March 2022 - openSUSE Security Announce

openSUSE-SU-2022:0096-1: important: Security update for fish3
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for fish3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0096-1 Rating: important References: #1197139 Cross-References: CVE-2022-20001 CVSS scores: CVE-2022-20001 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-20001 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fish3 fixes the following issues: - CVE-2022-20001: Navigating to a compromised git repository may lead to arbitrary code execution (bsc#1197139) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-96=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): fish3-3.3.1-bp153.2.10.1 fish3-devel-3.3.1-bp153.2.10.1 References: https://www.suse.com/security/cve/CVE-2022-20001.html https://bugzilla.suse.com/1197139

1 0

openSUSE-SU-2022:1064-1: moderate: Security update for python2-numpy
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for python2-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1064-1 Rating: moderate References: #1193907 #1193911 #1193913 Cross-References: CVE-2021-33430 CVE-2021-41495 CVE-2021-41496 CVSS scores: CVE-2021-33430 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-33430 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-41495 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-41495 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-41496 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-41496 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python2-numpy fixes the following issues: - CVE-2021-33430: Fixed buffer overflow that could lead to DoS in PyArray_NewFromDescr_int function of ctors.c (bsc#1193913). - CVE-2021-41496: Fixed buffer overflow that could lead to DoS in array_from_pyobj function of fortranobject.c (bsc#1193907). - CVE-2021-41495: Fixed Null Pointer Dereference in numpy.sort due to missing return value validation (bsc#1193911). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1064=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python2-numpy-1.16.5-150200.3.5.1 python2-numpy-debuginfo-1.16.5-150200.3.5.1 python2-numpy-debugsource-1.16.5-150200.3.5.1 python2-numpy-devel-1.16.5-150200.3.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): python-numpy_1_16_5-gnu-hpc-debugsource-1.16.5-150200.3.5.1 python2-numpy-gnu-hpc-1.16.5-150200.3.5.1 python2-numpy-gnu-hpc-devel-1.16.5-150200.3.5.1 python2-numpy_1_16_5-gnu-hpc-1.16.5-150200.3.5.1 python2-numpy_1_16_5-gnu-hpc-debuginfo-1.16.5-150200.3.5.1 python2-numpy_1_16_5-gnu-hpc-devel-1.16.5-150200.3.5.1 References: https://www.suse.com/security/cve/CVE-2021-33430.html https://www.suse.com/security/cve/CVE-2021-41495.html https://www.suse.com/security/cve/CVE-2021-41496.html https://bugzilla.suse.com/1193907 https://bugzilla.suse.com/1193911 https://bugzilla.suse.com/1193913

1 0

openSUSE-SU-2022:1065-1: important: Security update for kernel-firmware
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1065-1 Rating: important References: #1186938 #1188662 #1192953 #1195786 #1196333 Cross-References: CVE-2021-0066 CVE-2021-0071 CVE-2021-0072 CVE-2021-0076 CVE-2021-0161 CVE-2021-0164 CVE-2021-0165 CVE-2021-0166 CVE-2021-0168 CVE-2021-0170 CVE-2021-0172 CVE-2021-0173 CVE-2021-0174 CVE-2021-0175 CVE-2021-0176 CVE-2021-0183 CVE-2021-33139 CVE-2021-33155 CVSS scores: CVE-2021-0066 (NVD) : 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-0066 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-0071 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-0072 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0072 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0076 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-0076 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-0161 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0161 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0164 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-0164 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-0165 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0165 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0166 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0166 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0168 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0168 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0170 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0170 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0172 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0172 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0173 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0173 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0174 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0174 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0175 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0175 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0176 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-0176 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-0183 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-0183 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-33139 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33139 (SUSE): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33155 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33155 (SUSE): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for kernel-firmware fixes the following issues: Update Intel Wireless firmware for 9xxx (INTEL-SA-00539, bsc#1196333): CVE-2021-0161: Improper input validation in firmware for Intel PROSet/Wireless Wi-Fi and Killer Wi-Fi may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2021-0164: Improper access control in firmware for Intel PROSet/Wireless Wi-Fi and Killer Wi-Fi may allow an unauthenticated user to potentially enable escalation of privilege via local access. CVE-2021-0165: Improper input validation in firmware for Intel PROSet/Wireless Wi-Fi and Killer Wi-Fi may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0066: Improper input validation in firmware for Intel PROSet/Wireless Wi-Fi and Killer Wi-Fi may allow an unauthenticated user to potentially enable escalation of privilege via local access. CVE-2021-0166: Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2021-0168: Improper input validation in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2021-0170: Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow an authenticated user to potentially enable information disclosure via local access. CVE-2021-0172: Improper input validation in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0173: Improper Validation of Consistency within input in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0174: Improper Use of Validation Framework in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0175: Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0076: Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a privileged user to potentially enable denial of service via local access. CVE-2021-0176: Improper input validation in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a privileged user to potentially enable denial of service via local access. CVE-2021-0183: Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2021-0072: Improper input validation in firmware for some Intel PROSet/Wireless Wi-Fi and some Killer Wi-Fi may allow a privileged user to potentially enable information disclosure via local access. CVE-2021-0071: Improper input validation in firmware for some Intel PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Update Intel Bluetooth firmware (INTEL-SA-00604,bsc#1195786): - CVE-2021-33139: Improper conditions check in firmware for some Intel Wireless Bluetooth and Killer Bluetooth products before may allow an authenticated user to potentially enable denial of service via adjacent access. - CVE-2021-33155: Improper input validation in firmware for some Intel Wireless Bluetooth and Killer Bluetooth products before may allow an authenticated user to potentially enable denial of service via adjacent access. Bug fixes: - Updated the AMD SEV firmware (bsc#1186938) - Reduced the LZMA2 dictionary size (bsc#1188662) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1065=1 Package List: - openSUSE Leap 15.3 (noarch): kernel-firmware-20210208-150300.4.7.1 kernel-firmware-all-20210208-150300.4.7.1 kernel-firmware-amdgpu-20210208-150300.4.7.1 kernel-firmware-ath10k-20210208-150300.4.7.1 kernel-firmware-ath11k-20210208-150300.4.7.1 kernel-firmware-atheros-20210208-150300.4.7.1 kernel-firmware-bluetooth-20210208-150300.4.7.1 kernel-firmware-bnx2-20210208-150300.4.7.1 kernel-firmware-brcm-20210208-150300.4.7.1 kernel-firmware-chelsio-20210208-150300.4.7.1 kernel-firmware-dpaa2-20210208-150300.4.7.1 kernel-firmware-i915-20210208-150300.4.7.1 kernel-firmware-intel-20210208-150300.4.7.1 kernel-firmware-iwlwifi-20210208-150300.4.7.1 kernel-firmware-liquidio-20210208-150300.4.7.1 kernel-firmware-marvell-20210208-150300.4.7.1 kernel-firmware-media-20210208-150300.4.7.1 kernel-firmware-mediatek-20210208-150300.4.7.1 kernel-firmware-mellanox-20210208-150300.4.7.1 kernel-firmware-mwifiex-20210208-150300.4.7.1 kernel-firmware-network-20210208-150300.4.7.1 kernel-firmware-nfp-20210208-150300.4.7.1 kernel-firmware-nvidia-20210208-150300.4.7.1 kernel-firmware-platform-20210208-150300.4.7.1 kernel-firmware-prestera-20210208-150300.4.7.1 kernel-firmware-qlogic-20210208-150300.4.7.1 kernel-firmware-radeon-20210208-150300.4.7.1 kernel-firmware-realtek-20210208-150300.4.7.1 kernel-firmware-serial-20210208-150300.4.7.1 kernel-firmware-sound-20210208-150300.4.7.1 kernel-firmware-ti-20210208-150300.4.7.1 kernel-firmware-ueagle-20210208-150300.4.7.1 kernel-firmware-usb-network-20210208-150300.4.7.1 ucode-amd-20210208-150300.4.7.1 References: https://www.suse.com/security/cve/CVE-2021-0066.html https://www.suse.com/security/cve/CVE-2021-0071.html https://www.suse.com/security/cve/CVE-2021-0072.html https://www.suse.com/security/cve/CVE-2021-0076.html https://www.suse.com/security/cve/CVE-2021-0161.html https://www.suse.com/security/cve/CVE-2021-0164.html https://www.suse.com/security/cve/CVE-2021-0165.html https://www.suse.com/security/cve/CVE-2021-0166.html https://www.suse.com/security/cve/CVE-2021-0168.html https://www.suse.com/security/cve/CVE-2021-0170.html https://www.suse.com/security/cve/CVE-2021-0172.html https://www.suse.com/security/cve/CVE-2021-0173.html https://www.suse.com/security/cve/CVE-2021-0174.html https://www.suse.com/security/cve/CVE-2021-0175.html https://www.suse.com/security/cve/CVE-2021-0176.html https://www.suse.com/security/cve/CVE-2021-0183.html https://www.suse.com/security/cve/CVE-2021-33139.html https://www.suse.com/security/cve/CVE-2021-33155.html https://bugzilla.suse.com/1186938 https://bugzilla.suse.com/1188662 https://bugzilla.suse.com/1192953 https://bugzilla.suse.com/1195786 https://bugzilla.suse.com/1196333

1 0

openSUSE-SU-2022:0097-1: important: Security update for icingaweb2
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0097-1 Rating: important References: #1196911 #1196913 Cross-References: CVE-2022-24714 CVE-2022-24715 CVSS scores: CVE-2022-24714 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-24715 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24715 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. * Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users (GHSA-v9mv-h52f-7g63 boo#1196911) - CVE-2022-24714: Unwanted disclosure of hosts and related data, linked to decommissioned services (GHSA-qcmg-vr56-x9wf boo#1196913) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-97=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): icingacli-2.8.6-bp153.2.3.1 icingaweb2-2.8.6-bp153.2.3.1 icingaweb2-common-2.8.6-bp153.2.3.1 icingaweb2-vendor-HTMLPurifier-2.8.6-bp153.2.3.1 icingaweb2-vendor-JShrink-2.8.6-bp153.2.3.1 icingaweb2-vendor-Parsedown-2.8.6-bp153.2.3.1 icingaweb2-vendor-dompdf-2.8.6-bp153.2.3.1 icingaweb2-vendor-lessphp-2.8.6-bp153.2.3.1 icingaweb2-vendor-zf1-2.8.6-bp153.2.3.1 php-Icinga-2.8.6-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-24714.html https://www.suse.com/security/cve/CVE-2022-24715.html https://bugzilla.suse.com/1196911 https://bugzilla.suse.com/1196913

1 0

openSUSE-SU-2022:0100-1: moderate: Security update for abcm2ps
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for abcm2ps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0100-1 Rating: moderate References: #1197355 Cross-References: CVE-2021-32434 CVE-2021-32435 CVE-2021-32436 CVSS scores: CVE-2021-32434 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-32435 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-32436 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for abcm2ps fixes the following issues: Update to 8.14.13: * fix: don't start/stop slurs above/below decorations * fix: crash when too many notes in a grace note sequence (#102) * fix: crash when too big value in M: (#103) * fix: loop or crash when too big width of y (space) (#104) * fix: bad font definition with SVG output when spaces in font name * fix: bad check of note length again (#106) * fix: handle %%staffscale at the global level (#108) * fix: bad vertical offset of lyrics when mysic line starts with empty staves Update to 8.14.12: Fixes: * crash when "%%break 1" and no measure bar in the tune * crash when duplicated voice ending on %%staves with repeat variant * crash when voice duplication with symbols without width * crash or bad output when null value in %%scale * problem when only bars in 2 voices followed %%staves of the second voice only * crash when tuplet error in grace note sequence * crash when grace note with empty tuplet * crash when many broken rhythms after a single grace note * access outside the deco array when error in U: * crash when !xstem! with no note in the previous voice * crash on tuplet without any note/rest * crash when grace notes at end of line and voice overlay * crash when !trem2! at start of a grace note sequence * crash when wrong duration in 2 voice overlays and bad ties * crash when accidental without a note at start of line after K: (CVE-2021-32435) * array overflow when wrong duration in voice overlay (CVE-2021-32434, CVE-2021-32436) * loss of left margin after first page since previous commit * no respect of %%leftmargin with -E or -g * bad placement of chord symbols when in a music line with only invisible rests Syntax: * Accept and remove one or two '%'s at start of all %%beginxxx lines Generation: * Move the CSS from XHTML to SVG Update to 8.14.11: * fix: error "'staffwidth' too small" when generating sample3.abc Update to 8.14.10: * fix: bad glyph when defined by SVG containing 'v' in * fix: bad check of note length since commit 191fa55 * fix: memory corruption when error in %%staves/%%score * fix: crash when too big note duration * fix: crash when staff width too small Update to 8.14.9: * fix: bad natural accidental when %%MIDI temperamentequal Update to 8.14.8: * fix: no respect the width in %%staffbreak * fix: don't draw a staff when only %%staffbreak inside * fix: bad repeat bracket when continued on next line, line starting by a bar * fix: bad tuplet bracket again when at end of a voice overlay sequence * fix: bad tuplet bracket when at end of a voice overlay sequence * handle '%%MIDI temperamentequal ' * accept '^1' and '_1' as microtone accidentals Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-100=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): abcm2ps-8.14.13-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-32434.html https://www.suse.com/security/cve/CVE-2021-32435.html https://www.suse.com/security/cve/CVE-2021-32436.html https://bugzilla.suse.com/1197355

1 0

openSUSE-SU-2022:0098-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0098-1 Rating: moderate References: #1196905 #1196908 #1196952 Cross-References: CVE-2021-41239 CVE-2021-41241 CVE-2021-41741 CVSS scores: CVE-2021-41239 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-41239 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905) - CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908) - CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952) - For more changes see https://nextcloud.com/changelog/#21-0-9 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-98=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): nextcloud-21.0.9-bp153.2.12.1 nextcloud-apache-21.0.9-bp153.2.12.1 References: https://www.suse.com/security/cve/CVE-2021-41239.html https://www.suse.com/security/cve/CVE-2021-41241.html https://www.suse.com/security/cve/CVE-2021-41741.html https://bugzilla.suse.com/1196905 https://bugzilla.suse.com/1196908 https://bugzilla.suse.com/1196952

1 0

openSUSE-SU-2022:0095-1: moderate: Security update for openSUSE-build-key
by opensuse-security＠opensuse.org 31 Mar '22

31 Mar '22

openSUSE Security Update: Security update for openSUSE-build-key ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0095-1 Rating: moderate References: #1197293 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for openSUSE-build-key fixes the following issues: - Disabled the SLE11 build key as SLE11 is EOL now, also key was 1024bit RSA (removed gpg-pubkey-307e3d54-5aaa90a5.asc) Also obsolete old build key. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-95=1 Package List: - openSUSE Leap 15.3 (noarch): openSUSE-build-key-1.0-lp153.4.8.1 References: https://bugzilla.suse.com/1197293

1 0

openSUSE-SU-2022:1061-1: important: Security update for zlib
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for zlib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1061-1 Rating: important References: #1197459 Cross-References: CVE-2018-25032 CVSS scores: CVE-2018-25032 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zlib fixes the following issues: - CVE-2018-25032: Fixed memory corruption on deflate (bsc#1197459). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1061=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1061=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libminizip1-1.2.11-150000.3.30.1 libminizip1-debuginfo-1.2.11-150000.3.30.1 libz1-1.2.11-150000.3.30.1 libz1-debuginfo-1.2.11-150000.3.30.1 minizip-devel-1.2.11-150000.3.30.1 zlib-debugsource-1.2.11-150000.3.30.1 zlib-devel-1.2.11-150000.3.30.1 zlib-devel-static-1.2.11-150000.3.30.1 - openSUSE Leap 15.4 (x86_64): libminizip1-32bit-1.2.11-150000.3.30.1 libminizip1-32bit-debuginfo-1.2.11-150000.3.30.1 libz1-32bit-1.2.11-150000.3.30.1 libz1-32bit-debuginfo-1.2.11-150000.3.30.1 zlib-devel-32bit-1.2.11-150000.3.30.1 zlib-devel-static-32bit-1.2.11-150000.3.30.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libminizip1-1.2.11-150000.3.30.1 libminizip1-debuginfo-1.2.11-150000.3.30.1 libz1-1.2.11-150000.3.30.1 libz1-debuginfo-1.2.11-150000.3.30.1 minizip-devel-1.2.11-150000.3.30.1 zlib-debugsource-1.2.11-150000.3.30.1 zlib-devel-1.2.11-150000.3.30.1 zlib-devel-static-1.2.11-150000.3.30.1 - openSUSE Leap 15.3 (x86_64): libminizip1-32bit-1.2.11-150000.3.30.1 libminizip1-32bit-debuginfo-1.2.11-150000.3.30.1 libz1-32bit-1.2.11-150000.3.30.1 libz1-32bit-debuginfo-1.2.11-150000.3.30.1 zlib-devel-32bit-1.2.11-150000.3.30.1 zlib-devel-static-32bit-1.2.11-150000.3.30.1 References: https://www.suse.com/security/cve/CVE-2018-25032.html https://bugzilla.suse.com/1197459

