January 2022 - openSUSE Security Announce

openSUSE-SU-2022:0111-1: important: Security update for virglrenderer
by opensuse-security＠opensuse.org 18 Jan '22

18 Jan '22

openSUSE Security Update: Security update for virglrenderer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0111-1 Rating: important References: #1194601 Cross-References: CVE-2022-0175 CVSS scores: CVE-2022-0175 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virglrenderer fixes the following issues: - CVE-2022-0175: Fixed missing initialization of res->ptr (bsc#1194601). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-111=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libvirglrenderer0-0.6.0-4.6.1 libvirglrenderer0-debuginfo-0.6.0-4.6.1 virglrenderer-debuginfo-0.6.0-4.6.1 virglrenderer-debugsource-0.6.0-4.6.1 virglrenderer-devel-0.6.0-4.6.1 virglrenderer-test-server-0.6.0-4.6.1 virglrenderer-test-server-debuginfo-0.6.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2022-0175.html https://bugzilla.suse.com/1194601

1 0

openSUSE-SU-2022:0104-1: important: Security update for SDL2
by opensuse-security＠opensuse.org 18 Jan '22

18 Jan '22

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0104-1 Rating: important References: #1181201 #1181202 Cross-References: CVE-2020-14409 CVE-2020-14410 CVSS scores: CVE-2020-14409 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-14409 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-14410 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2020-14410 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: - CVE-2020-14409: Fixed Integer Overflow resulting in heap corruption in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP (bsc#1181202). - CVE-2020-14410: Fixed heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP (bsc#1181201). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-104=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): SDL2-debugsource-2.0.8-11.3.1 libSDL2-2_0-0-2.0.8-11.3.1 libSDL2-2_0-0-debuginfo-2.0.8-11.3.1 libSDL2-devel-2.0.8-11.3.1 - openSUSE Leap 15.3 (x86_64): libSDL2-2_0-0-32bit-2.0.8-11.3.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-11.3.1 libSDL2-devel-32bit-2.0.8-11.3.1 References: https://www.suse.com/security/cve/CVE-2020-14409.html https://www.suse.com/security/cve/CVE-2020-14410.html https://bugzilla.suse.com/1181201 https://bugzilla.suse.com/1181202

1 0

openSUSE-SU-2022:0106-1: important: Security update for jawn
by opensuse-security＠opensuse.org 18 Jan '22

18 Jan '22

openSUSE Security Update: Security update for jawn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0106-1 Rating: important References: #1194358 Cross-References: CVE-2022-21653 CVSS scores: CVE-2022-21653 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jawn fixes the following issues: - CVE-2022-21653: Fixed DoS caused by a hash collision in SimpleFacade and MutableFacade (bsc#1194358). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-106=1 Package List: - openSUSE Leap 15.3 (noarch): jawn-ast-0.14.1-3.3.1 jawn-json4s-0.14.1-3.3.1 jawn-parser-0.14.1-3.3.1 jawn-util-0.14.1-3.3.1 References: https://www.suse.com/security/cve/CVE-2022-21653.html https://bugzilla.suse.com/1194358

1 0

openSUSE-SU-2022:0108-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 18 Jan '22

