February 2022 - openSUSE Security Announce

openSUSE-SU-2022:0052-2: important: Security update for libsndfile
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0052-2 Rating: important References: #1194006 Cross-References: CVE-2021-4156 CVSS scores: CVE-2021-4156 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libsndfile fixes the following issues: - CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that could potentially lead to heap exploitation (bsc#1194006). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-52=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libsndfile-debugsource-1.0.28-5.15.1 libsndfile-devel-1.0.28-5.15.1 libsndfile-progs-1.0.28-5.15.1 libsndfile-progs-debuginfo-1.0.28-5.15.1 libsndfile-progs-debugsource-1.0.28-5.15.1 libsndfile1-1.0.28-5.15.1 libsndfile1-debuginfo-1.0.28-5.15.1 - openSUSE Leap 15.4 (x86_64): libsndfile1-32bit-1.0.28-5.15.1 libsndfile1-32bit-debuginfo-1.0.28-5.15.1 References: https://www.suse.com/security/cve/CVE-2021-4156.html https://bugzilla.suse.com/1194006

1 0

openSUSE-SU-2022:0150-2: important: Security update for aide
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for aide ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0150-2 Rating: important References: #1194735 Cross-References: CVE-2021-45417 CVSS scores: CVE-2021-45417 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for aide fixes the following issues: - CVE-2021-45417: Fix a bufferoverflow in base64 functions (bsc#1194735) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-150=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): aide-0.16-24.1 aide-debuginfo-0.16-24.1 aide-debugsource-0.16-24.1 aide-test-0.16-24.1 References: https://www.suse.com/security/cve/CVE-2021-45417.html https://bugzilla.suse.com/1194735

1 0

openSUSE-SU-2022:0043-1: moderate: Security update for htmldoc
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0043-1 Rating: moderate References: #1178561 #1190515 #1192357 #1194178 #1194487 #1195758 Cross-References: CVE-2021-3997 CVE-2021-40985 CVE-2021-43579 CVE-2022-0534 CVSS scores: CVE-2021-3997 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-40985 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-43579 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-0534 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0534 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: htmldoc was updated to fix issues: - CVE-2021-40985: Fixed buffer overflow may lead to DoS via a crafted BMP image (bsc#1192357) - CVE-2021-43579: Fixed stack-based buffer overflow in image_load_bmp() results in remote code execution if the victim converts an HTML document linking to a crafted BMP file (bsc#1194487) - CVE-2022-0534: Fixed stack out-of-bounds read in gif_get_code() when opening a malicious GIF file results in a segmentation fault (bsc#1195758) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-43=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-43=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsystemd0-246.16-7.33.1 libsystemd0-debuginfo-246.16-7.33.1 libudev-devel-246.16-7.33.1 libudev1-246.16-7.33.1 libudev1-debuginfo-246.16-7.33.1 nss-myhostname-246.16-7.33.1 nss-myhostname-debuginfo-246.16-7.33.1 nss-mymachines-246.16-7.33.1 nss-mymachines-debuginfo-246.16-7.33.1 nss-resolve-246.16-7.33.1 nss-resolve-debuginfo-246.16-7.33.1 nss-systemd-246.16-7.33.1 nss-systemd-debuginfo-246.16-7.33.1 systemd-246.16-7.33.1 systemd-container-246.16-7.33.1 systemd-container-debuginfo-246.16-7.33.1 systemd-coredump-246.16-7.33.1 systemd-coredump-debuginfo-246.16-7.33.1 systemd-debuginfo-246.16-7.33.1 systemd-debugsource-246.16-7.33.1 systemd-devel-246.16-7.33.1 systemd-doc-246.16-7.33.1 systemd-journal-remote-246.16-7.33.1 systemd-journal-remote-debuginfo-246.16-7.33.1 systemd-logger-246.16-7.33.1 systemd-network-246.16-7.33.1 systemd-network-debuginfo-246.16-7.33.1 systemd-sysvinit-246.16-7.33.1 udev-246.16-7.33.1 udev-debuginfo-246.16-7.33.1 - openSUSE Leap 15.3 (x86_64): libsystemd0-32bit-246.16-7.33.1 libsystemd0-32bit-debuginfo-246.16-7.33.1 libudev-devel-32bit-246.16-7.33.1 libudev1-32bit-246.16-7.33.1 libudev1-32bit-debuginfo-246.16-7.33.1 nss-myhostname-32bit-246.16-7.33.1 nss-myhostname-32bit-debuginfo-246.16-7.33.1 nss-mymachines-32bit-246.16-7.33.1 nss-mymachines-32bit-debuginfo-246.16-7.33.1 systemd-32bit-246.16-7.33.1 systemd-32bit-debuginfo-246.16-7.33.1 - openSUSE Leap 15.3 (noarch): systemd-lang-246.16-7.33.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): htmldoc-1.9.12-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-3997.html https://www.suse.com/security/cve/CVE-2021-40985.html https://www.suse.com/security/cve/CVE-2021-43579.html https://www.suse.com/security/cve/CVE-2022-0534.html https://bugzilla.suse.com/1178561 https://bugzilla.suse.com/1190515 https://bugzilla.suse.com/1192357 https://bugzilla.suse.com/1194178 https://bugzilla.suse.com/1194487 https://bugzilla.suse.com/1195758

