February 2022 - openSUSE Security Announce

openSUSE-SU-2022:0525-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 21 Feb '22

21 Feb '22

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0525-1 Rating: moderate References: #1195542 Cross-References: CVE-2021-4115 CVSS scores: CVE-2021-4115 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: - CVE-2021-4115: Fixed a denial of service via file descriptor leak (bsc#1195542). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-525=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-525=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpolkit0-0.116-3.9.1 libpolkit0-debuginfo-0.116-3.9.1 polkit-0.116-3.9.1 polkit-debuginfo-0.116-3.9.1 polkit-debugsource-0.116-3.9.1 polkit-devel-0.116-3.9.1 polkit-devel-debuginfo-0.116-3.9.1 typelib-1_0-Polkit-1_0-0.116-3.9.1 - openSUSE Leap 15.4 (noarch): polkit-doc-0.116-3.9.1 - openSUSE Leap 15.4 (x86_64): libpolkit0-32bit-0.116-3.9.1 libpolkit0-32bit-debuginfo-0.116-3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpolkit0-0.116-3.9.1 libpolkit0-debuginfo-0.116-3.9.1 polkit-0.116-3.9.1 polkit-debuginfo-0.116-3.9.1 polkit-debugsource-0.116-3.9.1 polkit-devel-0.116-3.9.1 polkit-devel-debuginfo-0.116-3.9.1 typelib-1_0-Polkit-1_0-0.116-3.9.1 - openSUSE Leap 15.3 (noarch): polkit-doc-0.116-3.9.1 - openSUSE Leap 15.3 (x86_64): libpolkit0-32bit-0.116-3.9.1 libpolkit0-32bit-debuginfo-0.116-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-4115.html https://bugzilla.suse.com/1195542

1 0

openSUSE-SU-2022:0498-1: important: Security update for expat
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0498-1 Rating: important References: #1195054 #1195217 Cross-References: CVE-2022-23852 CVE-2022-23990 CVSS scores: CVE-2022-23852 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23852 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23990 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23990 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following issues: - CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054). - CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-498=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): expat-2.2.5-3.12.1 expat-debuginfo-2.2.5-3.12.1 expat-debugsource-2.2.5-3.12.1 libexpat-devel-2.2.5-3.12.1 libexpat1-2.2.5-3.12.1 libexpat1-debuginfo-2.2.5-3.12.1 - openSUSE Leap 15.3 (x86_64): expat-32bit-debuginfo-2.2.5-3.12.1 libexpat-devel-32bit-2.2.5-3.12.1 libexpat1-32bit-2.2.5-3.12.1 libexpat1-32bit-debuginfo-2.2.5-3.12.1 References: https://www.suse.com/security/cve/CVE-2022-23852.html https://www.suse.com/security/cve/CVE-2022-23990.html https://bugzilla.suse.com/1195054 https://bugzilla.suse.com/1195217

1 0

openSUSE-SU-2022:0210-2: Security update for qemu
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0210-2 Rating: low References: #1172033 #1181361 Cross-References: CVE-2020-13253 CVE-2021-20196 CVSS scores: CVE-2020-13253 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-13253 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-20196 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-20196 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for qemu fixes the following issues: - CVE-2020-13253: Fixed an OOB access that could crash the guest resulting in DoS (bsc#1172033) - CVE-2021-20196: Fixed null pointer dereference that may lead to guest crash (bsc#1181361). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-210=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): qemu-s390-4.2.1-11.34.2 qemu-s390-debuginfo-4.2.1-11.34.2 References: https://www.suse.com/security/cve/CVE-2020-13253.html https://www.suse.com/security/cve/CVE-2021-20196.html https://bugzilla.suse.com/1172033 https://bugzilla.suse.com/1181361