18 Jan '22

openSUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0108-1 Rating: important References: #1185055 #1188564 #1188565 #1191902 #1191904 #1191905 #1191909 #1191910 #1191911 #1191913 #1191914 #1192052 #1194198 #1194232 Cross-References: CVE-2021-2163 CVE-2021-2341 CVE-2021-2369 CVE-2021-35556 CVE-2021-35559 CVE-2021-35560 CVE-2021-35564 CVE-2021-35565 CVE-2021-35578 CVE-2021-35586 CVE-2021-35588 CVE-2021-41035 CVSS scores: CVE-2021-2163 (NVD) : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2163 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-2341 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2341 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2369 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2369 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-35556 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35556 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35559 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35560 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-35560 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-35564 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-35564 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-35565 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35565 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35578 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35578 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35586 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35586 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-35588 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-35588 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-41035 (SUSE): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has two fixes is now available. Description: This update for java-1_8_0-ibm fixes the following issues: - Update to Java 8.0 Service Refresh 7 Fix Pack 0 - CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052) - CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914) - CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913) - CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911) - CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910) - CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) - CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905) - CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564) - CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565) - CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055) - CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902) - CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-108=1 Package List: - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-demo-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-devel-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-src-1.8.0_sr7.0-3.53.1 - openSUSE Leap 15.3 (x86_64): java-1_8_0-ibm-32bit-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-alsa-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-devel-32bit-1.8.0_sr7.0-3.53.1 java-1_8_0-ibm-plugin-1.8.0_sr7.0-3.53.1 References: https://www.suse.com/security/cve/CVE-2021-2163.html https://www.suse.com/security/cve/CVE-2021-2341.html https://www.suse.com/security/cve/CVE-2021-2369.html https://www.suse.com/security/cve/CVE-2021-35556.html https://www.suse.com/security/cve/CVE-2021-35559.html https://www.suse.com/security/cve/CVE-2021-35560.html https://www.suse.com/security/cve/CVE-2021-35564.html https://www.suse.com/security/cve/CVE-2021-35565.html https://www.suse.com/security/cve/CVE-2021-35578.html https://www.suse.com/security/cve/CVE-2021-35586.html https://www.suse.com/security/cve/CVE-2021-35588.html https://www.suse.com/security/cve/CVE-2021-41035.html https://bugzilla.suse.com/1185055 https://bugzilla.suse.com/1188564 https://bugzilla.suse.com/1188565 https://bugzilla.suse.com/1191902 https://bugzilla.suse.com/1191904 https://bugzilla.suse.com/1191905 https://bugzilla.suse.com/1191909 https://bugzilla.suse.com/1191910 https://bugzilla.suse.com/1191911 https://bugzilla.suse.com/1191913 https://bugzilla.suse.com/1191914 https://bugzilla.suse.com/1192052 https://bugzilla.suse.com/1194198 https://bugzilla.suse.com/1194232

1 0

openSUSE-SU-2022:0016-1: important: Security update for watchman
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for watchman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0016-1 Rating: important References: #1181400 #1194470 Cross-References: CVE-2022-21944 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for watchman fixes the following issues: - ship README.suse that explains how to use the template systemd units - add user writable bit for systemd service and socket files - properly handle state directory creation in /run/watchman/$USER-state. The former approach was susceptible to a local privilege escalation using symlinks (CVE-2022-21944, boo#1194470). - Added hardening to systemd service(s) (boo#1181400). Modified: * watchman@.service - removed python2 bindings - enabled python3 bindings as python3-watchman - Changes in 4.8.0: * New command `flush-subscriptions` to synchronize subscriptions associated with the current session. * Enforce socket Unix groups more strongly �� Watchman will now refuse to start if it couldn't gain the right group memberships, as can happen for sites that are experiencing intermittent LDAP connectivity problems. * pywatchman now officially supports Python 3. pywatchman will return Unicode strings (possibly with surrogate escapes) by default, but can optionally return bytestrings. Note that on Python 3, pywatchman requires Watchman 4.8 and above. The Python 2 interface and requirements remain unchanged. * Prior to 4.8, methods on the Java WatchmanClient that returned ListenableFutures would swallow exceptions and hang in an unfinished state under situations like socket closure or thread death. This has been fixed, and now ListenableFutures propagate exception conditions immediately. (Note that this is typically unrecoverable, and users should create a new WatchmanClient to re-establish communication with Watchman.) See #412. * The minimum Java version for the Watchman Java client has always been 1.7, but it was incorrectly described to be 1.6. The Java client's build file has been fixed accordingly. * Watchman was converted from C to C++. The conversion exposed several concurrency bugs, all of which have now been fixed. * Subscription queries are now executed in the context of the client thread, which means that subscriptions are dispatched in parallel. Previously, subscriptions would be serially dispatched and block the disk IO thread. * Triggers are now dispatched in parallel and waits are managed in their own threads (one thread per trigger). This improves concurrency and resolves a couple of waitpid related issues where watchman may not reap spawned children in a timely fashion, or may spin on CPU until another child is spawned. * Fixed an object lifecycle management issue that could cause a crash when aging out old/transient files. * Implement an upgraded wire protocol, BSERv2, on the server and in pywatchman. BSERv2 can carry information about string encoding over the wire. This lets pywatchman convert to Unicode strings on Python 3. Clients and servers know how to transparently fall back to BSERv1. - Changes in 4.9.0: * New field: `content.sha1hex`. This field expands to the SHA1 hash of the file contents, expressed in hex digits (40 character hex string). Watchman maintains a cache of the content hashes and can compute the hash on demand and also heuristically as files are changed. This is useful for tooling that wants to perform more intelligent cache invalidation or build artifact fetching from content addressed storage. * Fixed an issue that resulted in the perf logging thread deadlocking when `perf_logger_command` is enabled in the global configuration * Fixed an issue where queries larger than 1MB would likely result in a PDU error response. * Reduced lock contention for subscriptions that do no use the advanced settling (`drop`, `defer`) options. * Fixed `since` generator behavior when using unix timestamps rather than the preferred clock string syntax * Improved the reporting of "new" files in watchman results * Improved performance of handling changes on case insensitive filesystems * pywatchman: the python wheel format is used for publishing watchman pypi package * pywatchman: now watchman path is configurable in python client * pywatchman: now python client can be used as a context manager Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-16=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): python3-watchman-1.4.0-bp153.2.3.1 watchman-4.9.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-21944.html https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1194470