1 0

openSUSE-SU-2022:0042-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0042-1 Rating: important References: #1195986 Cross-References: CVE-2022-0603 CVE-2022-0604 CVE-2022-0605 CVE-2022-0606 CVE-2022-0607 CVE-2022-0608 CVE-2022-0609 CVE-2022-0610 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 98.0.4758.102 (boo#1195986) * CVE-2022-0603: Use after free in File Manager * CVE-2022-0604: Heap buffer overflow in Tab Groups * CVE-2022-0605: Use after free in Webstore API * CVE-2022-0606: Use after free in ANGLE * CVE-2022-0607: Use after free in GPU * CVE-2022-0608: Integer overflow in Mojo * CVE-2022-0609: Use after free in Animation * CVE-2022-0610: Inappropriate implementation in Gamepad API * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-42=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-98.0.4758.102-bp153.2.63.1 chromium-98.0.4758.102-bp153.2.63.1 References: https://www.suse.com/security/cve/CVE-2022-0603.html https://www.suse.com/security/cve/CVE-2022-0604.html https://www.suse.com/security/cve/CVE-2022-0605.html https://www.suse.com/security/cve/CVE-2022-0606.html https://www.suse.com/security/cve/CVE-2022-0607.html https://www.suse.com/security/cve/CVE-2022-0608.html https://www.suse.com/security/cve/CVE-2022-0609.html https://www.suse.com/security/cve/CVE-2022-0610.html https://bugzilla.suse.com/1195986