1 0

openSUSE-SU-2022:0492-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0492-1 Rating: important References: #1194471 Cross-References: CVE-2021-45079 CVSS scores: CVE-2021-45079 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-45079 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for strongswan fixes the following issues: - CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-492=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-492=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): strongswan-5.8.2-11.24.1 strongswan-debuginfo-5.8.2-11.24.1 strongswan-debugsource-5.8.2-11.24.1 strongswan-hmac-5.8.2-11.24.1 strongswan-ipsec-5.8.2-11.24.1 strongswan-ipsec-debuginfo-5.8.2-11.24.1 strongswan-libs0-5.8.2-11.24.1 strongswan-libs0-debuginfo-5.8.2-11.24.1 strongswan-mysql-5.8.2-11.24.1 strongswan-mysql-debuginfo-5.8.2-11.24.1 strongswan-nm-5.8.2-11.24.1 strongswan-nm-debuginfo-5.8.2-11.24.1 strongswan-sqlite-5.8.2-11.24.1 strongswan-sqlite-debuginfo-5.8.2-11.24.1 - openSUSE Leap 15.4 (noarch): strongswan-doc-5.8.2-11.24.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): strongswan-5.8.2-11.24.1 strongswan-debuginfo-5.8.2-11.24.1 strongswan-debugsource-5.8.2-11.24.1 strongswan-hmac-5.8.2-11.24.1 strongswan-ipsec-5.8.2-11.24.1 strongswan-ipsec-debuginfo-5.8.2-11.24.1 strongswan-libs0-5.8.2-11.24.1 strongswan-libs0-debuginfo-5.8.2-11.24.1 strongswan-mysql-5.8.2-11.24.1 strongswan-mysql-debuginfo-5.8.2-11.24.1 strongswan-nm-5.8.2-11.24.1 strongswan-nm-debuginfo-5.8.2-11.24.1 strongswan-sqlite-5.8.2-11.24.1 strongswan-sqlite-debuginfo-5.8.2-11.24.1 - openSUSE Leap 15.3 (noarch): strongswan-doc-5.8.2-11.24.1 References: https://www.suse.com/security/cve/CVE-2021-45079.html https://bugzilla.suse.com/1194471

1 0

openSUSE-SU-2022:0493-1: important: Security update for clamav
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0493-1 Rating: important References: #1194731 Cross-References: CVE-2022-20698 CVSS scores: CVE-2022-20698 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for clamav fixes the following issues: - CVE-2022-20698: Fixed invalid pointer read allowing denial of service crash. (bsc#1194731) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-493=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-493=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): clamav-0.103.5-3.35.1 clamav-debuginfo-0.103.5-3.35.1 clamav-debugsource-0.103.5-3.35.1 clamav-devel-0.103.5-3.35.1 libclamav9-0.103.5-3.35.1 libclamav9-debuginfo-0.103.5-3.35.1 libfreshclam2-0.103.5-3.35.1 libfreshclam2-debuginfo-0.103.5-3.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): clamav-0.103.5-3.35.1 clamav-debuginfo-0.103.5-3.35.1 clamav-debugsource-0.103.5-3.35.1 clamav-devel-0.103.5-3.35.1 libclamav9-0.103.5-3.35.1 libclamav9-debuginfo-0.103.5-3.35.1 libfreshclam2-0.103.5-3.35.1 libfreshclam2-debuginfo-0.103.5-3.35.1 References: https://www.suse.com/security/cve/CVE-2022-20698.html https://bugzilla.suse.com/1194731

1 0

openSUSE-SU-2022:0503-1: important: Security update for xerces-j2
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for xerces-j2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0503-1 Rating: important References: #1195108 Cross-References: CVE-2022-23437 CVSS scores: CVE-2022-23437 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-23437 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xerces-j2 fixes the following issues: - CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-503=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-503=1 Package List: - openSUSE Leap 15.4 (noarch): xerces-j2-2.12.0-3.3.1 xerces-j2-demo-2.12.0-3.3.1 xerces-j2-javadoc-2.12.0-3.3.1 - openSUSE Leap 15.3 (noarch): xerces-j2-2.12.0-3.3.1 xerces-j2-demo-2.12.0-3.3.1 xerces-j2-javadoc-2.12.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2022-23437.html https://bugzilla.suse.com/1195108