1 0

openSUSE-SU-2022:1059-1: important: Security update for salt
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1059-1 Rating: important References: #1197417 Cross-References: CVE-2022-22934 CVE-2022-22935 CVE-2022-22936 CVE-2022-22941 CVSS scores: CVE-2022-22934 (SUSE): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-22935 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22936 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for salt fixes the following issues: - CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417) - CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417) - CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417) - CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1059=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python3-salt-3002.2-150300.53.10.1 salt-3002.2-150300.53.10.1 salt-api-3002.2-150300.53.10.1 salt-cloud-3002.2-150300.53.10.1 salt-doc-3002.2-150300.53.10.1 salt-master-3002.2-150300.53.10.1 salt-minion-3002.2-150300.53.10.1 salt-proxy-3002.2-150300.53.10.1 salt-ssh-3002.2-150300.53.10.1 salt-standalone-formulas-configuration-3002.2-150300.53.10.1 salt-syndic-3002.2-150300.53.10.1 salt-transactional-update-3002.2-150300.53.10.1 - openSUSE Leap 15.3 (noarch): salt-bash-completion-3002.2-150300.53.10.1 salt-fish-completion-3002.2-150300.53.10.1 salt-zsh-completion-3002.2-150300.53.10.1 References: https://www.suse.com/security/cve/CVE-2022-22934.html https://www.suse.com/security/cve/CVE-2022-22935.html https://www.suse.com/security/cve/CVE-2022-22936.html https://www.suse.com/security/cve/CVE-2022-22941.html https://bugzilla.suse.com/1197417

1 0

openSUSE-SU-2022:1037-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1037-1 Rating: important References: #1176447 #1176774 #1178134 #1179439 #1181147 #1191428 #1192273 #1193731 #1193787 #1193864 #1194463 #1194516 #1195211 #1195254 #1195403 #1195612 #1195897 #1195905 #1195939 #1195949 #1195987 #1196079 #1196095 #1196132 #1196155 #1196299 #1196301 #1196433 #1196468 #1196472 #1196627 #1196723 #1196779 #1196830 #1196836 #1196866 #1196868 Cross-References: CVE-2021-0920 CVE-2021-39657 CVE-2021-44879 CVE-2022-0487 CVE-2022-0617 CVE-2022-0644 CVE-2022-24448 CVE-2022-24958 CVE-2022-24959 CVE-2022-25258 CVE-2022-25636 CVE-2022-26490 CVSS scores: CVE-2021-0920 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0920 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39657 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24958 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24958 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (SUSE): 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 25 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155) - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096). - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731). - CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864). The following non-security bugs were fixed: - ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes). - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes). - ARM: Fix kgdb breakpoint for Thumb2 (git-fixes). - ASoC: cs4265: Fix the duplicated control name (git-fixes). - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes). - ASoC: rt5668: do not block workqueue if card is unbound (git-fixes). - ASoC: rt5682: do not block workqueue if card is unbound (git-fixes). - Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779). - EDAC/altera: Fix deferred probing (bsc#1178134). - HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes). - HID: add mapping for KEY_DICTATE (git-fixes). - Hand over the maintainership to SLE15-SP3 maintainers - IB/hfi1: Correct guard on eager buffer deallocation (git-fixes). - IB/hfi1: Fix early init panic (git-fixes). - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes). - IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes). - IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes). - Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes). - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes). - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes). - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" (git-fixes). - RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147). - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes). - RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes). - RDMA/core: Do not infoleak GRH fields (git-fixes). - RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes). - RDMA/cxgb4: Set queue pair state when being queried (git-fixes). - RDMA/hns: Validate the pkey index (git-fixes). - RDMA/ib_srp: Fix a deadlock (git-fixes). - RDMA/mlx4: Do not continue event handler after memory allocation failure (git-fixes). - RDMA/rtrs-clt: Fix possible double free in error case (jsc#SLE-15176). - RDMA/rxe: Fix a typo in opcode name (git-fixes). - RDMA/siw: Fix broken RDMA Read Fence/Resume logic (git-fixes). - RDMA/uverbs: Check for null return of kmalloc_array (git-fixes). - RDMA/uverbs: Remove the unnecessary assignment (git-fixes). - Revert "USB: serial: ch341: add new Product ID for CH341A" (git-fixes). - SUNRPC: avoid race between mod_timer() and del_timer_sync() (bnc#1195403). - USB: gadget: validate endpoint index for xilinx udc (git-fixes). - USB: gadget: validate interface OS descriptor requests (git-fixes). - USB: hub: Clean up use of port initialization schemes and retries (git-fixes). - USB: serial: option: add Telit LE910R1 compositions (git-fixes). - USB: serial: option: add support for DW5829e (git-fixes). - USB: zaurus: support another broken Zaurus (git-fixes). - arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output (git-fixes). - asix: fix uninit-value in asix_mdio_read() (git-fixes). - ata: pata_hpt37x: disable primary channel on HPT371 (git-fixes). - batman-adv: Do not expect inter-netns unique iflink indices (git-fixes). - batman-adv: Request iflink once in batadv-on-batadv check (git-fixes). - batman-adv: Request iflink once in batadv_get_real_netdevice (git-fixes). - blk-mq: do not free tags if the tag_set is used by other device in queue initialztion (bsc#1193787). - bnxt_en: Fix active FEC reporting to ethtool (jsc#SLE-16649). - bnxt_en: Fix incorrect multicast rx mask setting when not requested (git-fixes). - bnxt_en: Fix occasional ethtool -t loopback test failures (git-fixes). - bnxt_en: Fix offline ethtool selftest with RDMA enabled (git-fixes). - bonding: force carrier update when releasing slave (git-fixes). - can: gs_usb: change active_channels's type from atomic_t to u8 (git-fixes). - cgroup-v1: Correct privileges check in release_agent writes (bsc#1196723). - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning (bsc#1196868). - clk: jz4725b: fix mmc0 clock gating (git-fixes). - cpufreq: schedutil: Use kobject release() method to free (git-fixes) - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() (bsc#1196866). - cputime, cpuacct: Include guest time in user time in (git-fixes) - dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278). - dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278). - dmaengine: shdma: Fix runtime PM imbalance on error (git-fixes). - drm/amdgpu: disable MMHUB PG for Picasso (git-fixes). - drm/edid: Always set RGB444 (git-fixes). - drm/i915/dg1: Wait for pcode/uncore handshake at startup (bsc#1195211). - drm/i915/gen11+: Only load DRAM information from pcode (bsc#1195211). - drm/i915: Nuke not needed members of dram_info (bsc#1195211). - drm/i915: Remove memory frequency calculation (bsc#1195211). - drm/i915: Rename is_16gb_dimm to wm_lv_0_adjust_needed (bsc#1195211). - efivars: Respect "block" flag in efivar_entry_set_safe() (git-fixes). - exfat: fix i_blocks for files truncated over 4 GiB (git-fixes). - exfat: fix incorrect loading of i_blocks for large files (git-fixes). - firmware: arm_scmi: Remove space in MODULE_ALIAS name (git-fixes). - gpio: rockchip: Reset int_bothedge when changing trigger (git-fixes). - gpio: tegra186: Fix chip_data type confusion (git-fixes). - gtp: remove useless rcu_read_lock() (git-fixes). - hamradio: fix macro redefine warning (git-fixes). - i2c: bcm2835: Avoid clock stretching timeouts (git-fixes). - iavf: Fix missing check for running netdev (git-fixes). - ice: initialize local variable 'tlv' (jsc#SLE-12878). - igc: igc_read_phy_reg_gpy: drop premature return (git-fixes). - igc: igc_write_phy_reg_gpy: drop premature return (git-fixes). - iio: Fix error handling for PM (git-fixes). - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits (git-fixes). - iio: adc: men_z188_adc: Fix a resource leak in an error handling path (git-fixes). - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() (git-fixes). - mac80211: fix forwarded mesh frames AC & queue selection (git-fixes). - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work (git-fixes). - mac80211_hwsim: report NOACK frames in tx_status (git-fixes). - mask out added spinlock in rndis_params (git-fixes). - net/mlx5: Fix possible deadlock on rule deletion (git-fixes). - net/mlx5: Fix wrong limitation of metadata match on ecpf (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5e: Fix modify header actions memory leak (git-fixes). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure (git-fixes). - net/mlx5e: TC, Reject rules with drop and modify hdr action (git-fixes). - net/mlx5e: TC, Reject rules with forward and drop actions (git-fixes). - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets (jsc#SLE-15172). - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones (jsc#SLE-15172). - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (git-fixes). - net: ethernet: ti: cpsw: disable PTPv1 hw timestamping advertisement (git-fixes). - net: fix up skbs delta_truesize in UDP GRO frag_list (bsc#1176447). - net: hns3: Clear the CMDQ registers before unmapping BAR region (git-fixes). - net: sfc: Replace in_interrupt() usage (git-fixes). - net: tipc: validate domain record count on input (bsc#1195254). - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 (git-fixes). - netfilter: nf_tables: fix memory leak during stateful obj update (bsc#1176447). - netsec: ignore 'phy-mode' device property on ACPI systems (git-fixes). - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() (git-fixes). - nl80211: Handle nla_memdup failures in handle_nan_filter (git-fixes). - ntb: intel: fix port config status offset for SPR (git-fixes). - nvme-multipath: use vmalloc for ANA log buffer (bsc#1193787). - nvme-rdma: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme-tcp: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme: fix a possible use-after-free in controller reset during load (git-fixes). - powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278). Update config files. - powerpc/fadump: register for fadump as early as possible (bsc#1179439 ltc#190038). - powerpc/mm: Remove dcache flush from memory remove (bsc#1196433 ltc#196449). - powerpc/powernv/memtrace: Fix dcache flushing (bsc#1196433 ltc#196449). - powerpc/pseries/iommu: Fix window size for direct mapping with pmem (bsc#1196472 ltc#192278). - sched/core: Mitigate race (git-fixes) - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (git-fixes). - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (git-fixes). - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (git-fixes). - scsi: nsp_cs: Check of ioremap return value (git-fixes). - scsi: qedf: Fix potential dereference of NULL pointer (git-fixes). - scsi: smartpqi: Add PCI IDs (bsc#1196627). - scsi: ufs: Fix race conditions related to driver data (git-fixes). - selftests: mlxsw: tc_police_scale: Make test more robust (bsc#1176774). - soc: fsl: Correct MAINTAINERS database (QUICC ENGINE LIBRARY) (git-fixes). - soc: fsl: Correct MAINTAINERS database (SOC) (git-fixes). - soc: fsl: qe: Check of ioremap return value (git-fixes). - spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() (git-fixes). - sr9700: sanity check for packet length (bsc#1196836). - tracing: Fix return value of __setup handlers (git-fixes). - tty: n_gsm: fix encoding of control signal octet bit DV (git-fixes). - tty: n_gsm: fix proper link termination after failed open (git-fixes). - usb: dwc2: use well defined macros for power_down (git-fixes). - usb: dwc3: gadget: Let the interrupt handler disable bottom halves (git-fixes). - usb: dwc3: pci: Fix Bay Trail phy GPIO mappings (git-fixes). - usb: gadget: rndis: add spinlock for rndis response list (git-fixes). - usb: hub: Fix usb enumeration issue due to address0 race (git-fixes). - vrf: Fix fast path output packet handling with async Netfilter rules (git-fixes). - xhci: Prevent futile URB re-submissions due to incorrect return value (git-fixes). - xhci: re-initialize the HC during resume if HCE was set (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1037=1 Package List: - openSUSE Leap 15.3 (x86_64): cluster-md-kmp-azure-5.3.18-150300.38.50.1 cluster-md-kmp-azure-debuginfo-5.3.18-150300.38.50.1 dlm-kmp-azure-5.3.18-150300.38.50.1 dlm-kmp-azure-debuginfo-5.3.18-150300.38.50.1 gfs2-kmp-azure-5.3.18-150300.38.50.1 gfs2-kmp-azure-debuginfo-5.3.18-150300.38.50.1 kernel-azure-5.3.18-150300.38.50.1 kernel-azure-debuginfo-5.3.18-150300.38.50.1 kernel-azure-debugsource-5.3.18-150300.38.50.1 kernel-azure-devel-5.3.18-150300.38.50.1 kernel-azure-devel-debuginfo-5.3.18-150300.38.50.1 kernel-azure-extra-5.3.18-150300.38.50.1 kernel-azure-extra-debuginfo-5.3.18-150300.38.50.1 kernel-azure-livepatch-devel-5.3.18-150300.38.50.1 kernel-azure-optional-5.3.18-150300.38.50.1 kernel-azure-optional-debuginfo-5.3.18-150300.38.50.1 kernel-syms-azure-5.3.18-150300.38.50.1 kselftests-kmp-azure-5.3.18-150300.38.50.1 kselftests-kmp-azure-debuginfo-5.3.18-150300.38.50.1 ocfs2-kmp-azure-5.3.18-150300.38.50.1 ocfs2-kmp-azure-debuginfo-5.3.18-150300.38.50.1 reiserfs-kmp-azure-5.3.18-150300.38.50.1 reiserfs-kmp-azure-debuginfo-5.3.18-150300.38.50.1 - openSUSE Leap 15.3 (noarch): kernel-devel-azure-5.3.18-150300.38.50.1 kernel-source-azure-5.3.18-150300.38.50.1 References: https://www.suse.com/security/cve/CVE-2021-0920.html https://www.suse.com/security/cve/CVE-2021-39657.html https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24958.html https://www.suse.com/security/cve/CVE-2022-24959.html https://www.suse.com/security/cve/CVE-2022-25258.html https://www.suse.com/security/cve/CVE-2022-25636.html https://www.suse.com/security/cve/CVE-2022-26490.html https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176774 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1179439 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1191428 https://bugzilla.suse.com/1192273 https://bugzilla.suse.com/1193731 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1193864 https://bugzilla.suse.com/1194463 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1195211 https://bugzilla.suse.com/1195254 https://bugzilla.suse.com/1195403 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195905 https://bugzilla.suse.com/1195939 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196095 https://bugzilla.suse.com/1196132 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196299 https://bugzilla.suse.com/1196301 https://bugzilla.suse.com/1196433 https://bugzilla.suse.com/1196468 https://bugzilla.suse.com/1196472 https://bugzilla.suse.com/1196627 https://bugzilla.suse.com/1196723 https://bugzilla.suse.com/1196779 https://bugzilla.suse.com/1196830 https://bugzilla.suse.com/1196836 https://bugzilla.suse.com/1196866 https://bugzilla.suse.com/1196868

