdevice-devel-3.4.2-11.8.2 libavdevice57-3.4.2-11.8.2 libavdevice57-debuginfo-3.4.2-11.8.2 libavfilter-devel-3.4.2-11.8.2 libavfilter6-3.4.2-11.8.2 libavfilter6-debuginfo-3.4.2-11.8.2 libavformat-devel-3.4.2-11.8.2 libavformat57-3.4.2-11.8.2 libavformat57-debuginfo-3.4.2-11.8.2 libavresample-devel-3.4.2-11.8.2 libavresample3-3.4.2-11.8.2 libavresample3-debuginfo-3.4.2-11.8.2 libavutil-devel-3.4.2-11.8.2 libavutil55-3.4.2-11.8.2 libavutil55-debuginfo-3.4.2-11.8.2 libpostproc-devel-3.4.2-11.8.2 libpostproc54-3.4.2-11.8.2 libpostproc54-debuginfo-3.4.2-11.8.2 libswresample-devel-3.4.2-11.8.2 libswresample2-3.4.2-11.8.2 libswresample2-debuginfo-3.4.2-11.8.2 libswscale-devel-3.4.2-11.8.2 libswscale4-3.4.2-11.8.2 libswscale4-debuginfo-3.4.2-11.8.2 - openSUSE Leap 15.3 (x86_64): libavcodec57-32bit-3.4.2-11.8.2 libavcodec57-32bit-debuginfo-3.4.2-11.8.2 libavdevice57-32bit-3.4.2-11.8.2 libavdevice57-32bit-debuginfo-3.4.2-11.8.2 libavfilter6-32bit-3.4.2-11.8.2 libavfilter6-32bit-debuginfo-3.4.2-11.8.2 libavformat57-32bit-3.4.2-11.8.2 libavformat57-32bit-debuginfo-3.4.2-11.8.2 libavresample3-32bit-3.4.2-11.8.2 libavresample3-32bit-debuginfo-3.4.2-11.8.2 libavutil55-32bit-3.4.2-11.8.2 libavutil55-32bit-debuginfo-3.4.2-11.8.2 libpostproc54-32bit-3.4.2-11.8.2 libpostproc54-32bit-debuginfo-3.4.2-11.8.2 libswresample2-32bit-3.4.2-11.8.2 libswresample2-32bit-debuginfo-3.4.2-11.8.2 libswscale4-32bit-3.4.2-11.8.2 libswscale4-32bit-debuginfo-3.4.2-11.8.2 References: https://www.suse.com/security/cve/CVE-2019-9721.html https://www.suse.com/security/cve/CVE-2020-21688.html https://www.suse.com/security/cve/CVE-2020-21697.html https://www.suse.com/security/cve/CVE-2020-22046.html https://www.suse.com/security/cve/CVE-2020-22048.html https://www.suse.com/security/cve/CVE-2020-22049.html https://www.suse.com/security/cve/CVE-2020-22054.html https://www.suse.com/security/cve/CVE-2021-38114.html https://bugzilla.suse.com/1129714 https://bugzilla.suse.com/1186849 https://bugzilla.suse.com/1186859 https://bugzilla.suse.com/1186861 https://bugzilla.suse.com/1186863 https://bugzilla.suse.com/1189142 https://bugzilla.suse.com/1189348 https://bugzilla.suse.com/1189350

1 0