1 0

openSUSE-SU-2022:0500-1: important: Security update for xerces-j2
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for xerces-j2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0500-1 Rating: important References: #1195108 Cross-References: CVE-2022-23437 CVSS scores: CVE-2022-23437 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-23437 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xerces-j2 fixes the following issues: - CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-500=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-500=1 Package List: - openSUSE Leap 15.4 (noarch): xerces-j2-scripts-2.11.0-4.3.1 xerces-j2-xml-apis-2.11.0-4.3.1 xerces-j2-xml-resolver-2.11.0-4.3.1 - openSUSE Leap 15.3 (noarch): xerces-j2-scripts-2.11.0-4.3.1 xerces-j2-xml-apis-2.11.0-4.3.1 xerces-j2-xml-resolver-2.11.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2022-23437.html https://bugzilla.suse.com/1195108

1 0

openSUSE-SU-2022:0491-1: moderate: Security update for rust
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for rust ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0491-1 Rating: moderate References: #1194767 Cross-References: CVE-2022-21658 CVSS scores: CVE-2022-21658 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2022-21658 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rust fixes the following issues: - CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-491=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-491=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cargo-debuginfo-1.53.0-22.1 rust-debuginfo-1.53.0-22.1 - openSUSE Leap 15.4 (aarch64 x86_64): rls-debuginfo-1.53.0-22.1 rust-analysis-1.53.0-22.1 rust-doc-1.53.0-22.1 - openSUSE Leap 15.4 (noarch): cargo-doc-1.53.0-22.1 rust-src-1.53.0-22.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo-debuginfo-1.53.0-22.1 rust-debuginfo-1.53.0-22.1 - openSUSE Leap 15.3 (aarch64 x86_64): rls-debuginfo-1.53.0-22.1 rust-analysis-1.53.0-22.1 rust-doc-1.53.0-22.1 - openSUSE Leap 15.3 (noarch): cargo-doc-1.53.0-22.1 rust-src-1.53.0-22.1 References: https://www.suse.com/security/cve/CVE-2022-21658.html https://bugzilla.suse.com/1194767

1 0

openSUSE-SU-2022:0499-1: important: Security update for python-Twisted
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0499-1 Rating: important References: #1195667 Cross-References: CVE-2022-21712 CVSS scores: CVE-2022-21712 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-21712 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects by properly removing sensitive headers when redirecting to a different origin (bsc#1195667). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-499=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-499=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-Twisted-debuginfo-19.10.0-3.6.1 python-Twisted-debugsource-19.10.0-3.6.1 python2-Twisted-19.10.0-3.6.1 python2-Twisted-debuginfo-19.10.0-3.6.1 python3-Twisted-debuginfo-19.10.0-3.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-Twisted-debuginfo-19.10.0-3.6.1 python-Twisted-debugsource-19.10.0-3.6.1 python-Twisted-doc-19.10.0-3.6.1 python2-Twisted-19.10.0-3.6.1 python2-Twisted-debuginfo-19.10.0-3.6.1 python3-Twisted-19.10.0-3.6.1 python3-Twisted-debuginfo-19.10.0-3.6.1 References: https://www.suse.com/security/cve/CVE-2022-21712.html https://bugzilla.suse.com/1195667

1 0

openSUSE-SU-2022:0069-2: Security update for libmspack
by opensuse-security＠opensuse.org 18 Feb '22

18 Feb '22

openSUSE Security Update: Security update for libmspack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0069-2 Rating: low References: #1113040 Cross-References: CVE-2018-18586 CVSS scores: CVE-2018-18586 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmspack fixes the following issues: - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti "../" and leading slash protection (bsc#1113040). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-69=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libmspack-debugsource-0.6-3.14.1 libmspack-devel-0.6-3.14.1 libmspack0-0.6-3.14.1 libmspack0-debuginfo-0.6-3.14.1 mspack-tools-0.6-3.14.1 mspack-tools-debuginfo-0.6-3.14.1 - openSUSE Leap 15.4 (x86_64): libmspack0-32bit-0.6-3.14.1 libmspack0-32bit-debuginfo-0.6-3.14.1 References: https://www.suse.com/security/cve/CVE-2018-18586.html https://bugzilla.suse.com/1113040

1 0