1 0

openSUSE-SU-2022:0091-1: important: Security update for apache2
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0091-1 Rating: important References: #1193942 #1193943 SLE-22733 SLE-22849 Cross-References: CVE-2021-44224 CVE-2021-44790 CVSS scores: CVE-2021-44224 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44790 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities, contains two features is now available. Description: This update for apache2 fixes the following issues: Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849) It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51. See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log. Also fixed: - CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943) - CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-91=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-2.4.51-3.37.1 apache2-debuginfo-2.4.51-3.37.1 apache2-debugsource-2.4.51-3.37.1 apache2-devel-2.4.51-3.37.1 apache2-event-2.4.51-3.37.1 apache2-event-debuginfo-2.4.51-3.37.1 apache2-example-pages-2.4.51-3.37.1 apache2-prefork-2.4.51-3.37.1 apache2-prefork-debuginfo-2.4.51-3.37.1 apache2-utils-2.4.51-3.37.1 apache2-utils-debuginfo-2.4.51-3.37.1 apache2-worker-2.4.51-3.37.1 apache2-worker-debuginfo-2.4.51-3.37.1 - openSUSE Leap 15.3 (noarch): apache2-doc-2.4.51-3.37.1 References: https://www.suse.com/security/cve/CVE-2021-44224.html https://www.suse.com/security/cve/CVE-2021-44790.html https://bugzilla.suse.com/1193942 https://bugzilla.suse.com/1193943

1 0

openSUSE-SU-2022:0088-1: moderate: Security update for ghostscript
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0088-1 Rating: moderate References: #1194303 #1194304 Cross-References: CVE-2021-45944 CVE-2021-45949 CVSS scores: CVE-2021-45944 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45944 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-45949 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45949 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: - CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303) - CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-88=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ghostscript-9.52-161.1 ghostscript-debuginfo-9.52-161.1 ghostscript-debugsource-9.52-161.1 ghostscript-devel-9.52-161.1 ghostscript-x11-9.52-161.1 ghostscript-x11-debuginfo-9.52-161.1 References: https://www.suse.com/security/cve/CVE-2021-45944.html https://www.suse.com/security/cve/CVE-2021-45949.html https://bugzilla.suse.com/1194303 https://bugzilla.suse.com/1194304