1 0

openSUSE-SU-2022:0480-1: important: Security update for tiff
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0480-1 Rating: important References: #1071031 #1154365 #1182808 #1182809 #1182811 #1182812 #1190312 #1194539 Cross-References: CVE-2017-17095 CVE-2019-17546 CVE-2020-19131 CVE-2020-35521 CVE-2020-35522 CVE-2020-35523 CVE-2020-35524 CVE-2022-22844 CVSS scores: CVE-2017-17095 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-17095 (SUSE): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-17546 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17546 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-19131 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-19131 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35521 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35521 (SUSE): 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2020-35522 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-35522 (SUSE): 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2020-35523 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-35523 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2020-35524 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-35524 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2022-22844 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for tiff fixes the following issues: - CVE-2017-17095: Fixed DoS in tools/pal2rgb.c in pal2rgb (bsc#1071031). - CVE-2019-17546: Fixed integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image (bsc#1154365). - CVE-2020-19131: Fixed buffer overflow in tiffcrop that may cause DoS via the invertImage() function (bsc#1190312). - CVE-2020-35521: Fixed memory allocation failure in tif_read.c (bsc#1182808). - CVE-2020-35522: Fixed memory allocation failure in tif_pixarlog.c (bsc#1182809). - CVE-2020-35523: Fixed integer overflow in tif_getimage.c (bsc#1182811). - CVE-2020-35524: Fixed heap-based buffer overflow in TIFF2PDF tool (bsc#1182812). - CVE-2022-22844: Fixed out-of-bounds read in _TIFFmemcpy in tif_unix.c (bsc#1194539). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-480=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-480=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-45.5.1 libtiff5-4.0.9-45.5.1 libtiff5-debuginfo-4.0.9-45.5.1 tiff-4.0.9-45.5.1 tiff-debuginfo-4.0.9-45.5.1 tiff-debugsource-4.0.9-45.5.1 - openSUSE Leap 15.4 (x86_64): libtiff-devel-32bit-4.0.9-45.5.1 libtiff5-32bit-4.0.9-45.5.1 libtiff5-32bit-debuginfo-4.0.9-45.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-45.5.1 libtiff5-4.0.9-45.5.1 libtiff5-debuginfo-4.0.9-45.5.1 tiff-4.0.9-45.5.1 tiff-debuginfo-4.0.9-45.5.1 tiff-debugsource-4.0.9-45.5.1 - openSUSE Leap 15.3 (x86_64): libtiff-devel-32bit-4.0.9-45.5.1 libtiff5-32bit-4.0.9-45.5.1 libtiff5-32bit-debuginfo-4.0.9-45.5.1 References: https://www.suse.com/security/cve/CVE-2017-17095.html https://www.suse.com/security/cve/CVE-2019-17546.html https://www.suse.com/security/cve/CVE-2020-19131.html https://www.suse.com/security/cve/CVE-2020-35521.html https://www.suse.com/security/cve/CVE-2020-35522.html https://www.suse.com/security/cve/CVE-2020-35523.html https://www.suse.com/security/cve/CVE-2020-35524.html https://www.suse.com/security/cve/CVE-2022-22844.html https://bugzilla.suse.com/1071031 https://bugzilla.suse.com/1154365 https://bugzilla.suse.com/1182808 https://bugzilla.suse.com/1182809 https://bugzilla.suse.com/1182811 https://bugzilla.suse.com/1182812 https://bugzilla.suse.com/1190312 https://bugzilla.suse.com/1194539

1 0

openSUSE-SU-2022:0479-1: important: Security update for virglrenderer
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for virglrenderer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0479-1 Rating: important References: #1195389 Cross-References: CVE-2022-0135 CVSS scores: CVE-2022-0135 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virglrenderer fixes the following issues: - CVE-2022-0135: Fixed out-of-bonds write in read_transfer_data() (bsc#1195389). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-479=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-479=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libvirglrenderer0-0.6.0-4.9.1 libvirglrenderer0-debuginfo-0.6.0-4.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libvirglrenderer0-0.6.0-4.9.1 libvirglrenderer0-debuginfo-0.6.0-4.9.1 virglrenderer-debuginfo-0.6.0-4.9.1 virglrenderer-debugsource-0.6.0-4.9.1 virglrenderer-devel-0.6.0-4.9.1 virglrenderer-test-server-0.6.0-4.9.1 virglrenderer-test-server-debuginfo-0.6.0-4.9.1 References: https://www.suse.com/security/cve/CVE-2022-0135.html https://bugzilla.suse.com/1195389