1 0

openSUSE-SU-2022:1039-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1039-1 Rating: important References: #1176447 #1176774 #1178134 #1179439 #1181147 #1191428 #1192273 #1193731 #1193787 #1193864 #1194463 #1194516 #1194943 #1195051 #1195211 #1195254 #1195353 #1195403 #1195612 #1195897 #1195905 #1195939 #1195949 #1195987 #1196079 #1196095 #1196130 #1196132 #1196155 #1196299 #1196301 #1196433 #1196468 #1196472 #1196488 #1196627 #1196723 #1196779 #1196830 #1196836 #1196866 #1196868 #1196956 #1196959 Cross-References: CVE-2021-0920 CVE-2021-39657 CVE-2021-39698 CVE-2021-44879 CVE-2021-45402 CVE-2022-0487 CVE-2022-0617 CVE-2022-0644 CVE-2022-23036 CVE-2022-23037 CVE-2022-23038 CVE-2022-23039 CVE-2022-23040 CVE-2022-23041 CVE-2022-23042 CVE-2022-24448 CVE-2022-24958 CVE-2022-24959 CVE-2022-25258 CVE-2022-25636 CVE-2022-26490 CVE-2022-26966 CVSS scores: CVE-2021-0920 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0920 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39657 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39698 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39698 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45402 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-45402 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-23036 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23036 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23037 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23037 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23038 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23038 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23039 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23039 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23040 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23040 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23041 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23041 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23042 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23042 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24958 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24958 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (SUSE): 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-26966 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-26966 (SUSE): 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 22 vulnerabilities and has 22 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155) - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096). - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731). - CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864). - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from heap memory via crafted frame lengths from a device (bsc#1196836). - CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956) - CVE-2021-45402: The check_alu_op function in kernel/bpf/verifier.c did not properly update bounds while handling the mov32 instruction, which allowed local users to obtain potentially sensitive address information (bsc#1196130). - CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040, CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488) The following non-security bugs were fixed: - ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes). - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes). - ARM: Fix kgdb breakpoint for Thumb2 (git-fixes). - ASoC: cs4265: Fix the duplicated control name (git-fixes). - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes). - ASoC: rt5668: do not block workqueue if card is unbound (git-fixes). - ASoC: rt5682: do not block workqueue if card is unbound (git-fixes). - Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779). - EDAC/altera: Fix deferred probing (bsc#1178134). - EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1178134). - HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes). - HID: add mapping for KEY_DICTATE (git-fixes). - Hand over the maintainership to SLE15-SP3 maintainers - IB/hfi1: Correct guard on eager buffer deallocation (git-fixes). - IB/hfi1: Fix early init panic (git-fixes). - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes). - IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes). - IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes). - Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes). - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes). - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes). - NFC: port100: fix use-after-free in port100_send_complete (git-fixes). - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" (git-fixes). - RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147). - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes). - RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes). - RDMA/core: Do not infoleak GRH fields (git-fixes). - RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes). - RDMA/cxgb4: Set queue pair state when being queried (git-fixes). - RDMA/hns: Validate the pkey index (git-fixes). - RDMA/ib_srp: Fix a deadlock (git-fixes). - RDMA/mlx4: Do not continue event handler after memory allocation failure (git-fixes). - RDMA/rtrs-clt: Fix possible double free in error case (jsc#SLE-15176). - RDMA/rxe: Fix a typo in opcode name (git-fixes). - RDMA/siw: Fix broken RDMA Read Fence/Resume logic (git-fixes). - RDMA/uverbs: Check for null return of kmalloc_array (git-fixes). - RDMA/uverbs: Remove the unnecessary assignment (git-fixes). - Revert "USB: serial: ch341: add new Product ID for CH341A" (git-fixes). - SUNRPC: avoid race between mod_timer() and del_timer_sync() (bnc#1195403). - USB: gadget: validate endpoint index for xilinx udc (git-fixes). - USB: gadget: validate interface OS descriptor requests (git-fixes). - USB: hub: Clean up use of port initialization schemes and retries (git-fixes). - USB: serial: option: add Telit LE910R1 compositions (git-fixes). - USB: serial: option: add support for DW5829e (git-fixes). - USB: zaurus: support another broken Zaurus (git-fixes). - arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output (git-fixes). - asix: fix uninit-value in asix_mdio_read() (git-fixes). - ata: pata_hpt37x: disable primary channel on HPT371 (git-fixes). - ax25: Fix NULL pointer dereference in ax25_kill_by_device (git-fixes). - batman-adv: Do not expect inter-netns unique iflink indices (git-fixes). - batman-adv: Request iflink once in batadv-on-batadv check (git-fixes). - batman-adv: Request iflink once in batadv_get_real_netdevice (git-fixes). - blk-mq: do not free tags if the tag_set is used by other device in queue initialztion (bsc#1193787). - bnxt_en: Fix active FEC reporting to ethtool (jsc#SLE-16649). - bnxt_en: Fix incorrect multicast rx mask setting when not requested (git-fixes). - bnxt_en: Fix occasional ethtool -t loopback test failures (git-fixes). - bnxt_en: Fix offline ethtool selftest with RDMA enabled (git-fixes). - bonding: force carrier update when releasing slave (git-fixes). - build initrd without systemd This reduces the size of the initrd by over 25%, which improves startup time of the virtual machine by 0.5-0.6s on very fast machines, more on slower ones. - can: gs_usb: change active_channels's type from atomic_t to u8 (git-fixes). - cgroup-v1: Correct privileges check in release_agent writes (bsc#1196723). - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning (bsc#1196868). - clk: jz4725b: fix mmc0 clock gating (git-fixes). - constraints: Also adjust disk requirement for x86 and s390. - constraints: Increase disk space for aarch64 - cpufreq: schedutil: Use kobject release() method to free (git-fixes) - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() (bsc#1196866). - cputime, cpuacct: Include guest time in user time in (git-fixes) - dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278). - dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278). - dmaengine: shdma: Fix runtime PM imbalance on error (git-fixes). - drm/amdgpu: disable MMHUB PG for Picasso (git-fixes). - drm/edid: Always set RGB444 (git-fixes). - drm/i915/dg1: Wait for pcode/uncore handshake at startup (bsc#1195211). - drm/i915/gen11+: Only load DRAM information from pcode (bsc#1195211). - drm/i915: Nuke not needed members of dram_info (bsc#1195211). - drm/i915: Remove memory frequency calculation (bsc#1195211). - drm/i915: Rename is_16gb_dimm to wm_lv_0_adjust_needed (bsc#1195211). - drm/sun4i: mixer: Fix P010 and P210 format numbers (git-fixes). - efivars: Respect "block" flag in efivar_entry_set_safe() (git-fixes). - exfat: fix i_blocks for files truncated over 4 GiB (git-fixes). - exfat: fix incorrect loading of i_blocks for large files (git-fixes). - firmware: arm_scmi: Remove space in MODULE_ALIAS name (git-fixes). - fix rpm build warning tumbleweed rpm is adding these warnings to the log: It's not recommended to have unversioned Obsoletes: Obsoletes: microcode_ctl - gianfar: ethtool: Fix refcount leak in gfar_get_ts_info (git-fixes). - gpio: rockchip: Reset int_bothedge when changing trigger (git-fixes). - gpio: tegra186: Fix chip_data type confusion (git-fixes). - gpio: ts4900: Do not set DAT and OE together (git-fixes). - gpiolib: acpi: Convert ACPI value of debounce to microseconds (git-fixes). - gtp: remove useless rcu_read_lock() (git-fixes). - hamradio: fix macro redefine warning (git-fixes). - i2c: bcm2835: Avoid clock stretching timeouts (git-fixes). - iavf: Fix missing check for running netdev (git-fixes). - ice: initialize local variable 'tlv' (jsc#SLE-12878). - igc: igc_read_phy_reg_gpy: drop premature return (git-fixes). - igc: igc_write_phy_reg_gpy: drop premature return (git-fixes). - iio: Fix error handling for PM (git-fixes). - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits (git-fixes). - iio: adc: men_z188_adc: Fix a resource leak in an error handling path (git-fixes). - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() (git-fixes). - kernel-binary.spec.in: Move 20-kernel-default-extra.conf to the correctr directory (bsc#1195051). - kernel-binary.spec: Also exclude the kernel signing key from devel package. There is a check in OBS that fails when it is included. Also the key is not reproducible. Fixes: bb988d4625a3 ("kernel-binary: Do not include sourcedir in certificate path.") - kernel-binary.spec: Do not use the default certificate path (bsc#1194943). Using the the default path is broken since Linux 5.17 - kernel-binary: Do not include sourcedir in certificate path. The certs macro runs before build directory is set up so it creates the aggregate of supplied certificates in the source directory. Using this file directly as the certificate in kernel config works but embeds the source directory path in the kernel config. To avoid this symlink the certificate to the build directory and use relative path to refer to it. Also fabricate a certificate in the same location in build directory when none is provided. - kernel-obs-build: include 9p (boo#1195353) To be able to share files between host and the qemu vm of the build script, the 9p and 9p_virtio kernel modules need to be included in the initrd of kernel-obs-build. - mac80211: fix forwarded mesh frames AC & queue selection (git-fixes). - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work (git-fixes). - mac80211_hwsim: report NOACK frames in tx_status (git-fixes). - mask out added spinlock in rndis_params (git-fixes). - mmc: meson: Fix usage of meson_mmc_post_req() (git-fixes). - net/mlx5: Fix possible deadlock on rule deletion (git-fixes). - net/mlx5: Fix wrong limitation of metadata match on ecpf (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5e: Fix modify header actions memory leak (git-fixes). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure (git-fixes). - net/mlx5e: TC, Reject rules with drop and modify hdr action (git-fixes). - net/mlx5e: TC, Reject rules with forward and drop actions (git-fixes). - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets (jsc#SLE-15172). - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones (jsc#SLE-15172). - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (git-fixes). - net: ethernet: ti: cpsw: disable PTPv1 hw timestamping advertisement (git-fixes). - net: fix up skbs delta_truesize in UDP GRO frag_list (bsc#1176447). - net: hns3: Clear the CMDQ registers before unmapping BAR region (git-fixes). - net: phy: DP83822: clear MISR2 register to disable interrupts (git-fixes). - net: sfc: Replace in_interrupt() usage (git-fixes). - net: tipc: validate domain record count on input (bsc#1195254). - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 (git-fixes). - netfilter: nf_tables: fix memory leak during stateful obj update (bsc#1176447). - netsec: ignore 'phy-mode' device property on ACPI systems (git-fixes). - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() (git-fixes). - nl80211: Handle nla_memdup failures in handle_nan_filter (git-fixes). - ntb: intel: fix port config status offset for SPR (git-fixes). - nvme-multipath: use vmalloc for ANA log buffer (bsc#1193787). - nvme-rdma: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme-tcp: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme: fix a possible use-after-free in controller reset during load (git-fixes). - powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278). Update config files. - powerpc/fadump: register for fadump as early as possible (bsc#1179439 ltc#190038). - powerpc/mm: Remove dcache flush from memory remove (bsc#1196433 ltc#196449). - powerpc/powernv/memtrace: Fix dcache flushing (bsc#1196433 ltc#196449). - powerpc/pseries/iommu: Fix window size for direct mapping with pmem (bsc#1196472 ltc#192278). - rpm/*.spec.in: Use https:// urls - rpm/arch-symbols,guards,*driver: Replace Novell with SUSE. - rpm/check-for-config-changes: Ignore PAHOLE_VERSION. - rpm/kernel-docs.spec.in: use %%license for license declarations Limited to SLE15+ to avoid compatibility nightmares. - rpm/kernel-source.spec.in: call fdupes per subpackage It is a waste of time to do a global fdupes when we have subpackages. - rpm: SC2006: Use $(...) notation instead of legacy backticked `...`. - sched/core: Mitigate race (git-fixes) - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (git-fixes). - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (git-fixes). - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (git-fixes). - scsi: nsp_cs: Check of ioremap return value (git-fixes). - scsi: qedf: Fix potential dereference of NULL pointer (git-fixes). - scsi: smartpqi: Add PCI IDs (bsc#1196627). - scsi: ufs: Fix race conditions related to driver data (git-fixes). - selftests: mlxsw: tc_police_scale: Make test more robust (bsc#1176774). - soc: fsl: Correct MAINTAINERS database (QUICC ENGINE LIBRARY) (git-fixes). - soc: fsl: Correct MAINTAINERS database (SOC) (git-fixes). - soc: fsl: qe: Check of ioremap return value (git-fixes). - spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() (git-fixes). - sr9700: sanity check for packet length (bsc#1196836). - staging: gdm724x: fix use after free in gdm_lte_rx() (git-fixes). - tracing: Fix return value of __setup handlers (git-fixes). - tty: n_gsm: fix encoding of control signal octet bit DV (git-fixes). - tty: n_gsm: fix proper link termination after failed open (git-fixes). - usb: dwc2: Fix Stalling a Non-Isochronous OUT EP (git-fixes). - usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode (git-fixes). - usb: dwc2: gadget: Fix kill_all_requests race (git-fixes). - usb: dwc2: use well defined macros for power_down (git-fixes). - usb: dwc3: gadget: Let the interrupt handler disable bottom halves (git-fixes). - usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe (git-fixes). - usb: dwc3: pci: Fix Bay Trail phy GPIO mappings (git-fixes). - usb: gadget: rndis: add spinlock for rndis response list (git-fixes). - usb: host: xen-hcd: add missing unlock in error path (git-fixes). - usb: hub: Fix locking issues with address0_mutex (git-fixes). - usb: hub: Fix usb enumeration issue due to address0 race (git-fixes). - vrf: Fix fast path output packet handling with async Netfilter rules (git-fixes). - xen/usb: do not use gnttab_end_foreign_access() in xenhcd_gnttab_done() (bsc#1196488, XSA-396). - xhci: Prevent futile URB re-submissions due to incorrect return value (git-fixes). - xhci: re-initialize the HC during resume if HCE was set (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1039=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1039=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.60.4 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-preempt-5.3.18-150300.59.60.4 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-preempt-5.3.18-150300.59.60.4 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-5.3.18-150300.59.60.4 kernel-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-debugsource-5.3.18-150300.59.60.4 kernel-preempt-devel-5.3.18-150300.59.60.4 kernel-preempt-devel-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-extra-5.3.18-150300.59.60.4 kernel-preempt-extra-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-livepatch-devel-5.3.18-150300.59.60.4 kernel-preempt-optional-5.3.18-150300.59.60.4 kernel-preempt-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-preempt-5.3.18-150300.59.60.4 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.4 (aarch64): dtb-al-5.3.18-150300.59.60.4 dtb-zte-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-5.3.18-150300.59.60.4 cluster-md-kmp-default-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-default-5.3.18-150300.59.60.4 dlm-kmp-default-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-default-5.3.18-150300.59.60.4 gfs2-kmp-default-debuginfo-5.3.18-150300.59.60.4 kernel-default-5.3.18-150300.59.60.4 kernel-default-base-5.3.18-150300.59.60.4.150300.18.37.5 kernel-default-base-rebuild-5.3.18-150300.59.60.4.150300.18.37.5 kernel-default-debuginfo-5.3.18-150300.59.60.4 kernel-default-debugsource-5.3.18-150300.59.60.4 kernel-default-devel-5.3.18-150300.59.60.4 kernel-default-devel-debuginfo-5.3.18-150300.59.60.4 kernel-default-extra-5.3.18-150300.59.60.4 kernel-default-extra-debuginfo-5.3.18-150300.59.60.4 kernel-default-livepatch-5.3.18-150300.59.60.4 kernel-default-livepatch-devel-5.3.18-150300.59.60.4 kernel-default-optional-5.3.18-150300.59.60.4 kernel-default-optional-debuginfo-5.3.18-150300.59.60.4 kernel-obs-build-5.3.18-150300.59.60.4 kernel-obs-build-debugsource-5.3.18-150300.59.60.4 kernel-obs-qa-5.3.18-150300.59.60.4 kernel-syms-5.3.18-150300.59.60.4 kselftests-kmp-default-5.3.18-150300.59.60.4 kselftests-kmp-default-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-default-5.3.18-150300.59.60.4 ocfs2-kmp-default-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-default-5.3.18-150300.59.60.4 reiserfs-kmp-default-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-5.3.18-150300.59.60.4 kernel-debug-debuginfo-5.3.18-150300.59.60.4 kernel-debug-debugsource-5.3.18-150300.59.60.4 kernel-debug-devel-5.3.18-150300.59.60.4 kernel-debug-devel-debuginfo-5.3.18-150300.59.60.4 kernel-debug-livepatch-devel-5.3.18-150300.59.60.4 kernel-kvmsmall-5.3.18-150300.59.60.4 kernel-kvmsmall-debuginfo-5.3.18-150300.59.60.4 kernel-kvmsmall-debugsource-5.3.18-150300.59.60.4 kernel-kvmsmall-devel-5.3.18-150300.59.60.4 kernel-kvmsmall-devel-debuginfo-5.3.18-150300.59.60.4 kernel-kvmsmall-livepatch-devel-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.60.4 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-preempt-5.3.18-150300.59.60.4 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-preempt-5.3.18-150300.59.60.4 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-5.3.18-150300.59.60.4 kernel-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-debugsource-5.3.18-150300.59.60.4 kernel-preempt-devel-5.3.18-150300.59.60.4 kernel-preempt-devel-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-extra-5.3.18-150300.59.60.4 kernel-preempt-extra-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-livepatch-devel-5.3.18-150300.59.60.4 kernel-preempt-optional-5.3.18-150300.59.60.4 kernel-preempt-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-preempt-5.3.18-150300.59.60.4 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64): cluster-md-kmp-64kb-5.3.18-150300.59.60.4 cluster-md-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-64kb-5.3.18-150300.59.60.4 dlm-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 dtb-al-5.3.18-150300.59.60.4 dtb-allwinner-5.3.18-150300.59.60.4 dtb-altera-5.3.18-150300.59.60.4 dtb-amd-5.3.18-150300.59.60.4 dtb-amlogic-5.3.18-150300.59.60.4 dtb-apm-5.3.18-150300.59.60.4 dtb-arm-5.3.18-150300.59.60.4 dtb-broadcom-5.3.18-150300.59.60.4 dtb-cavium-5.3.18-150300.59.60.4 dtb-exynos-5.3.18-150300.59.60.4 dtb-freescale-5.3.18-150300.59.60.4 dtb-hisilicon-5.3.18-150300.59.60.4 dtb-lg-5.3.18-150300.59.60.4 dtb-marvell-5.3.18-150300.59.60.4 dtb-mediatek-5.3.18-150300.59.60.4 dtb-nvidia-5.3.18-150300.59.60.4 dtb-qcom-5.3.18-150300.59.60.4 dtb-renesas-5.3.18-150300.59.60.4 dtb-rockchip-5.3.18-150300.59.60.4 dtb-socionext-5.3.18-150300.59.60.4 dtb-sprd-5.3.18-150300.59.60.4 dtb-xilinx-5.3.18-150300.59.60.4 dtb-zte-5.3.18-150300.59.60.4 gfs2-kmp-64kb-5.3.18-150300.59.60.4 gfs2-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-5.3.18-150300.59.60.4 kernel-64kb-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-debugsource-5.3.18-150300.59.60.4 kernel-64kb-devel-5.3.18-150300.59.60.4 kernel-64kb-devel-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-extra-5.3.18-150300.59.60.4 kernel-64kb-extra-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-livepatch-devel-5.3.18-150300.59.60.4 kernel-64kb-optional-5.3.18-150300.59.60.4 kernel-64kb-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-64kb-5.3.18-150300.59.60.4 kselftests-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-64kb-5.3.18-150300.59.60.4 ocfs2-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-64kb-5.3.18-150300.59.60.4 reiserfs-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (noarch): kernel-devel-5.3.18-150300.59.60.4 kernel-docs-5.3.18-150300.59.60.4 kernel-docs-html-5.3.18-150300.59.60.4 kernel-macros-5.3.18-150300.59.60.4 kernel-source-5.3.18-150300.59.60.4 kernel-source-vanilla-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (s390x): kernel-zfcpdump-5.3.18-150300.59.60.4 kernel-zfcpdump-debuginfo-5.3.18-150300.59.60.4 kernel-zfcpdump-debugsource-5.3.18-150300.59.60.4 References: https://www.suse.com/security/cve/CVE-2021-0920.html https://www.suse.com/security/cve/CVE-2021-39657.html https://www.suse.com/security/cve/CVE-2021-39698.html https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2021-45402.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-23036.html https://www.suse.com/security/cve/CVE-2022-23037.html https://www.suse.com/security/cve/CVE-2022-23038.html https://www.suse.com/security/cve/CVE-2022-23039.html https://www.suse.com/security/cve/CVE-2022-23040.html https://www.suse.com/security/cve/CVE-2022-23041.html https://www.suse.com/security/cve/CVE-2022-23042.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24958.html https://www.suse.com/security/cve/CVE-2022-24959.html https://www.suse.com/security/cve/CVE-2022-25258.html https://www.suse.com/security/cve/CVE-2022-25636.html https://www.suse.com/security/cve/CVE-2022-26490.html https://www.suse.com/security/cve/CVE-2022-26966.html https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176774 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1179439 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1191428 https://bugzilla.suse.com/1192273 https://bugzilla.suse.com/1193731 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1193864 https://bugzilla.suse.com/1194463 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1194943 https://bugzilla.suse.com/1195051 https://bugzilla.suse.com/1195211 https://bugzilla.suse.com/1195254 https://bugzilla.suse.com/1195353 https://bugzilla.suse.com/1195403 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195905 https://bugzilla.suse.com/1195939 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196095 https://bugzilla.suse.com/1196130 https://bugzilla.suse.com/1196132 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196299 https://bugzilla.suse.com/1196301 https://bugzilla.suse.com/1196433 https://bugzilla.suse.com/1196468 https://bugzilla.suse.com/1196472 https://bugzilla.suse.com/1196488 https://bugzilla.suse.com/1196627 https://bugzilla.suse.com/1196723 https://bugzilla.suse.com/1196779 https://bugzilla.suse.com/1196830 https://bugzilla.suse.com/1196836 https://bugzilla.suse.com/1196866 https://bugzilla.suse.com/1196868 https://bugzilla.suse.com/1196956 https://bugzilla.suse.com/1196959