1 0

openSUSE-SU-2022:0014-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0014-1 Rating: important References: #1194055 #1194182 #1194331 Cross-References: CVE-2022-0096 CVE-2022-0097 CVE-2022-0098 CVE-2022-0099 CVE-2022-0100 CVE-2022-0101 CVE-2022-0102 CVE-2022-0103 CVE-2022-0104 CVE-2022-0105 CVE-2022-0106 CVE-2022-0107 CVE-2022-0108 CVE-2022-0109 CVE-2022-0110 CVE-2022-0111 CVE-2022-0112 CVE-2022-0113 CVE-2022-0114 CVE-2022-0115 CVE-2022-0116 CVE-2022-0117 CVE-2022-0118 CVE-2022-0120 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 97.0.4692.71 (boo#1194331): * CVE-2022-0096: Use after free in Storage * CVE-2022-0097: Inappropriate implementation in DevTools * CVE-2022-0098: Use after free in Screen Capture * CVE-2022-0099: Use after free in Sign-in * CVE-2022-0100: Heap buffer overflow in Media streams API * CVE-2022-0101: Heap buffer overflow in Bookmarks * CVE-2022-0102: Type Confusion in V8 * CVE-2022-0103: Use after free in SwiftShader * CVE-2022-0104: Heap buffer overflow in ANGLE * CVE-2022-0105: Use after free in PDF * CVE-2022-0106: Use after free in Autofill * CVE-2022-0107: Use after free in File Manager API * CVE-2022-0108: Inappropriate implementation in Navigation * CVE-2022-0109: Inappropriate implementation in Autofill * CVE-2022-0110: Incorrect security UI in Autofill * CVE-2022-0111: Inappropriate implementation in Navigation * CVE-2022-0112: Incorrect security UI in Browser UI * CVE-2022-0113: Inappropriate implementation in Blink * CVE-2022-0114: Out of bounds memory access in Web Serial * CVE-2022-0115: Uninitialized Use in File API * CVE-2022-0116: Inappropriate implementation in Compositing * CVE-2022-0117: Policy bypass in Service Workers * CVE-2022-0118: Inappropriate implementation in WebShare * CVE-2022-0120: Inappropriate implementation in Passwords - Revert wayland fixes because it doesn't handle GPU correctly (boo#1194182) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-14=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-97.0.4692.71-bp153.2.54.1 chromium-97.0.4692.71-bp153.2.54.1 References: https://www.suse.com/security/cve/CVE-2022-0096.html https://www.suse.com/security/cve/CVE-2022-0097.html https://www.suse.com/security/cve/CVE-2022-0098.html https://www.suse.com/security/cve/CVE-2022-0099.html https://www.suse.com/security/cve/CVE-2022-0100.html https://www.suse.com/security/cve/CVE-2022-0101.html https://www.suse.com/security/cve/CVE-2022-0102.html https://www.suse.com/security/cve/CVE-2022-0103.html https://www.suse.com/security/cve/CVE-2022-0104.html https://www.suse.com/security/cve/CVE-2022-0105.html https://www.suse.com/security/cve/CVE-2022-0106.html https://www.suse.com/security/cve/CVE-2022-0107.html https://www.suse.com/security/cve/CVE-2022-0108.html https://www.suse.com/security/cve/CVE-2022-0109.html https://www.suse.com/security/cve/CVE-2022-0110.html https://www.suse.com/security/cve/CVE-2022-0111.html https://www.suse.com/security/cve/CVE-2022-0112.html https://www.suse.com/security/cve/CVE-2022-0113.html https://www.suse.com/security/cve/CVE-2022-0114.html https://www.suse.com/security/cve/CVE-2022-0115.html https://www.suse.com/security/cve/CVE-2022-0116.html https://www.suse.com/security/cve/CVE-2022-0117.html https://www.suse.com/security/cve/CVE-2022-0118.html https://www.suse.com/security/cve/CVE-2022-0120.html https://bugzilla.suse.com/1194055 https://bugzilla.suse.com/1194182 https://bugzilla.suse.com/1194331

1 0

openSUSE-SU-2022:0012-1: important: Security update for prosody
by opensuse-security＠opensuse.org 14 Jan '22

14 Jan '22

openSUSE Security Update: Security update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0012-1 Rating: important References: #1194596 Cross-References: CVE-2022-0217 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prosody fixes the following issues: Update to 0.11.12: * CVE-2022-0217: util.xml: Do not allow doctypes, comments or processing instructions (bsc#1194596) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-12=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): prosody-0.11.12-bp153.2.12.1 References: https://www.suse.com/security/cve/CVE-2022-0217.html https://bugzilla.suse.com/1194596

1 0

openSUSE-SU-2022:0069-1: Security update for libmspack
by opensuse-security＠opensuse.org 13 Jan '22

13 Jan '22

openSUSE Security Update: Security update for libmspack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0069-1 Rating: low References: #1113040 Cross-References: CVE-2018-18586 CVSS scores: CVE-2018-18586 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmspack fixes the following issues: - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti "../" and leading slash protection (bsc#1113040). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-69=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmspack-debugsource-0.6-3.14.1 libmspack-devel-0.6-3.14.1 libmspack0-0.6-3.14.1 libmspack0-debuginfo-0.6-3.14.1 mspack-tools-0.6-3.14.1 mspack-tools-debuginfo-0.6-3.14.1 - openSUSE Leap 15.3 (x86_64): libmspack0-32bit-0.6-3.14.1 libmspack0-32bit-debuginfo-0.6-3.14.1 References: https://www.suse.com/security/cve/CVE-2018-18586.html https://bugzilla.suse.com/1113040

1 0