1 0

openSUSE-SU-2022:0040-1: important: Security update for kafka
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for kafka ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0040-1 Rating: important References: #1190587 #1190839 #1193662 #1193930 #1194842 #1194843 #1194844 Cross-References: CVE-2021-4104 CVE-2021-43565 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 CVSS scores: CVE-2021-4104 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4104 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-43565 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23302 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23302 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-23305 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23305 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23307 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for kafka, kafka-kit fixes following issues: - Remove JDBCAppender, JMSSink, chainsaw from log4j jars during build to prevent bsc#1194842, CVE-2022-23302, bsc#1194843, CVE-2022-23305, bsc#1194844, CVE-2022-23307 - Rebuild with kafka-kit change to Remove JMSAppender from log4j jars during build to prevent bsc#1193662, CVE-2021-4104 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-40=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2022-40=1 Package List: - openSUSE Leap 15.3 (x86_64): kubevirt-container-disk-0.45.0-8.7.1 kubevirt-container-disk-debuginfo-0.45.0-8.7.1 kubevirt-manifests-0.45.0-8.7.1 kubevirt-tests-0.45.0-8.7.1 kubevirt-tests-debuginfo-0.45.0-8.7.1 kubevirt-virt-api-0.45.0-8.7.1 kubevirt-virt-api-debuginfo-0.45.0-8.7.1 kubevirt-virt-controller-0.45.0-8.7.1 kubevirt-virt-controller-debuginfo-0.45.0-8.7.1 kubevirt-virt-handler-0.45.0-8.7.1 kubevirt-virt-handler-debuginfo-0.45.0-8.7.1 kubevirt-virt-launcher-0.45.0-8.7.1 kubevirt-virt-launcher-debuginfo-0.45.0-8.7.1 kubevirt-virt-operator-0.45.0-8.7.1 kubevirt-virt-operator-debuginfo-0.45.0-8.7.1 kubevirt-virtctl-0.45.0-8.7.1 kubevirt-virtctl-debuginfo-0.45.0-8.7.1 obs-service-kubevirt_containers_meta-0.45.0-8.7.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kafka-source-2.1.0-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (x86_64): kafka-kit-2.1.0-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-4104.html https://www.suse.com/security/cve/CVE-2021-43565.html https://www.suse.com/security/cve/CVE-2022-23302.html https://www.suse.com/security/cve/CVE-2022-23305.html https://www.suse.com/security/cve/CVE-2022-23307.html https://bugzilla.suse.com/1190587 https://bugzilla.suse.com/1190839 https://bugzilla.suse.com/1193662 https://bugzilla.suse.com/1193930 https://bugzilla.suse.com/1194842 https://bugzilla.suse.com/1194843 https://bugzilla.suse.com/1194844

1 0

openSUSE-SU-2021:4136-2: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4136-2 Rating: important References: #1190487 #1190488 #1190489 Cross-References: CVE-2021-4009 CVE-2021-4010 CVE-2021-4011 CVSS scores: CVE-2021-4009 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4010 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-4011 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-4009: The handler for the CreatePointerBarrier request of the XFixes extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190487) - CVE-2021-4010: The handler for the Suspend request of the Screen Saver extension does not properly validate the request length leading to out of bounds memory write. (bsc#1190488) - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. (bsc#1190489) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-465=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xorg-x11-server-wayland-1.20.3-22.5.42.1 xorg-x11-server-wayland-debuginfo-1.20.3-22.5.42.1 References: https://www.suse.com/security/cve/CVE-2021-4009.html https://www.suse.com/security/cve/CVE-2021-4010.html https://www.suse.com/security/cve/CVE-2021-4011.html https://bugzilla.suse.com/1190487 https://bugzilla.suse.com/1190488 https://bugzilla.suse.com/1190489