1 0

openSUSE-SU-2022:1040-1: moderate: Security update for protobuf
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for protobuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1040-1 Rating: moderate References: #1195258 Cross-References: CVE-2021-22570 CVSS scores: CVE-2021-22570 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22570 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for protobuf fixes the following issues: - CVE-2021-22570: Fix incorrect parsing of nullchar in the proto symbol (bsc#1195258). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1040=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1040=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libprotobuf-lite20-3.9.2-4.12.1 libprotobuf-lite20-debuginfo-3.9.2-4.12.1 libprotobuf20-3.9.2-4.12.1 libprotobuf20-debuginfo-3.9.2-4.12.1 libprotoc20-3.9.2-4.12.1 libprotoc20-debuginfo-3.9.2-4.12.1 protobuf-debugsource-3.9.2-4.12.1 protobuf-devel-3.9.2-4.12.1 protobuf-devel-debuginfo-3.9.2-4.12.1 protobuf-java-3.9.2-4.12.1 python2-protobuf-3.9.2-4.12.1 python3-protobuf-3.9.2-4.12.1 - openSUSE Leap 15.4 (x86_64): libprotobuf-lite20-32bit-3.9.2-4.12.1 libprotobuf-lite20-32bit-debuginfo-3.9.2-4.12.1 libprotobuf20-32bit-3.9.2-4.12.1 libprotobuf20-32bit-debuginfo-3.9.2-4.12.1 libprotoc20-32bit-3.9.2-4.12.1 libprotoc20-32bit-debuginfo-3.9.2-4.12.1 - openSUSE Leap 15.4 (noarch): protobuf-source-3.9.2-4.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libprotobuf-lite20-3.9.2-4.12.1 libprotobuf-lite20-debuginfo-3.9.2-4.12.1 libprotobuf20-3.9.2-4.12.1 libprotobuf20-debuginfo-3.9.2-4.12.1 libprotoc20-3.9.2-4.12.1 libprotoc20-debuginfo-3.9.2-4.12.1 protobuf-debugsource-3.9.2-4.12.1 protobuf-devel-3.9.2-4.12.1 protobuf-devel-debuginfo-3.9.2-4.12.1 protobuf-java-3.9.2-4.12.1 python2-protobuf-3.9.2-4.12.1 python3-protobuf-3.9.2-4.12.1 - openSUSE Leap 15.3 (x86_64): libprotobuf-lite20-32bit-3.9.2-4.12.1 libprotobuf-lite20-32bit-debuginfo-3.9.2-4.12.1 libprotobuf20-32bit-3.9.2-4.12.1 libprotobuf20-32bit-debuginfo-3.9.2-4.12.1 libprotoc20-32bit-3.9.2-4.12.1 libprotoc20-32bit-debuginfo-3.9.2-4.12.1 - openSUSE Leap 15.3 (noarch): protobuf-source-3.9.2-4.12.1 References: https://www.suse.com/security/cve/CVE-2021-22570.html https://bugzilla.suse.com/1195258

1 0

openSUSE-SU-2022:1027-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 29 Mar '22

29 Mar '22

openSUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1027-1 Rating: important References: #1194925 #1194926 #1194927 #1194928 #1194929 #1194930 #1194931 #1194932 #1194933 #1194934 #1194935 #1194937 #1194939 #1194940 #1194941 #1195146 #1196500 #1197126 Cross-References: CVE-2022-21248 CVE-2022-21271 CVE-2022-21277 CVE-2022-21282 CVE-2022-21283 CVE-2022-21291 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21349 CVE-2022-21360 CVE-2022-21365 CVE-2022-21366 CVSS scores: CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21271 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21271 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21349 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21349 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-ibm fixes the following issues: Update Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126). Including fixes for the following vulnerabilities: CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271. Non-securtiy fix: - Fixed a broken symlink for javaws (bsc#1195146). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1027=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1027=1 Package List: - openSUSE Leap 15.4 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-demo-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-devel-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-src-1.8.0_sr7.5-150000.3.56.1 - openSUSE Leap 15.4 (x86_64): java-1_8_0-ibm-32bit-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-alsa-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-devel-32bit-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-plugin-1.8.0_sr7.5-150000.3.56.1 - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-demo-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-devel-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-src-1.8.0_sr7.5-150000.3.56.1 - openSUSE Leap 15.3 (x86_64): java-1_8_0-ibm-32bit-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-alsa-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-devel-32bit-1.8.0_sr7.5-150000.3.56.1 java-1_8_0-ibm-plugin-1.8.0_sr7.5-150000.3.56.1 References: https://www.suse.com/security/cve/CVE-2022-21248.html https://www.suse.com/security/cve/CVE-2022-21271.html https://www.suse.com/security/cve/CVE-2022-21277.html https://www.suse.com/security/cve/CVE-2022-21282.html https://www.suse.com/security/cve/CVE-2022-21283.html https://www.suse.com/security/cve/CVE-2022-21291.html https://www.suse.com/security/cve/CVE-2022-21293.html https://www.suse.com/security/cve/CVE-2022-21294.html https://www.suse.com/security/cve/CVE-2022-21296.html https://www.suse.com/security/cve/CVE-2022-21299.html https://www.suse.com/security/cve/CVE-2022-21305.html https://www.suse.com/security/cve/CVE-2022-21340.html https://www.suse.com/security/cve/CVE-2022-21341.html https://www.suse.com/security/cve/CVE-2022-21349.html https://www.suse.com/security/cve/CVE-2022-21360.html https://www.suse.com/security/cve/CVE-2022-21365.html https://www.suse.com/security/cve/CVE-2022-21366.html https://bugzilla.suse.com/1194925 https://bugzilla.suse.com/1194926 https://bugzilla.suse.com/1194927 https://bugzilla.suse.com/1194928 https://bugzilla.suse.com/1194929 https://bugzilla.suse.com/1194930 https://bugzilla.suse.com/1194931 https://bugzilla.suse.com/1194932 https://bugzilla.suse.com/1194933 https://bugzilla.suse.com/1194934 https://bugzilla.suse.com/1194935 https://bugzilla.suse.com/1194937 https://bugzilla.suse.com/1194939 https://bugzilla.suse.com/1194940 https://bugzilla.suse.com/1194941 https://bugzilla.suse.com/1195146 https://bugzilla.suse.com/1196500 https://bugzilla.suse.com/1197126

1 0

openSUSE-SU-2022:1029-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 29 Mar '22

29 Mar '22

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1029-1 Rating: important References: #1197341 Cross-References: CVE-2022-0547 CVSS scores: CVE-2022-0547 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn fixes the following issues: - CVE-2022-0547: Fixed possible authentication bypass in external authentication plug-in (bsc#1197341). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1029=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1029=1 Package List: - openSUSE Leap 15.4 (aarch64): openvpn-2.4.3-150000.5.10.1 openvpn-auth-pam-plugin-2.4.3-150000.5.10.1 openvpn-auth-pam-plugin-debuginfo-2.4.3-150000.5.10.1 openvpn-debuginfo-2.4.3-150000.5.10.1 openvpn-debugsource-2.4.3-150000.5.10.1 openvpn-devel-2.4.3-150000.5.10.1 openvpn-down-root-plugin-2.4.3-150000.5.10.1 openvpn-down-root-plugin-debuginfo-2.4.3-150000.5.10.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openvpn-2.4.3-150000.5.10.1 openvpn-auth-pam-plugin-2.4.3-150000.5.10.1 openvpn-auth-pam-plugin-debuginfo-2.4.3-150000.5.10.1 openvpn-debuginfo-2.4.3-150000.5.10.1 openvpn-debugsource-2.4.3-150000.5.10.1 openvpn-devel-2.4.3-150000.5.10.1 openvpn-down-root-plugin-2.4.3-150000.5.10.1 openvpn-down-root-plugin-debuginfo-2.4.3-150000.5.10.1 References: https://www.suse.com/security/cve/CVE-2022-0547.html https://bugzilla.suse.com/1197341

1 0

openSUSE-SU-2022:1031-1: important: Security update for apache2
by opensuse-security＠opensuse.org 29 Mar '22

29 Mar '22

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1031-1 Rating: important References: #1197091 #1197095 #1197096 #1197098 Cross-References: CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 CVE-2022-23943 CVSS scores: CVE-2022-22719 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22719 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22720 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-22720 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-22721 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-22721 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-23943 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23943 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098). - CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095). - CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091). - CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1031=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-2.4.51-150200.3.42.1 apache2-debuginfo-2.4.51-150200.3.42.1 apache2-debugsource-2.4.51-150200.3.42.1 apache2-devel-2.4.51-150200.3.42.1 apache2-event-2.4.51-150200.3.42.1 apache2-event-debuginfo-2.4.51-150200.3.42.1 apache2-example-pages-2.4.51-150200.3.42.1 apache2-prefork-2.4.51-150200.3.42.1 apache2-prefork-debuginfo-2.4.51-150200.3.42.1 apache2-utils-2.4.51-150200.3.42.1 apache2-utils-debuginfo-2.4.51-150200.3.42.1 apache2-worker-2.4.51-150200.3.42.1 apache2-worker-debuginfo-2.4.51-150200.3.42.1 - openSUSE Leap 15.3 (noarch): apache2-doc-2.4.51-150200.3.42.1 References: https://www.suse.com/security/cve/CVE-2022-22719.html https://www.suse.com/security/cve/CVE-2022-22720.html https://www.suse.com/security/cve/CVE-2022-22721.html https://www.suse.com/security/cve/CVE-2022-23943.html https://bugzilla.suse.com/1197091 https://bugzilla.suse.com/1197095 https://bugzilla.suse.com/1197096 https://bugzilla.suse.com/1197098

1 0

openSUSE-SU-2022:0091-1: important: Security update for apache2
by opensuse-security＠opensuse.org 28 Mar '22

28 Mar '22

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0091-1 Rating: important References: #1193942 #1193943 #1197552 SLE-22733 SLE-22849 Cross-References: CVE-2021-44224 CVE-2021-44790 CVE-2022-1096 CVSS scores: CVE-2021-44224 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2021-44224 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44790 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-44790 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities, contains two features is now available. Description: This update for apache2 fixes the following issues: Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849) It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51. See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log. Also fixed: - CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943) - CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-91=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-91=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-2.4.51-3.37.1 apache2-debuginfo-2.4.51-3.37.1 apache2-debugsource-2.4.51-3.37.1 apache2-devel-2.4.51-3.37.1 apache2-event-2.4.51-3.37.1 apache2-event-debuginfo-2.4.51-3.37.1 apache2-example-pages-2.4.51-3.37.1 apache2-prefork-2.4.51-3.37.1 apache2-prefork-debuginfo-2.4.51-3.37.1 apache2-utils-2.4.51-3.37.1 apache2-utils-debuginfo-2.4.51-3.37.1 apache2-worker-2.4.51-3.37.1 apache2-worker-debuginfo-2.4.51-3.37.1 - openSUSE Leap 15.3 (noarch): apache2-doc-2.4.51-3.37.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-99.0.4844.84-bp153.2.75.1 chromium-99.0.4844.84-bp153.2.75.1 References: https://www.suse.com/security/cve/CVE-2021-44224.html https://www.suse.com/security/cve/CVE-2021-44790.html https://www.suse.com/security/cve/CVE-2022-1096.html https://bugzilla.suse.com/1193942 https://bugzilla.suse.com/1193943 https://bugzilla.suse.com/1197552

1 0

openSUSE-SU-2022:0953-1: moderate: Security update for perl-DBD-SQLite
by opensuse-security＠opensuse.org 28 Mar '22

28 Mar '22

openSUSE Security Update: Security update for perl-DBD-SQLite ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0953-1 Rating: moderate References: #1195771 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for perl-DBD-SQLite fixes the following issues: - updated to 1.66 - Use external sqlite3 library rather than internal code. (bsc#1195771) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-953=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-953=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): perl-DBD-SQLite-1.66-150300.3.3.1 perl-DBD-SQLite-debuginfo-1.66-150300.3.3.1 perl-DBD-SQLite-debugsource-1.66-150300.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): perl-DBD-SQLite-1.66-150300.3.3.1 perl-DBD-SQLite-debuginfo-1.66-150300.3.3.1 perl-DBD-SQLite-debugsource-1.66-150300.3.3.1 References: https://bugzilla.suse.com/1195771

1 0

openSUSE-SU-2022:0954-1: moderate: Security update for wavpack
by opensuse-security＠opensuse.org 28 Mar '22

28 Mar '22

openSUSE Security Update: Security update for wavpack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0954-1 Rating: moderate References: #1197020 Cross-References: CVE-2021-44269 CVSS scores: CVE-2021-44269 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44269 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wavpack fixes the following issues: - CVE-2021-44269: Fixed out of bounds read in processing .wav files (bsc#1197020). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-954=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-954=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libwavpack1-5.4.0-4.12.1 libwavpack1-debuginfo-5.4.0-4.12.1 wavpack-5.4.0-4.12.1 wavpack-debuginfo-5.4.0-4.12.1 wavpack-debugsource-5.4.0-4.12.1 wavpack-devel-5.4.0-4.12.1 - openSUSE Leap 15.4 (x86_64): libwavpack1-32bit-5.4.0-4.12.1 libwavpack1-32bit-debuginfo-5.4.0-4.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwavpack1-5.4.0-4.12.1 libwavpack1-debuginfo-5.4.0-4.12.1 wavpack-5.4.0-4.12.1 wavpack-debuginfo-5.4.0-4.12.1 wavpack-debugsource-5.4.0-4.12.1 wavpack-devel-5.4.0-4.12.1 - openSUSE Leap 15.3 (x86_64): libwavpack1-32bit-5.4.0-4.12.1 libwavpack1-32bit-debuginfo-5.4.0-4.12.1 References: https://www.suse.com/security/cve/CVE-2021-44269.html https://bugzilla.suse.com/1197020

1 0

openSUSE-SU-2022:0946-1: important: Security update for bind
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0946-1 Rating: important References: #1197135 Cross-References: CVE-2021-25220 CVSS scores: CVE-2021-25220 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2021-25220: Fixed a DNS cache poisoning vulnerability due to loose caching rules (bsc#1197135). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-946=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-946=1 Package List: - openSUSE Leap 15.4 (x86_64): bind-devel-32bit-9.16.6-150000.12.60.1 libbind9-1600-32bit-9.16.6-150000.12.60.1 libbind9-1600-32bit-debuginfo-9.16.6-150000.12.60.1 libdns1605-32bit-9.16.6-150000.12.60.1 libdns1605-32bit-debuginfo-9.16.6-150000.12.60.1 libirs1601-32bit-9.16.6-150000.12.60.1 libirs1601-32bit-debuginfo-9.16.6-150000.12.60.1 libisc1606-32bit-9.16.6-150000.12.60.1 libisc1606-32bit-debuginfo-9.16.6-150000.12.60.1 libisccc1600-32bit-9.16.6-150000.12.60.1 libisccc1600-32bit-debuginfo-9.16.6-150000.12.60.1 libisccfg1600-32bit-9.16.6-150000.12.60.1 libisccfg1600-32bit-debuginfo-9.16.6-150000.12.60.1 libns1604-32bit-9.16.6-150000.12.60.1 libns1604-32bit-debuginfo-9.16.6-150000.12.60.1 - openSUSE Leap 15.3 (x86_64): bind-devel-32bit-9.16.6-150000.12.60.1 libbind9-1600-32bit-9.16.6-150000.12.60.1 libbind9-1600-32bit-debuginfo-9.16.6-150000.12.60.1 libdns1605-32bit-9.16.6-150000.12.60.1 libdns1605-32bit-debuginfo-9.16.6-150000.12.60.1 libirs1601-32bit-9.16.6-150000.12.60.1 libirs1601-32bit-debuginfo-9.16.6-150000.12.60.1 libisc1606-32bit-9.16.6-150000.12.60.1 libisc1606-32bit-debuginfo-9.16.6-150000.12.60.1 libisccc1600-32bit-9.16.6-150000.12.60.1 libisccc1600-32bit-debuginfo-9.16.6-150000.12.60.1 libisccfg1600-32bit-9.16.6-150000.12.60.1 libisccfg1600-32bit-debuginfo-9.16.6-150000.12.60.1 libns1604-32bit-9.16.6-150000.12.60.1 libns1604-32bit-debuginfo-9.16.6-150000.12.60.1 References: https://www.suse.com/security/cve/CVE-2021-25220.html https://bugzilla.suse.com/1197135

1 0

openSUSE-SU-2022:0945-1: important: Security update for bind
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0945-1 Rating: important References: #1197135 Cross-References: CVE-2021-25220 CVSS scores: CVE-2021-25220 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2021-25220: Fixed a DNS cache poisoning vulnerability due to loose caching rules (bsc#1197135). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-945=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-945=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): bind-chrootenv-9.16.6-150300.22.16.1 bind-devel-9.16.6-150300.22.16.1 libbind9-1600-9.16.6-150300.22.16.1 libbind9-1600-debuginfo-9.16.6-150300.22.16.1 libdns1605-9.16.6-150300.22.16.1 libdns1605-debuginfo-9.16.6-150300.22.16.1 libirs-devel-9.16.6-150300.22.16.1 libirs1601-9.16.6-150300.22.16.1 libirs1601-debuginfo-9.16.6-150300.22.16.1 libisc1606-9.16.6-150300.22.16.1 libisc1606-debuginfo-9.16.6-150300.22.16.1 libisccc1600-9.16.6-150300.22.16.1 libisccc1600-debuginfo-9.16.6-150300.22.16.1 libisccfg1600-9.16.6-150300.22.16.1 libisccfg1600-debuginfo-9.16.6-150300.22.16.1 libns1604-9.16.6-150300.22.16.1 libns1604-debuginfo-9.16.6-150300.22.16.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bind-9.16.6-150300.22.16.1 bind-chrootenv-9.16.6-150300.22.16.1 bind-debuginfo-9.16.6-150300.22.16.1 bind-debugsource-9.16.6-150300.22.16.1 bind-devel-9.16.6-150300.22.16.1 bind-utils-9.16.6-150300.22.16.1 bind-utils-debuginfo-9.16.6-150300.22.16.1 libbind9-1600-9.16.6-150300.22.16.1 libbind9-1600-debuginfo-9.16.6-150300.22.16.1 libdns1605-9.16.6-150300.22.16.1 libdns1605-debuginfo-9.16.6-150300.22.16.1 libirs-devel-9.16.6-150300.22.16.1 libirs1601-9.16.6-150300.22.16.1 libirs1601-debuginfo-9.16.6-150300.22.16.1 libisc1606-9.16.6-150300.22.16.1 libisc1606-debuginfo-9.16.6-150300.22.16.1 libisccc1600-9.16.6-150300.22.16.1 libisccc1600-debuginfo-9.16.6-150300.22.16.1 libisccfg1600-9.16.6-150300.22.16.1 libisccfg1600-debuginfo-9.16.6-150300.22.16.1 libns1604-9.16.6-150300.22.16.1 libns1604-debuginfo-9.16.6-150300.22.16.1 - openSUSE Leap 15.3 (noarch): bind-doc-9.16.6-150300.22.16.1 python3-bind-9.16.6-150300.22.16.1 References: https://www.suse.com/security/cve/CVE-2021-25220.html https://bugzilla.suse.com/1197135

1 0

openSUSE-SU-2022:0944-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0944-1 Rating: moderate References: #1022528 #1188572 #1189528 Cross-References: CVE-2017-5601 CVE-2021-36976 CVSS scores: CVE-2017-5601 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-5601 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-36976 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-36976 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-36976: Fixed an invalid memory access that could cause data corruption (bsc#1188572). Non-security updates: - Updated references for CVE-2017-5601, which was already fixed in a previous version (bsc#1022528 bsc#1189528). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-944=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.3.1 bsdtar-debuginfo-3.4.2-150200.4.3.1 libarchive-debugsource-3.4.2-150200.4.3.1 libarchive-devel-3.4.2-150200.4.3.1 libarchive13-3.4.2-150200.4.3.1 libarchive13-debuginfo-3.4.2-150200.4.3.1 - openSUSE Leap 15.3 (x86_64): libarchive13-32bit-3.4.2-150200.4.3.1 libarchive13-32bit-debuginfo-3.4.2-150200.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-5601.html https://www.suse.com/security/cve/CVE-2021-36976.html https://bugzilla.suse.com/1022528 https://bugzilla.suse.com/1188572 https://bugzilla.suse.com/1189528

1 0

openSUSE-SU-2022:0943-1: moderate: Security update for slirp4netns
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for slirp4netns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0943-1 Rating: moderate References: #1179467 Cross-References: CVE-2020-29130 CVSS scores: CVE-2020-29130 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-29130 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slirp4netns fixes the following issues: - CVE-2020-29130: Fixed an invalid memory access while processing ARP packets (bsc#1179467). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-943=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-943=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): slirp4netns-0.4.7-3.15.1 slirp4netns-debuginfo-0.4.7-3.15.1 slirp4netns-debugsource-0.4.7-3.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): slirp4netns-0.4.7-3.15.1 slirp4netns-debuginfo-0.4.7-3.15.1 slirp4netns-debugsource-0.4.7-3.15.1 References: https://www.suse.com/security/cve/CVE-2020-29130.html https://bugzilla.suse.com/1179467

1 0

openSUSE-SU-2022:0942-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 24 Mar '22

24 Mar '22

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0942-1 Rating: moderate References: #1186819 Cross-References: CVE-2021-3572 CVSS scores: CVE-2021-3572 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: - CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-942=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-942=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.21.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.21.1 python3-3.6.15-150300.10.21.1 python3-base-3.6.15-150300.10.21.1 python3-base-debuginfo-3.6.15-150300.10.21.1 python3-core-debugsource-3.6.15-150300.10.21.1 python3-curses-3.6.15-150300.10.21.1 python3-curses-debuginfo-3.6.15-150300.10.21.1 python3-dbm-3.6.15-150300.10.21.1 python3-dbm-debuginfo-3.6.15-150300.10.21.1 python3-debuginfo-3.6.15-150300.10.21.1 python3-debugsource-3.6.15-150300.10.21.1 python3-devel-3.6.15-150300.10.21.1 python3-devel-debuginfo-3.6.15-150300.10.21.1 python3-doc-3.6.15-150300.10.21.1 python3-doc-devhelp-3.6.15-150300.10.21.1 python3-idle-3.6.15-150300.10.21.1 python3-testsuite-3.6.15-150300.10.21.1 python3-testsuite-debuginfo-3.6.15-150300.10.21.1 python3-tk-3.6.15-150300.10.21.1 python3-tk-debuginfo-3.6.15-150300.10.21.1 python3-tools-3.6.15-150300.10.21.1 - openSUSE Leap 15.4 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.21.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.21.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.21.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.21.1 python3-3.6.15-150300.10.21.1 python3-base-3.6.15-150300.10.21.1 python3-base-debuginfo-3.6.15-150300.10.21.1 python3-core-debugsource-3.6.15-150300.10.21.1 python3-curses-3.6.15-150300.10.21.1 python3-curses-debuginfo-3.6.15-150300.10.21.1 python3-dbm-3.6.15-150300.10.21.1 python3-dbm-debuginfo-3.6.15-150300.10.21.1 python3-debuginfo-3.6.15-150300.10.21.1 python3-debugsource-3.6.15-150300.10.21.1 python3-devel-3.6.15-150300.10.21.1 python3-devel-debuginfo-3.6.15-150300.10.21.1 python3-doc-3.6.15-150300.10.21.1 python3-doc-devhelp-3.6.15-150300.10.21.1 python3-idle-3.6.15-150300.10.21.1 python3-testsuite-3.6.15-150300.10.21.1 python3-testsuite-debuginfo-3.6.15-150300.10.21.1 python3-tk-3.6.15-150300.10.21.1 python3-tk-debuginfo-3.6.15-150300.10.21.1 python3-tools-3.6.15-150300.10.21.1 - openSUSE Leap 15.3 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.21.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.21.1 References: https://www.suse.com/security/cve/CVE-2021-3572.html https://bugzilla.suse.com/1186819

1 0

openSUSE-SU-2022:0089-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0089-1 Rating: moderate References: #1196905 #1196908 #1196952 Cross-References: CVE-2021-41239 CVE-2021-41241 CVE-2021-41741 CVSS scores: CVE-2021-41239 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-41239 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905) - CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908) - CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952) - For more changes see https://nextcloud.com/changelog/#21-0-9 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-89=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-21.0.9-37.1 nextcloud-apache-21.0.9-37.1 References: https://www.suse.com/security/cve/CVE-2021-41239.html https://www.suse.com/security/cve/CVE-2021-41241.html https://www.suse.com/security/cve/CVE-2021-41741.html https://bugzilla.suse.com/1196905 https://bugzilla.suse.com/1196908 https://bugzilla.suse.com/1196952

1 0

openSUSE-SU-2022:0940-1: important: Security update for xen
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0940-1 Rating: important References: #1027519 #1191668 #1194267 #1196915 Cross-References: CVE-2021-26401 CVE-2022-0001 CVE-2022-0002 CVSS scores: CVE-2021-26401 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-26401 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: Update Xen to version 4.14.4 (bsc#1027519) Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. Security issues fixed: - CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915). Non-security issues fixed: - Fixed issue around xl and virsh operation - virsh list not giving any output (bsc#1191668). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-940=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.4_02-150300.3.21.1 xen-debugsource-4.14.4_02-150300.3.21.1 xen-devel-4.14.4_02-150300.3.21.1 xen-doc-html-4.14.4_02-150300.3.21.1 xen-libs-4.14.4_02-150300.3.21.1 xen-libs-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-4.14.4_02-150300.3.21.1 xen-tools-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-domU-4.14.4_02-150300.3.21.1 xen-tools-domU-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.4_02-150300.3.21.1 xen-libs-32bit-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.4_02-150300.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-26401.html https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191668 https://bugzilla.suse.com/1194267 https://bugzilla.suse.com/1196915

1 0

openSUSE-SU-2022:0930-1: important: Security update for qemu
by opensuse-security＠opensuse.org 22 Mar '22

22 Mar '22

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0930-1 Rating: important References: #1178049 #1192525 #1193364 #1193545 #1194938 #1195161 #1196087 #1196737 Cross-References: CVE-2021-3930 CVE-2022-0358 CVSS scores: CVE-2021-3930 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3930 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2022-0358 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: This update for qemu fixes the following issues: - CVE-2022-0358: Fixed a potential privilege escalation via virtiofsd (bsc#1195161). - CVE-2021-3930: Fixed a potential denial of service in the emulated SCSI device (bsc#1192525). Non-security fixes: - Fixed a kernel data corruption via a long kernel boot cmdline (bsc#1196737). - Included vmxcap in the qemu-tools package (bsc#1193364). - Fixed package dependencies (bsc#1196087). - Fixed an issue were PowerPC firmwares would not be built for non-PowerPC builds (bsc#1193545). - Fixed multiple issues in I/O (bsc#1178049 bsc#1194938). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-930=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-150300.112.4 qemu-arm-5.2.0-150300.112.4 qemu-arm-debuginfo-5.2.0-150300.112.4 qemu-audio-alsa-5.2.0-150300.112.4 qemu-audio-alsa-debuginfo-5.2.0-150300.112.4 qemu-audio-pa-5.2.0-150300.112.4 qemu-audio-pa-debuginfo-5.2.0-150300.112.4 qemu-audio-spice-5.2.0-150300.112.4 qemu-audio-spice-debuginfo-5.2.0-150300.112.4 qemu-block-curl-5.2.0-150300.112.4 qemu-block-curl-debuginfo-5.2.0-150300.112.4 qemu-block-dmg-5.2.0-150300.112.4 qemu-block-dmg-debuginfo-5.2.0-150300.112.4 qemu-block-gluster-5.2.0-150300.112.4 qemu-block-gluster-debuginfo-5.2.0-150300.112.4 qemu-block-iscsi-5.2.0-150300.112.4 qemu-block-iscsi-debuginfo-5.2.0-150300.112.4 qemu-block-nfs-5.2.0-150300.112.4 qemu-block-nfs-debuginfo-5.2.0-150300.112.4 qemu-block-rbd-5.2.0-150300.112.4 qemu-block-rbd-debuginfo-5.2.0-150300.112.4 qemu-block-ssh-5.2.0-150300.112.4 qemu-block-ssh-debuginfo-5.2.0-150300.112.4 qemu-chardev-baum-5.2.0-150300.112.4 qemu-chardev-baum-debuginfo-5.2.0-150300.112.4 qemu-chardev-spice-5.2.0-150300.112.4 qemu-chardev-spice-debuginfo-5.2.0-150300.112.4 qemu-debuginfo-5.2.0-150300.112.4 qemu-debugsource-5.2.0-150300.112.4 qemu-extra-5.2.0-150300.112.4 qemu-extra-debuginfo-5.2.0-150300.112.4 qemu-guest-agent-5.2.0-150300.112.4 qemu-guest-agent-debuginfo-5.2.0-150300.112.4 qemu-hw-display-qxl-5.2.0-150300.112.4 qemu-hw-display-qxl-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-redirect-5.2.0-150300.112.4 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-smartcard-5.2.0-150300.112.4 qemu-hw-usb-smartcard-debuginfo-5.2.0-150300.112.4 qemu-ivshmem-tools-5.2.0-150300.112.4 qemu-ivshmem-tools-debuginfo-5.2.0-150300.112.4 qemu-ksm-5.2.0-150300.112.4 qemu-lang-5.2.0-150300.112.4 qemu-linux-user-5.2.0-150300.112.3 qemu-linux-user-debuginfo-5.2.0-150300.112.3 qemu-linux-user-debugsource-5.2.0-150300.112.3 qemu-ppc-5.2.0-150300.112.4 qemu-ppc-debuginfo-5.2.0-150300.112.4 qemu-s390x-5.2.0-150300.112.4 qemu-s390x-debuginfo-5.2.0-150300.112.4 qemu-testsuite-5.2.0-150300.112.7 qemu-tools-5.2.0-150300.112.4 qemu-tools-debuginfo-5.2.0-150300.112.4 qemu-ui-curses-5.2.0-150300.112.4 qemu-ui-curses-debuginfo-5.2.0-150300.112.4 qemu-ui-gtk-5.2.0-150300.112.4 qemu-ui-gtk-debuginfo-5.2.0-150300.112.4 qemu-ui-opengl-5.2.0-150300.112.4 qemu-ui-opengl-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-app-5.2.0-150300.112.4 qemu-ui-spice-app-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-core-5.2.0-150300.112.4 qemu-ui-spice-core-debuginfo-5.2.0-150300.112.4 qemu-vhost-user-gpu-5.2.0-150300.112.4 qemu-vhost-user-gpu-debuginfo-5.2.0-150300.112.4 qemu-x86-5.2.0-150300.112.4 qemu-x86-debuginfo-5.2.0-150300.112.4 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-150300.112.4 - openSUSE Leap 15.3 (noarch): qemu-SLOF-5.2.0-150300.112.4 qemu-ipxe-1.0.0+-150300.112.4 qemu-microvm-5.2.0-150300.112.4 qemu-seabios-1.14.0_0_g155821a-150300.112.4 qemu-sgabios-8-150300.112.4 qemu-skiboot-5.2.0-150300.112.4 qemu-vgabios-1.14.0_0_g155821a-150300.112.4 References: https://www.suse.com/security/cve/CVE-2021-3930.html https://www.suse.com/security/cve/CVE-2022-0358.html https://bugzilla.suse.com/1178049 https://bugzilla.suse.com/1192525 https://bugzilla.suse.com/1193364 https://bugzilla.suse.com/1193545 https://bugzilla.suse.com/1194938 https://bugzilla.suse.com/1195161 https://bugzilla.suse.com/1196087 https://bugzilla.suse.com/1196737