1 0

openSUSE-SU-2022:0182-2: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0182-2 Rating: important References: #1194019 Cross-References: CVE-2019-8766 CVE-2019-8782 CVE-2019-8808 CVE-2019-8815 CVE-2020-13753 CVE-2020-27918 CVE-2020-29623 CVE-2020-3902 CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9947 CVE-2020-9948 CVE-2020-9951 CVE-2020-9952 CVE-2021-1765 CVE-2021-1788 CVE-2021-1817 CVE-2021-1820 CVE-2021-1825 CVE-2021-1826 CVE-2021-1844 CVE-2021-1871 CVE-2021-30661 CVE-2021-30666 CVE-2021-30682 CVE-2021-30761 CVE-2021-30762 CVE-2021-30809 CVE-2021-30818 CVE-2021-30823 CVE-2021-30836 CVE-2021-30846 CVE-2021-30848 CVE-2021-30849 CVE-2021-30851 CVE-2021-30858 CVE-2021-30884 CVE-2021-30887 CVE-2021-30888 CVE-2021-30889 CVE-2021-30890 CVE-2021-30897 CVSS scores: CVE-2019-8766 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8766 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8782 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8782 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8808 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8808 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8815 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-8815 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-13753 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-13753 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2020-27918 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27918 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-29623 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2020-29623 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2020-3902 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-3902 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-9802 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9802 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2020-9803 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9803 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2020-9805 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2020-9805 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2020-9947 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9947 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9948 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9951 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9951 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-9952 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2020-9952 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-1765 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-1765 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-1788 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1788 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1844 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1844 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1871 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-1871 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30809 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30809 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30818 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30818 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30823 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-30823 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-30836 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-30836 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-30846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30846 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30848 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30848 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30849 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30849 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30858 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30858 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30884 (NVD) : 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVE-2021-30884 (SUSE): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVE-2021-30887 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-30887 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-30888 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-30888 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-30889 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30889 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30890 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-30890 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-30897 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-30897 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 43 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - Update to version 2.34.3 (bsc#1194019). - CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content. - CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-182=1 Package List: - openSUSE Leap 15.4 (noarch): libwebkit2gtk3-lang-2.34.3-23.3 References: https://www.suse.com/security/cve/CVE-2019-8766.html https://www.suse.com/security/cve/CVE-2019-8782.html https://www.suse.com/security/cve/CVE-2019-8808.html https://www.suse.com/security/cve/CVE-2019-8815.html https://www.suse.com/security/cve/CVE-2020-13753.html https://www.suse.com/security/cve/CVE-2020-27918.html https://www.suse.com/security/cve/CVE-2020-29623.html https://www.suse.com/security/cve/CVE-2020-3902.html https://www.suse.com/security/cve/CVE-2020-9802.html https://www.suse.com/security/cve/CVE-2020-9803.html https://www.suse.com/security/cve/CVE-2020-9805.html https://www.suse.com/security/cve/CVE-2020-9947.html https://www.suse.com/security/cve/CVE-2020-9948.html https://www.suse.com/security/cve/CVE-2020-9951.html https://www.suse.com/security/cve/CVE-2020-9952.html https://www.suse.com/security/cve/CVE-2021-1765.html https://www.suse.com/security/cve/CVE-2021-1788.html https://www.suse.com/security/cve/CVE-2021-1817.html https://www.suse.com/security/cve/CVE-2021-1820.html https://www.suse.com/security/cve/CVE-2021-1825.html https://www.suse.com/security/cve/CVE-2021-1826.html https://www.suse.com/security/cve/CVE-2021-1844.html https://www.suse.com/security/cve/CVE-2021-1871.html https://www.suse.com/security/cve/CVE-2021-30661.html https://www.suse.com/security/cve/CVE-2021-30666.html https://www.suse.com/security/cve/CVE-2021-30682.html https://www.suse.com/security/cve/CVE-2021-30761.html https://www.suse.com/security/cve/CVE-2021-30762.html https://www.suse.com/security/cve/CVE-2021-30809.html https://www.suse.com/security/cve/CVE-2021-30818.html https://www.suse.com/security/cve/CVE-2021-30823.html https://www.suse.com/security/cve/CVE-2021-30836.html https://www.suse.com/security/cve/CVE-2021-30846.html https://www.suse.com/security/cve/CVE-2021-30848.html https://www.suse.com/security/cve/CVE-2021-30849.html https://www.suse.com/security/cve/CVE-2021-30851.html https://www.suse.com/security/cve/CVE-2021-30858.html https://www.suse.com/security/cve/CVE-2021-30884.html https://www.suse.com/security/cve/CVE-2021-30887.html https://www.suse.com/security/cve/CVE-2021-30888.html https://www.suse.com/security/cve/CVE-2021-30889.html https://www.suse.com/security/cve/CVE-2021-30890.html https://www.suse.com/security/cve/CVE-2021-30897.html https://bugzilla.suse.com/1194019

1 0

openSUSE-SU-2022:0184-2: important: Security update for json-c
by opensuse-security＠opensuse.org 17 Feb '22

17 Feb '22

openSUSE Security Update: Security update for json-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0184-2 Rating: important References: #1171479 Cross-References: CVE-2020-12762 CVSS scores: CVE-2020-12762 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-12762 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for json-c fixes the following issues: - CVE-2020-12762: Fixed integer overflow and out-of-bounds write. (bsc#1171479) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-184=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): json-c-debugsource-0.13-3.3.1 libjson-c-devel-0.13-3.3.1 libjson-c3-0.13-3.3.1 libjson-c3-debuginfo-0.13-3.3.1 - openSUSE Leap 15.4 (x86_64): libjson-c3-32bit-0.13-3.3.1 libjson-c3-32bit-debuginfo-0.13-3.3.1 - openSUSE Leap 15.4 (noarch): libjson-c-doc-0.13-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12762.html https://bugzilla.suse.com/1171479

1 0