1 0

openSUSE-SU-2022:0923-1: important: Test update for SUSE:SLE-15-SP4:Update (security)
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Test update for SUSE:SLE-15-SP4:Update (security) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0923-1 Rating: important References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This is a security test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-923=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-923=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-security-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-security-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-SU-2022:0088-1: important: Security update for htmldoc
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0088-1 Rating: important References: #1192357 #1194303 #1194304 #1194487 #1195758 Cross-References: CVE-2021-40985 CVE-2021-43579 CVE-2021-45944 CVE-2021-45949 CVE-2022-0534 CVSS scores: CVE-2021-40985 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-40985 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-43579 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43579 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45944 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45944 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-45949 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45949 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0534 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0534 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: htmldoc was updated to fix issues: - CVE-2021-40985: Fixed buffer overflow may lead to DoS via a crafted BMP image (bsc#1192357) - CVE-2021-43579: Fixed stack-based buffer overflow in image_load_bmp() results in remote code execution if the victim converts an HTML document linking to a crafted BMP file (bsc#1194487) - CVE-2022-0534: Fixed stack out-of-bounds read in gif_get_code() when opening a malicious GIF file results in a segmentation fault (bsc#1195758) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-88=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-88=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ghostscript-9.52-161.1 ghostscript-debuginfo-9.52-161.1 ghostscript-debugsource-9.52-161.1 ghostscript-devel-9.52-161.1 ghostscript-x11-9.52-161.1 ghostscript-x11-debuginfo-9.52-161.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): htmldoc-1.8.28-9.1 References: https://www.suse.com/security/cve/CVE-2021-40985.html https://www.suse.com/security/cve/CVE-2021-43579.html https://www.suse.com/security/cve/CVE-2021-45944.html https://www.suse.com/security/cve/CVE-2021-45949.html https://www.suse.com/security/cve/CVE-2022-0534.html https://bugzilla.suse.com/1192357 https://bugzilla.suse.com/1194303 https://bugzilla.suse.com/1194304 https://bugzilla.suse.com/1194487 https://bugzilla.suse.com/1195758

1 0

openSUSE-SU-2022:0915-1: moderate: Security update for lapack
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for lapack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0915-1 Rating: moderate References: #1193562 Cross-References: CVE-2021-4048 CVSS scores: CVE-2021-4048 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-4048 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lapack fixes the following issues: - CVE-2021-4048: Fixed an out of bounds read when user input was not validated properly (bsc#1193562). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-915=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-915=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): blas-devel-3.5.0-4.6.1 blas-devel-static-3.5.0-4.6.1 lapack-debugsource-3.5.0-4.6.1 lapack-devel-3.5.0-4.6.1 lapack-devel-static-3.5.0-4.6.1 lapacke-devel-3.5.0-4.6.1 lapacke-devel-static-3.5.0-4.6.1 libblas3-3.5.0-4.6.1 libblas3-debuginfo-3.5.0-4.6.1 liblapack3-3.5.0-4.6.1 liblapack3-debuginfo-3.5.0-4.6.1 liblapacke3-3.5.0-4.6.1 liblapacke3-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.4 (x86_64): blas-devel-32bit-3.5.0-4.6.1 lapack-devel-32bit-3.5.0-4.6.1 lapacke-devel-32bit-3.5.0-4.6.1 libblas3-32bit-3.5.0-4.6.1 libblas3-32bit-debuginfo-3.5.0-4.6.1 liblapack3-32bit-3.5.0-4.6.1 liblapack3-32bit-debuginfo-3.5.0-4.6.1 liblapacke3-32bit-3.5.0-4.6.1 liblapacke3-32bit-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.4 (noarch): blas-man-3.5.0-4.6.1 lapack-man-3.5.0-4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): blas-devel-3.5.0-4.6.1 blas-devel-static-3.5.0-4.6.1 lapack-debugsource-3.5.0-4.6.1 lapack-devel-3.5.0-4.6.1 lapack-devel-static-3.5.0-4.6.1 lapacke-devel-3.5.0-4.6.1 lapacke-devel-static-3.5.0-4.6.1 libblas3-3.5.0-4.6.1 libblas3-debuginfo-3.5.0-4.6.1 liblapack3-3.5.0-4.6.1 liblapack3-debuginfo-3.5.0-4.6.1 liblapacke3-3.5.0-4.6.1 liblapacke3-debuginfo-3.5.0-4.6.1 - openSUSE Leap 15.3 (noarch): blas-man-3.5.0-4.6.1 lapack-man-3.5.0-4.6.1 - openSUSE Leap 15.3 (x86_64): blas-devel-32bit-3.5.0-4.6.1 lapack-devel-32bit-3.5.0-4.6.1 lapacke-devel-32bit-3.5.0-4.6.1 libblas3-32bit-3.5.0-4.6.1 libblas3-32bit-debuginfo-3.5.0-4.6.1 liblapack3-32bit-3.5.0-4.6.1 liblapack3-32bit-debuginfo-3.5.0-4.6.1 liblapacke3-32bit-3.5.0-4.6.1 liblapacke3-32bit-debuginfo-3.5.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2021-4048.html https://bugzilla.suse.com/1193562

1 0

openSUSE-SU-2022:0087-1: important: Security update for icingaweb2
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0087-1 Rating: important References: #1196911 #1196913 Cross-References: CVE-2022-24714 CVE-2022-24715 CVSS scores: CVE-2022-24714 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-24715 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24715 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. * Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users (GHSA-v9mv-h52f-7g63 boo#1196911) - CVE-2022-24714: Unwanted disclosure of hosts and related data, linked to decommissioned services (GHSA-qcmg-vr56-x9wf boo#1196913) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-87=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.8.6-15.1 icingaweb2-2.8.6-15.1 icingaweb2-common-2.8.6-15.1 icingaweb2-vendor-HTMLPurifier-2.8.6-15.1 icingaweb2-vendor-JShrink-2.8.6-15.1 icingaweb2-vendor-Parsedown-2.8.6-15.1 icingaweb2-vendor-dompdf-2.8.6-15.1 icingaweb2-vendor-lessphp-2.8.6-15.1 icingaweb2-vendor-zf1-2.8.6-15.1 php-Icinga-2.8.6-15.1 References: https://www.suse.com/security/cve/CVE-2022-24714.html https://www.suse.com/security/cve/CVE-2022-24715.html https://bugzilla.suse.com/1196911 https://bugzilla.suse.com/1196913

1 0

openSUSE-SU-2022:0906-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0906-1 Rating: important References: #1196900 Cross-References: CVE-2022-26381 CVE-2022-26383 CVE-2022-26384 CVE-2022-26386 CVE-2022-26387 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Updated to version 91.7 (bsc#1196900): - CVE-2022-26381: Fixed an invalid memory access due to text reflow when SVG objects were present. - CVE-2022-26383: Fixed an issue where, when resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. - CVE-2022-26384: Fixed an iframe XSS sandbox bypass when allow-popups was used on the iframe. - CVE-2022-26386: Fixed an issue where downloadable temporary files were accessible to other local users. - CVE-2022-26387: Fixed a potential add-on signature verification bypass due to a race condition. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-906=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-906=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.7.0-150200.8.62.7 MozillaThunderbird-debuginfo-91.7.0-150200.8.62.7 MozillaThunderbird-debugsource-91.7.0-150200.8.62.7 MozillaThunderbird-translations-common-91.7.0-150200.8.62.7 MozillaThunderbird-translations-other-91.7.0-150200.8.62.7 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.7.0-150200.8.62.7 MozillaThunderbird-debuginfo-91.7.0-150200.8.62.7 MozillaThunderbird-debugsource-91.7.0-150200.8.62.7 MozillaThunderbird-translations-common-91.7.0-150200.8.62.7 MozillaThunderbird-translations-other-91.7.0-150200.8.62.7 References: https://www.suse.com/security/cve/CVE-2022-26381.html https://www.suse.com/security/cve/CVE-2022-26383.html https://www.suse.com/security/cve/CVE-2022-26384.html https://www.suse.com/security/cve/CVE-2022-26386.html https://www.suse.com/security/cve/CVE-2022-26387.html https://bugzilla.suse.com/1196900

1 0

openSUSE-SU-2022:0085-1: important: Security update for chromium
by opensuse-security＠opensuse.org 20 Mar '22

20 Mar '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0085-1 Rating: important References: #1197163 Cross-References: CVE-2022-0971 CVE-2022-0972 CVE-2022-0973 CVE-2022-0974 CVE-2022-0975 CVE-2022-0976 CVE-2022-0977 CVE-2022-0978 CVE-2022-0979 CVE-2022-0980 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 99.0.4844.74 (boo#1197163) * CVE-2022-0971: Use after free in Blink Layout * CVE-2022-0972: Use after free in Extensions * CVE-2022-0973: Use after free in Safe Browsing * CVE-2022-0974: Use after free in Splitscreen * CVE-2022-0975: Use after free in ANGLE * CVE-2022-0976: Heap buffer overflow in GPU * CVE-2022-0977: Use after free in Browser UI * CVE-2022-0978: Use after free in ANGLE * CVE-2022-0979: Use after free in Safe Browsing * CVE-2022-0980: Use after free in New Tab Page * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-85=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-99.0.4844.74-bp153.2.69.1 chromium-99.0.4844.74-bp153.2.69.1 References: https://www.suse.com/security/cve/CVE-2022-0971.html https://www.suse.com/security/cve/CVE-2022-0972.html https://www.suse.com/security/cve/CVE-2022-0973.html https://www.suse.com/security/cve/CVE-2022-0974.html https://www.suse.com/security/cve/CVE-2022-0975.html https://www.suse.com/security/cve/CVE-2022-0976.html https://www.suse.com/security/cve/CVE-2022-0977.html https://www.suse.com/security/cve/CVE-2022-0978.html https://www.suse.com/security/cve/CVE-2022-0979.html https://www.suse.com/security/cve/CVE-2022-0980.html https://bugzilla.suse.com/1197163

1 0

openSUSE-SU-2022:0083-1: moderate: Security update for weechat
by opensuse-security＠opensuse.org 18 Mar '22

18 Mar '22

openSUSE Security Update: Security update for weechat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0083-1 Rating: moderate References: #1190206 Cross-References: CVE-2021-40516 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for weechat fixes the following issues: update to 3.2.1: * CVE-2021-40516: relay: fix crash when decoding a malformed websocket frame (boo#1190206) update to 3.2 main changes: * use XDG directories by default (config, data, cache, runtime) * add support of IRC SASL mechanisms SCRAM-SHA-1, SCRAM-SHA-256 and SCRAM-SHA-512 * automatically load system certificates without giving a hardcoded path to the file with certificates * add options to customize commands executed on system signals received (SIGHUP, SIGQUIT, SIGTERM, SIGUSR1, SIGUSR2) * add bar item "tls_version" and buflist format * add signals "cursor_start" and "cursor_end" * add function crypto_hmac in API * add translated string in evaluation of expressions with "translate:xxx" * add info "weechat_daemon" * add Python stub for WeeChat API * add variables "${tg_shell_argc}" and "${tg_shell_argvN}" in command trigger evaluated strings * many bugs fixed. for all changes, please visit: https://weechat.org/files/changelog/ChangeLog-3.2.html update to 3.1 New features * core: add options weechat.look.hotlist_update_on_buffer_switch and weechat.look.read_marker_update_on_buffer_switch (issue #992, issue #993) * core: add option sec.crypt.passphrase_command to read passphrase from an external program on startup, remove option sec.crypt.passphrase_file (issue #141) * core: improve debug in command /eval: display more verbose debug with two "-d", add indentation and colors * core: add options "setvar" and "delvar" in command /buffer, rename option "localvar" to "listvar" * core: add buffer local variable "completion_default_template" (evaluated) to override the value of option "weechat.completion.default_template" (issue #1600) * core: add option "recreate" in command /filter * core: add raw string in evaluation of expressions with "raw:xxx" (issue #1611) * core: add evaluation of conditions in evaluation of expressions with "eval_cond:xxx" (issue #1582) * api: add info_hashtable "secured_data" * irc: add info "irc_is_message_ignored" * irc: add server option "default_chantypes", used when the server does not send them in message 005 (issue #1610) * trigger: add variable "${tg_trigger_name}" in command trigger evaluated strings (issue #1580) - Bug fixes * core: fix quoted line in cursor mode (issue #1602) * core: fix wrong size of the new window after vertical split (issue #1612) * core: do not remove quotes in arguments of command /eval as they can be part of the evaluated expression/condition (issue #1601) * core: display an error when the buffer is not found with command /command -buffer * buflist: add option buflist.look.use_items to speed up display of buflist (issue #1613) * irc: add bar item "irc_nick_prefix" * irc: fix separator between nick and host in bar item "irc_nick_host" * irc: fix completion of commands /halfop and /dehalfop - Documentation * do not build weechat-headless man page if headless binary is disabled (issue #1607) update to 3.0.1: * exec: fix search of command by identifier * spell: fix refresh of bar item "spell_suggest" when the input becomes empty (issue #1586) * spell: fix crash with IRC color codes in command line (issue #1589) update to 3.0 New features * api: add optional list of colors in infos "nick_color" and "nick_color_name" (issue #1565) * api: add argument "bytes" in function string_dyn_concat * api: add function string_color_code_size (issue #1547) * exec: add option "-oerr" to send stderr to buffer (now disabled by default) (issue #1566) * fset: add option fset.look.auto_refresh (issue #1553) * irc: add pointer to irc_nick in focus of bar item "buffer_nicklist" (issue #1535, issue #1538) * irc: allow to send text on buffers with commands /allchan, /allpv and /allserv * irc: evaluate command executed by commands /allchan, /allpv and /allserv (issue #1536) * script: add option script.scripts.download_enabled (issue #1548) * trigger: add variable "tg_argc" in data set by command trigger (issue #1576) * trigger: add variable "tg_trigger_name" in data set by all triggers (issue #1567, issue #1568) Bug fixes * core: set "notify_level" to 3 if there is a highlight in the line (issue #1529) * core: do not add line with highlight and tag "notify_none" to hotlist (issue #1529) * irc: remove SASL timeout message displayed by error after successful SASL authentication (issue #1515) * irc: send all channels in a single JOIN command when reconnecting to the server (issue #1551) * script: do not automatically download list of scripts on startup if the file is too old (issue #1548) * spell: properly skip WeeChat and IRC color codes when checking words in input (issue #1547) * trigger: fix recursive calls to triggers using regex (issue #1546) * trigger: add ${tg_tags} !!- ,notify_none, in conditions of default trigger "beep" (issue #1529) - Tests * core: add tests on GUI line functions - Build * core: disable debug by default in autotools build * tests: fix compilation with CppUTest �� 4.0 - new .desktop file from weechat sources - update to 2.9 - New features * core: add bar option "color_bg_inactive": color for window bars in inactive window (issue #732) * core: add Alacritty title escape sequence support (issue #1517) * core: display notify level for current buffer with command /buffer notify (issue #1505) * core: count only visible nicks in bar item "buffer_nicklist_count", add bar items "buffer_nicklist_count_groups" and "buffer_nicklist_count_all" (issue #1506) * core: set default size for input bar to 0 (automatic) (issue #1498) * core: add default key Alt+Enter to insert a newline (issue #1498) * core: add flag "input_multiline" in buffer (issue #984, issue #1063) * core: add a scalable WeeChat logo (SVG) (issue #1454, issue #1456) * core: add base 16/32/64 encoding/decoding in evaluation of expressions with "base_encode:base,xxx" and "base_decode:base,xxx" * core: add case sensitive wildcard matching comparison operator (==* and !!*) and case sensitive/insensitive include comparison operators (==-, !!-, =-, !-) in evaluation of expressions * core: add default key Alt+Shift+N to toggle nicklist bar * core: add command line option "--stdout" in weechat-headless binary to log to stdout rather than ~/.weechat/weechat.log (issue #1475, issue #1477) * core: reload configuration files on SIGHUP (issue #1476) * api: add pointer "_bar_window" in hashtable sent to hook focus callback (issue #1450) * api: add info_hashtable "focus_info" (issue #1245, issue #1257) * api: rename function hook_completion_get_string to completion_get_string and hook_completion_list_add to completion_list_add * api: add functions completion_new, completion_search and completion_free * api: add hdata "completion_word" * buflist: add default key Alt+Shift+B to toggle buflist * buflist: add options enable/disable/toggle in command /buflist * buflist: evaluate option buflist.look.sort so that sort can be customized for each of the three buflist bar items (issue #1465) * irc: add support of UTF8MAPPING (issue #1528) * irc: display account messages in buffers (issue #1250) * python: add WeeChat sharedir python directory to PYTHONPATH (issue #1537) * relay: increase default limits for IRC backlog options * relay: add command "handshake" in weechat relay protocol and nonce to prevent replay attacks, add options relay.network.password_hash_algo, relay.network.password_hash_iterations, relay.network.nonce_size (issue #1474) * relay: add command "completion" in weechat relay protocol to perform a completion on a string at a given position (issue #1484) * relay: add option relay.network.auth_timeout * relay: update default colors for client status * relay: add status "waiting_auth" in irc and weechat protocols (issue #1358) * trigger: evaluate arguments of command when the trigger is created (issue #1472) - Bug fixes * core: fix command /window scroll_beyond_end when buffer has fewer lines than chat height (issue #1509) * core: force buffer property "time_for_each_line" to 0 for buffers with free content (issue #1485) * core: don��t collapse consecutive newlines in lines displayed before the first buffer is created * core: don��t remove consecutive newlines when pasting text (issue #1500) * core: don��t collapse consecutive newlines in bar content (issue #1500) * core: fix WEECHAT_SHAREDIR with CMake build (issue #1461) * core: fix memory leak in calculation of expression on FreeBSD (issue #1469) * core: fix resize of a bar when its size is 0 (automatic) (issue #1470) * api: fix use of pointer after free in function key_unbind * api: replace plugin and buffer name by buffer pointer in argument "modifier_data" sent to weechat_print modifier callback (issue #42) * buflist: add "window" pointer in bar item evaluation only if it��s not NULL (if bar type is "window") * exec: fix use of same task id for different tasks (issue #1491) * fifo: fix errors when writing in the FIFO pipe (issue #713) * guile: enable again /guile eval (issue #1514) * irc: use new default chantypes "#&" when the server does not send it * irc: add support of optional server in info "irc_is_nick", fix check of nick using UTF8MAPPING isupport value (issue #1528) * irc: fix add of ignore with flags in regex, display full ignore mask in list of ignores (issue #1518) * irc: do not remove spaces at the end of users messages received (issue #1513) * irc: fix realname delimiter color in WHO/WHOX response (issue #1497) * irc: reuse a buffer with wrong type "channel" when a private message is received (issue #869) * python: fix crash when invalid UTF-8 string is in a WeeChat hashtable converted to a Python dict (issue #1463) * relay: add missing field "notify_level" in message "_buffer_line_added" (issue #1529) * relay: fix slow send of data to clients when SSL is enabled * trigger: only return trigger��s return code when condition evaluates to true (issue #592) * trigger: fix truncated trigger command with commands /trigger input|output|recreate * trigger: do not hide values of options with /set command in cmd_pass trigger - Documentation * add includes directory * merge 53 auto-generated files into 11 files * fix broken literal blocks in Japanese docs with Firefox (issue #1466) - Tests * core: add CI with GitHub Actions, move codecov.io upload to GitHub Actions * core: switch to Ubuntu Bionic on Travis CI, use pylint3 to lint Python scripts * core: run tests on plugins only if the plugins are enabled and compiled * irc: add tests on IRC color and channel functions - Build * javascript: disable build by default and remove Debian packaging of JavaScript plugin (issue #360) * core: make GnuTLS a required dependency * core: fix build with CMake 3.17.0 * core: fix build with cygport on Cygwin Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-83=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): weechat-3.2.1-bp153.2.3.1 weechat-devel-3.2.1-bp153.2.3.1 weechat-lua-3.2.1-bp153.2.3.1 weechat-perl-3.2.1-bp153.2.3.1 weechat-python-3.2.1-bp153.2.3.1 weechat-ruby-3.2.1-bp153.2.3.1 weechat-spell-3.2.1-bp153.2.3.1 weechat-tcl-3.2.1-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): weechat-lang-3.2.1-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-40516.html https://bugzilla.suse.com/1190206

1 0

openSUSE-SU-2022:0901-1: important: Security update for frr
by opensuse-security＠opensuse.org 18 Mar '22

18 Mar '22

openSUSE Security Update: Security update for frr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0901-1 Rating: important References: #1180217 #1196503 #1196504 #1196505 #1196506 #1196507 Cross-References: CVE-2022-26125 CVE-2022-26126 CVE-2022-26127 CVE-2022-26128 CVE-2022-26129 CVSS scores: CVE-2022-26125 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26125 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26126 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26126 (SUSE): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2022-26127 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26127 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26128 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26128 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-26129 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26129 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for frr fixes the following issues: - CVE-2022-26125, CVE-2022-26126: Fixed buffer overflows in unpack_tlv_router_cap() (bsc#1196505, bsc#1196506). - CVE-2022-26127: Fixed heap buffer overflow in babel_packet_examin() (bsc#1196503). - CVE-2022-26128: Fixed buffer overflows in babel_packet_examin() (bsc#1196507). - CVE-2022-26129: Fixed buffer overflows in parse_hello_subtlv(), parse_ihu_subtlv() and parse_update_subtlv() (bsc#1196504). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-901=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-901=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): frr-7.4-150300.4.3.1 frr-debuginfo-7.4-150300.4.3.1 frr-debugsource-7.4-150300.4.3.1 frr-devel-7.4-150300.4.3.1 libfrr0-7.4-150300.4.3.1 libfrr0-debuginfo-7.4-150300.4.3.1 libfrr_pb0-7.4-150300.4.3.1 libfrr_pb0-debuginfo-7.4-150300.4.3.1 libfrrcares0-7.4-150300.4.3.1 libfrrcares0-debuginfo-7.4-150300.4.3.1 libfrrfpm_pb0-7.4-150300.4.3.1 libfrrfpm_pb0-debuginfo-7.4-150300.4.3.1 libfrrgrpc_pb0-7.4-150300.4.3.1 libfrrgrpc_pb0-debuginfo-7.4-150300.4.3.1 libfrrospfapiclient0-7.4-150300.4.3.1 libfrrospfapiclient0-debuginfo-7.4-150300.4.3.1 libfrrsnmp0-7.4-150300.4.3.1 libfrrsnmp0-debuginfo-7.4-150300.4.3.1 libfrrzmq0-7.4-150300.4.3.1 libfrrzmq0-debuginfo-7.4-150300.4.3.1 libmlag_pb0-7.4-150300.4.3.1 libmlag_pb0-debuginfo-7.4-150300.4.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): frr-7.4-150300.4.3.1 frr-debuginfo-7.4-150300.4.3.1 frr-debugsource-7.4-150300.4.3.1 frr-devel-7.4-150300.4.3.1 libfrr0-7.4-150300.4.3.1 libfrr0-debuginfo-7.4-150300.4.3.1 libfrr_pb0-7.4-150300.4.3.1 libfrr_pb0-debuginfo-7.4-150300.4.3.1 libfrrcares0-7.4-150300.4.3.1 libfrrcares0-debuginfo-7.4-150300.4.3.1 libfrrfpm_pb0-7.4-150300.4.3.1 libfrrfpm_pb0-debuginfo-7.4-150300.4.3.1 libfrrgrpc_pb0-7.4-150300.4.3.1 libfrrgrpc_pb0-debuginfo-7.4-150300.4.3.1 libfrrospfapiclient0-7.4-150300.4.3.1 libfrrospfapiclient0-debuginfo-7.4-150300.4.3.1 libfrrsnmp0-7.4-150300.4.3.1 libfrrsnmp0-debuginfo-7.4-150300.4.3.1 libfrrzmq0-7.4-150300.4.3.1 libfrrzmq0-debuginfo-7.4-150300.4.3.1 libmlag_pb0-7.4-150300.4.3.1 libmlag_pb0-debuginfo-7.4-150300.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-26125.html https://www.suse.com/security/cve/CVE-2022-26126.html https://www.suse.com/security/cve/CVE-2022-26127.html https://www.suse.com/security/cve/CVE-2022-26128.html https://www.suse.com/security/cve/CVE-2022-26129.html https://bugzilla.suse.com/1180217 https://bugzilla.suse.com/1196503 https://bugzilla.suse.com/1196504 https://bugzilla.suse.com/1196505 https://bugzilla.suse.com/1196506 https://bugzilla.suse.com/1196507

1 0

openSUSE-SU-2022:0886-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 17 Mar '22

17 Mar '22

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0886-1 Rating: moderate References: #1196456 SLE-18214 Cross-References: CVE-2021-25636 CVSS scores: CVE-2021-25636 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-25636 (SUSE): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for libreoffice fixes the following issues: Update to version 7.2.5.1 (jsc#SLE-18214): - CVE-2021-25636: Fixed an incorrect vadidation of digitally signed documents (bsc#1196456). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-886=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-886=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le x86_64): libreoffice-7.2.5.1-150300.14.22.18.3 libreoffice-base-7.2.5.1-150300.14.22.18.3 libreoffice-base-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-base-drivers-postgresql-7.2.5.1-150300.14.22.18.3 libreoffice-base-drivers-postgresql-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-calc-7.2.5.1-150300.14.22.18.3 libreoffice-calc-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-calc-extensions-7.2.5.1-150300.14.22.18.3 libreoffice-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-debugsource-7.2.5.1-150300.14.22.18.3 libreoffice-draw-7.2.5.1-150300.14.22.18.3 libreoffice-draw-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-filters-optional-7.2.5.1-150300.14.22.18.3 libreoffice-gnome-7.2.5.1-150300.14.22.18.3 libreoffice-gnome-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-gtk3-7.2.5.1-150300.14.22.18.3 libreoffice-gtk3-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-impress-7.2.5.1-150300.14.22.18.3 libreoffice-impress-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-librelogo-7.2.5.1-150300.14.22.18.3 libreoffice-mailmerge-7.2.5.1-150300.14.22.18.3 libreoffice-math-7.2.5.1-150300.14.22.18.3 libreoffice-math-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-officebean-7.2.5.1-150300.14.22.18.3 libreoffice-officebean-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-pyuno-7.2.5.1-150300.14.22.18.3 libreoffice-pyuno-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-qt5-7.2.5.1-150300.14.22.18.3 libreoffice-qt5-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-doc-7.2.5.1-150300.14.22.18.3 libreoffice-writer-7.2.5.1-150300.14.22.18.3 libreoffice-writer-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-writer-extensions-7.2.5.1-150300.14.22.18.3 libreofficekit-7.2.5.1-150300.14.22.18.3 libreofficekit-devel-7.2.5.1-150300.14.22.18.3 - openSUSE Leap 15.4 (noarch): libreoffice-branding-upstream-7.2.5.1-150300.14.22.18.3 libreoffice-gdb-pretty-printers-7.2.5.1-150300.14.22.18.3 libreoffice-glade-7.2.5.1-150300.14.22.18.3 libreoffice-icon-themes-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-af-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-am-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ar-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-as-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ast-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-be-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bg-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bn_IN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-br-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-brx-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bs-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ca-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ca_valencia-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ckb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-cs-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-cy-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-da-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-de-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dgo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dsb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dz-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-el-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en_GB-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en_ZA-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-eo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-es-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-et-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-eu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fa-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fur-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fy-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ga-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gd-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gug-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-he-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hsb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-id-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-is-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-it-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ja-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ka-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kab-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-km-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kmr_Latn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ko-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kok-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ks-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lt-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lv-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mai-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ml-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mni-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-my-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ne-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nso-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-oc-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-om-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-or-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pa-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pt_BR-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pt_PT-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ro-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ru-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-rw-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sa_IN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sat-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sd-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-si-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sid-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sq-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ss-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-st-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sv-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sw_TZ-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-szl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ta-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-te-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tg-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-th-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ts-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tt-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ug-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-uk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-uz-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ve-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-vec-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-vi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-xh-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zh_CN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zh_TW-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zu-7.2.5.1-150300.14.22.18.3 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): libreoffice-7.2.5.1-150300.14.22.18.3 libreoffice-base-7.2.5.1-150300.14.22.18.3 libreoffice-base-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-base-drivers-postgresql-7.2.5.1-150300.14.22.18.3 libreoffice-base-drivers-postgresql-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-calc-7.2.5.1-150300.14.22.18.3 libreoffice-calc-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-calc-extensions-7.2.5.1-150300.14.22.18.3 libreoffice-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-debugsource-7.2.5.1-150300.14.22.18.3 libreoffice-draw-7.2.5.1-150300.14.22.18.3 libreoffice-draw-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-filters-optional-7.2.5.1-150300.14.22.18.3 libreoffice-gnome-7.2.5.1-150300.14.22.18.3 libreoffice-gnome-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-gtk3-7.2.5.1-150300.14.22.18.3 libreoffice-gtk3-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-impress-7.2.5.1-150300.14.22.18.3 libreoffice-impress-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-librelogo-7.2.5.1-150300.14.22.18.3 libreoffice-mailmerge-7.2.5.1-150300.14.22.18.3 libreoffice-math-7.2.5.1-150300.14.22.18.3 libreoffice-math-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-officebean-7.2.5.1-150300.14.22.18.3 libreoffice-officebean-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-pyuno-7.2.5.1-150300.14.22.18.3 libreoffice-pyuno-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-qt5-7.2.5.1-150300.14.22.18.3 libreoffice-qt5-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-sdk-doc-7.2.5.1-150300.14.22.18.3 libreoffice-writer-7.2.5.1-150300.14.22.18.3 libreoffice-writer-debuginfo-7.2.5.1-150300.14.22.18.3 libreoffice-writer-extensions-7.2.5.1-150300.14.22.18.3 libreofficekit-7.2.5.1-150300.14.22.18.3 libreofficekit-devel-7.2.5.1-150300.14.22.18.3 - openSUSE Leap 15.3 (noarch): libreoffice-branding-upstream-7.2.5.1-150300.14.22.18.3 libreoffice-gdb-pretty-printers-7.2.5.1-150300.14.22.18.3 libreoffice-glade-7.2.5.1-150300.14.22.18.3 libreoffice-icon-themes-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-af-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-am-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ar-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-as-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ast-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-be-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bg-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bn_IN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-br-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-brx-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-bs-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ca-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ca_valencia-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ckb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-cs-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-cy-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-da-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-de-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dgo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dsb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-dz-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-el-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en_GB-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-en_ZA-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-eo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-es-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-et-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-eu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fa-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fur-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-fy-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ga-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gd-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-gug-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-he-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hsb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-hu-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-id-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-is-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-it-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ja-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ka-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kab-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-km-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kmr_Latn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ko-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-kok-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ks-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lo-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lt-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-lv-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mai-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ml-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mni-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-mr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-my-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nb-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ne-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-nso-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-oc-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-om-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-or-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pa-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pt_BR-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-pt_PT-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ro-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ru-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-rw-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sa_IN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sat-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sd-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-si-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sid-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sq-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ss-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-st-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sv-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-sw_TZ-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-szl-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ta-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-te-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tg-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-th-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tn-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tr-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ts-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-tt-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ug-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-uk-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-uz-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-ve-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-vec-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-vi-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-xh-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zh_CN-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zh_TW-7.2.5.1-150300.14.22.18.3 libreoffice-l10n-zu-7.2.5.1-150300.14.22.18.3 References: https://www.suse.com/security/cve/CVE-2021-25636.html https://bugzilla.suse.com/1196456

1 0

openSUSE-SU-2022:0081-1: important: Security update for ansible
by opensuse-security＠opensuse.org 16 Mar '22

16 Mar '22

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0081-1 Rating: important References: #1099808 #1112959 #1118896 #1126503 #1137528 #1157968 #1157969 #1164133 #1164134 #1164135 #1164136 #1164137 #1164138 #1164139 #1164140 #1165393 #1166389 #1167440 #1167532 #1167873 #1171162 #1174145 #1174302 #1180816 #1180942 #1181119 #1181935 Cross-References: CVE-2018-10875 CVE-2018-16837 CVE-2019-10156 CVE-2019-14846 CVE-2019-14904 CVE-2019-14905 CVE-2020-10684 CVE-2020-10685 CVE-2020-10691 CVE-2020-10729 CVE-2020-14330 CVE-2020-14332 CVE-2020-1733 CVE-2020-1734 CVE-2020-1735 CVE-2020-1736 CVE-2020-1737 CVE-2020-1738 CVE-2020-1739 CVE-2020-1740 CVE-2020-1746 CVE-2020-1753 CVE-2021-20178 CVE-2021-20180 CVE-2021-20191 CVE-2021-20228 CVSS scores: CVE-2018-10875 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2018-10875 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-16837 (NVD) : 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2018-16837 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-10156 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2019-10156 (SUSE): 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVE-2019-14846 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-14846 (SUSE): 2.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVE-2019-14904 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L CVE-2019-14904 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2019-14905 (NVD) : 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L CVE-2019-14905 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-10684 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2020-10685 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-10685 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2020-10691 (NVD) : 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVE-2020-10691 (SUSE): 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVE-2020-10729 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-10729 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2020-14330 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-14330 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-14332 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-14332 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-1733 (NVD) : 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVE-2020-1733 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVE-2020-1734 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L CVE-2020-1735 (NVD) : 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N CVE-2020-1735 (SUSE): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2020-1736 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2020-1736 (SUSE): 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVE-2020-1737 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-1737 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVE-2020-1738 (NVD) : 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L CVE-2020-1738 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVE-2020-1739 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2020-1739 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2020-1740 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-1740 (SUSE): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-1746 (NVD) : 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2020-1746 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2020-1753 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-20178 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-20178 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2021-20180 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2021-20191 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-20191 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVE-2021-20228 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-20228 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that solves 26 vulnerabilities and has one errata is now available. Description: Ansible was updated to 2.9.21 to fix lots of bugs and security issues. Update to version 2.9.20, maintenance release containing numerous bugfixes. Update to version 2.9.19 with minor changes and a few bug fixes. Update to version 2.9.18: * CVE-2021-20228 where default and fallback values for no_log parameters to modules were not previously masked. (bsc#1181935) * CVE-2021-20178 where several parameters to the snmp_facts module were logged and displayed despite containing sensitive information. (bsc#1180816) * CVE-2021-20180 where several parameters to the bitbucket_pipeline_variable were logged and displayed despite containing sensitive information. (bsc#1180942) * CVE-2021-20191 which addresses a number of modules whose parameters were logged and displayed despite containing sensitive information. For the full list of affected modules, refer to the changelog linked below. (bsc#1181119) Update to version 2.9.17 with minor changes and a few bug fixes. Update to version 2.9.16 with minor changes and many bug fixes. update to version 2.9.15 with following breaking change: * ansible-galaxy login command has been removed update to version 2.9.14 with many small improvements and bug fixes, most notably: * kubectl - connection plugin now redact kubectl_token and kubectl_password in console log (CVE-2020-1753 bsc#1166389). update to version 2.9.13 with many bug fixes, most notably: * A security issue was addressed in the "dnf" module, which previously did not check GPG signatures of packages. * A bug in the "cron" module was fixed. In some cases prior to this fix, the module would inadvertently remove cron entries. update to version 2.9.12 with many bug fixes, most notably the following security fixes: * security issue - copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in check mode. Previously when used with check mode and with '-vvv', the module would not censor the content if a change would be made to the destination path. (CVE-2020-14332 bsc#1174302) * security issue atomic_move - change default permissions when creating temporary files so they are not world readable (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736 bsc#1164134) * Fix warning for default permission change when no mode is specified. Follow up to https://github.com/ansible/ansible/issues/67794. (CVE-2020-1736) * Sanitize no_log values from any response keys that might be returned from the uri module (CVE-2020-14330 bsc#1174145). * reset logging level to INFO due to CVE-2019-14846. update to version 2.9.11 with many bug fixes update to version 2.9.10 with many bug fixes. - Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733 (bsc#1164140) update to version 2.9.9 * fix for a regression introduced in 2.9.8 update to version 2.9.8, maintenance release containing numerous bugfixes update to version 2.9.7 with many bug fixes, especially for these security issues: - bsc#1164140 CVE-2020-1733 - insecure temporary directory when running become_user from become directive - bsc#1164139 CVE-2020-1734 shell enabled by default in a pipe lookup plugin subprocess - bsc#1164137 CVE-2020-1735 - path injection on dest parameter in fetch module - bsc#1164134 CVE-2020-1736 atomic_move primitive sets permissive permissions - bsc#1164138 CVE-2020-1737 - Extract-Zip function in win_unzip module does not check extracted path - bsc#1164136 CVE-2020-1738 module package can be selected by the ansible facts - bsc#1164133 CVE-2020-1739 - svn module leaks password when specified as a parameter - bsc#1164135 CVE-2020-1740 - secrets readable after ansible-vault edit - bsc#1165393 CVE-2020-1746 - information disclosure issue in ldap_attr and ldap_entry modules - bsc#1166389 CVE-2020-1753 - kubectl connection plugin leaks sensitive information - bsc#1167532 CVE-2020-10684 - code injection when using ansible_facts as a subkey - bsc#1167440 CVE-2020-10685 - modules which use files encrypted with vault are not properly cleaned up - bsc#1167873 CVE-2020-10691 - archive traversal vulnerability in ansible-galaxy collection install [2] Fixed before 2.9.6, but not yet listed: - bsc#1171162 CVE-2020-10729 two random password lookups in same task return same value - bsc#1157968 CVE-2019-14904 vulnerability in solaris_zone module via crafted solaris zone - bsc#1157969 CVE-2019-14905 malicious code could craft filename in nxos_file_copy module - bsc#1112959 CVE-2018-16837 Information leak in "user" module patch added - (bsc#1137528) CVE-2019-10156: ansible: templating causing an - bsc#1118896 CVE-2018-16876 Information disclosure in vvv+ mode with no_log on (https://github.com/ansible/ansible/pull/49569) - Includes fix for bsc#1099808 (CVE-2018-10875) ansible.cfg is being read from current working directory allowing possible code execution Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-81=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): ansible-2.9.21-bp153.2.3.1 ansible-doc-2.9.21-bp153.2.3.1 ansible-test-2.9.21-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-10875.html https://www.suse.com/security/cve/CVE-2018-16837.html https://www.suse.com/security/cve/CVE-2019-10156.html https://www.suse.com/security/cve/CVE-2019-14846.html https://www.suse.com/security/cve/CVE-2019-14904.html https://www.suse.com/security/cve/CVE-2019-14905.html https://www.suse.com/security/cve/CVE-2020-10684.html https://www.suse.com/security/cve/CVE-2020-10685.html https://www.suse.com/security/cve/CVE-2020-10691.html https://www.suse.com/security/cve/CVE-2020-10729.html https://www.suse.com/security/cve/CVE-2020-14330.html https://www.suse.com/security/cve/CVE-2020-14332.html https://www.suse.com/security/cve/CVE-2020-1733.html https://www.suse.com/security/cve/CVE-2020-1734.html https://www.suse.com/security/cve/CVE-2020-1735.html https://www.suse.com/security/cve/CVE-2020-1736.html https://www.suse.com/security/cve/CVE-2020-1737.html https://www.suse.com/security/cve/CVE-2020-1738.html https://www.suse.com/security/cve/CVE-2020-1739.html https://www.suse.com/security/cve/CVE-2020-1740.html https://www.suse.com/security/cve/CVE-2020-1746.html https://www.suse.com/security/cve/CVE-2020-1753.html https://www.suse.com/security/cve/CVE-2021-20178.html https://www.suse.com/security/cve/CVE-2021-20180.html https://www.suse.com/security/cve/CVE-2021-20191.html https://www.suse.com/security/cve/CVE-2021-20228.html https://bugzilla.suse.com/1099808 https://bugzilla.suse.com/1112959 https://bugzilla.suse.com/1118896 https://bugzilla.suse.com/1126503 https://bugzilla.suse.com/1137528 https://bugzilla.suse.com/1157968 https://bugzilla.suse.com/1157969 https://bugzilla.suse.com/1164133 https://bugzilla.suse.com/1164134 https://bugzilla.suse.com/1164135 https://bugzilla.suse.com/1164136 https://bugzilla.suse.com/1164137 https://bugzilla.suse.com/1164138 https://bugzilla.suse.com/1164139 https://bugzilla.suse.com/1164140 https://bugzilla.suse.com/1165393 https://bugzilla.suse.com/1166389 https://bugzilla.suse.com/1167440 https://bugzilla.suse.com/1167532 https://bugzilla.suse.com/1167873 https://bugzilla.suse.com/1171162 https://bugzilla.suse.com/1174145 https://bugzilla.suse.com/1174302 https://bugzilla.suse.com/1180816 https://bugzilla.suse.com/1180942 https://bugzilla.suse.com/1181119 https://bugzilla.suse.com/1181935

1 0

openSUSE-SU-2022:0872-1: important: Security update for stunnel
by opensuse-security＠opensuse.org 16 Mar '22

16 Mar '22

openSUSE Security Update: Security update for stunnel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0872-1 Rating: important References: #1181400 #1182529 SLE-20679 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes and contains one feature can now be installed. Description: This update for stunnel fixes the following issues: Update to 5.62 including new features and bugfixes: * Security bugfixes - The "redirect" option was fixed to properly handle unauthenticated requests (bsc#1182529). - Fixed a double free with OpenSSL older than 1.1.0. - Added hardening to systemd service (bsc#1181400). * New features - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. - Added support for the new SSL_set_options() values. - Added a bash completion script. - New 'sessionResume' service-level option to allow or disallow session resumption - Download fresh ca-certs.pem for each new release. - New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers). - 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value. - Initial FIPS 3.0 support. - Client-side "protocol = ldap" support * Bugfixes - Fixed a transfer() loop bug. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates. - Fixed a tiny memory leak in configuration file reload error handling. - Fixed engine initialization. - FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available. - Fix configuration reload when compression is used - Fix test suite fixed not to require external connectivity Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-872=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-872=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): stunnel-5.62-3.14.1 stunnel-debuginfo-5.62-3.14.1 stunnel-debugsource-5.62-3.14.1 - openSUSE Leap 15.4 (noarch): stunnel-doc-5.62-3.14.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): stunnel-5.62-3.14.1 stunnel-debuginfo-5.62-3.14.1 stunnel-debugsource-5.62-3.14.1 - openSUSE Leap 15.3 (noarch): stunnel-doc-5.62-3.14.1 References: https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1182529

1 0

openSUSE-SU-2022:0873-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 16 Mar '22

16 Mar '22

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0873-1 Rating: important References: #1193314 #1193444 #1193491 #1194926 #1194928 #1194929 #1194931 #1194932 #1194933 #1194934 #1194935 #1194937 #1194939 #1194940 #1194941 #1195163 Cross-References: CVE-2022-21248 CVE-2022-21282 CVE-2022-21283 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21349 CVE-2022-21360 CVE-2022-21365 CVSS scores: CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21349 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21349 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has three fixes is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Update to version jdk8u322 (icedtea-3.22.0) Including the following security fixes: - CVE-2022-21248, bsc#1194926: Enhance cross VM serialization - CVE-2022-21283, bsc#1194937: Better String matching - CVE-2022-21293, bsc#1194935: Improve String constructions - CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps - CVE-2022-21282, bsc#1194933: Better resolution of URIs - CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management - CVE-2022-21299, bsc#1194931: Improved scanning of XML entities - CVE-2022-21305, bsc#1194939: Better array indexing - CVE-2022-21340, bsc#1194940: Verify Jar Verification - CVE-2022-21341, bsc#1194941: Improve serial forms for transport - CVE-2022-21349: Improve Solaris font rendering - CVE-2022-21360, bsc#1194929: Enhance BMP image support - CVE-2022-21365, bsc#1194928: Enhanced BMP processing Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-873=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-873=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.322-3.64.2 java-1_8_0-openjdk-accessibility-1.8.0.322-3.64.2 java-1_8_0-openjdk-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-debugsource-1.8.0.322-3.64.2 java-1_8_0-openjdk-demo-1.8.0.322-3.64.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-devel-1.8.0.322-3.64.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-headless-1.8.0.322-3.64.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-src-1.8.0.322-3.64.2 - openSUSE Leap 15.4 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.322-3.64.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.322-3.64.2 java-1_8_0-openjdk-accessibility-1.8.0.322-3.64.2 java-1_8_0-openjdk-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-debugsource-1.8.0.322-3.64.2 java-1_8_0-openjdk-demo-1.8.0.322-3.64.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-devel-1.8.0.322-3.64.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-headless-1.8.0.322-3.64.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.322-3.64.2 java-1_8_0-openjdk-src-1.8.0.322-3.64.2 - openSUSE Leap 15.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.322-3.64.2 References: https://www.suse.com/security/cve/CVE-2022-21248.html https://www.suse.com/security/cve/CVE-2022-21282.html https://www.suse.com/security/cve/CVE-2022-21283.html https://www.suse.com/security/cve/CVE-2022-21293.html https://www.suse.com/security/cve/CVE-2022-21294.html https://www.suse.com/security/cve/CVE-2022-21296.html https://www.suse.com/security/cve/CVE-2022-21299.html https://www.suse.com/security/cve/CVE-2022-21305.html https://www.suse.com/security/cve/CVE-2022-21340.html https://www.suse.com/security/cve/CVE-2022-21341.html https://www.suse.com/security/cve/CVE-2022-21349.html https://www.suse.com/security/cve/CVE-2022-21360.html https://www.suse.com/security/cve/CVE-2022-21365.html https://bugzilla.suse.com/1193314 https://bugzilla.suse.com/1193444 https://bugzilla.suse.com/1193491 https://bugzilla.suse.com/1194926 https://bugzilla.suse.com/1194928 https://bugzilla.suse.com/1194929 https://bugzilla.suse.com/1194931 https://bugzilla.suse.com/1194932 https://bugzilla.suse.com/1194933 https://bugzilla.suse.com/1194934 https://bugzilla.suse.com/1194935 https://bugzilla.suse.com/1194937 https://bugzilla.suse.com/1194939 https://bugzilla.suse.com/1194940 https://bugzilla.suse.com/1194941 https://bugzilla.suse.com/1195163

1 0

openSUSE-SU-2022:0870-1: important: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 16 Mar '22

16 Mar '22

openSUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0870-1 Rating: important References: #1194925 #1194926 #1194927 #1194928 #1194929 #1194930 #1194931 #1194932 #1194933 #1194934 #1194935 #1194939 #1194940 #1194941 Cross-References: CVE-2022-21248 CVE-2022-21277 CVE-2022-21282 CVE-2022-21291 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 CVE-2022-21366 CVSS scores: CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: Update to OpenJDK 8u322 build 04 with OpenJ9 0.30.0: - Fixing the following vulnerabilities: CVE-2022-21248 (bsc#1194926), CVE-2022-21277 (bsc#1194930), CVE-2022-21282 (bsc#1194933), CVE-2022-21291 (bsc#1194925), CVE-2022-21293 (bsc#1194935), CVE-2022-21294 (bsc#1194934), CVE-2022-21296 (bsc#1194932), CVE-2022-21299 (bsc#1194931), CVE-2022-21305 (bsc#1194939), CVE-2022-21340 (bsc#1194940), CVE-2022-21341 (bsc#1194941), CVE-2022-21360 (bsc#1194929), CVE-2022-21365 (bsc#1194928), CVE-2022-21366 (bsc#1194927). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-870=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-870=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.322-3.21.2 java-1_8_0-openj9-accessibility-1.8.0.322-3.21.2 java-1_8_0-openj9-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-debugsource-1.8.0.322-3.21.2 java-1_8_0-openj9-demo-1.8.0.322-3.21.2 java-1_8_0-openj9-demo-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-devel-1.8.0.322-3.21.2 java-1_8_0-openj9-devel-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-headless-1.8.0.322-3.21.2 java-1_8_0-openj9-headless-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-src-1.8.0.322-3.21.2 - openSUSE Leap 15.4 (noarch): java-1_8_0-openj9-javadoc-1.8.0.322-3.21.2 - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.322-3.21.2 java-1_8_0-openj9-accessibility-1.8.0.322-3.21.2 java-1_8_0-openj9-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-debugsource-1.8.0.322-3.21.2 java-1_8_0-openj9-demo-1.8.0.322-3.21.2 java-1_8_0-openj9-demo-debuginfo-1.8.0.322-3.21.2 java-1_8_0-openj9-devel-1.8.0.322-3.21.2 java-1_8_0-openj9-headless-1.8.0.322-3.21.2 java-1_8_0-openj9-src-1.8.0.322-3.21.2 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.322-3.21.2 References: https://www.suse.com/security/cve/CVE-2022-21248.html https://www.suse.com/security/cve/CVE-2022-21277.html https://www.suse.com/security/cve/CVE-2022-21282.html https://www.suse.com/security/cve/CVE-2022-21291.html https://www.suse.com/security/cve/CVE-2022-21293.html https://www.suse.com/security/cve/CVE-2022-21294.html https://www.suse.com/security/cve/CVE-2022-21296.html https://www.suse.com/security/cve/CVE-2022-21299.html https://www.suse.com/security/cve/CVE-2022-21305.html https://www.suse.com/security/cve/CVE-2022-21340.html https://www.suse.com/security/cve/CVE-2022-21341.html https://www.suse.com/security/cve/CVE-2022-21360.html https://www.suse.com/security/cve/CVE-2022-21365.html https://www.suse.com/security/cve/CVE-2022-21366.html https://bugzilla.suse.com/1194925 https://bugzilla.suse.com/1194926 https://bugzilla.suse.com/1194927 https://bugzilla.suse.com/1194928 https://bugzilla.suse.com/1194929 https://bugzilla.suse.com/1194930 https://bugzilla.suse.com/1194931 https://bugzilla.suse.com/1194932 https://bugzilla.suse.com/1194933 https://bugzilla.suse.com/1194934 https://bugzilla.suse.com/1194935 https://bugzilla.suse.com/1194939 https://bugzilla.suse.com/1194940 https://bugzilla.suse.com/1194941

1 0

openSUSE-SU-2022:0856-1: important: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0856-1 Rating: important References: #1196877 Cross-References: CVE-2022-0778 CVSS scores: CVE-2022-0778 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2022-0778: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-856=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-856=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-3.49.1 libopenssl10-1.0.2p-3.49.1 libopenssl10-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-1.0.2p-3.49.1 libopenssl1_0_0-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-hmac-1.0.2p-3.49.1 libopenssl1_0_0-steam-1.0.2p-3.49.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-1.0.2p-3.49.1 openssl-1_0_0-cavs-1.0.2p-3.49.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-debugsource-1.0.2p-3.49.1 - openSUSE Leap 15.4 (noarch): openssl-1_0_0-doc-1.0.2p-3.49.1 - openSUSE Leap 15.4 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-3.49.1 libopenssl1_0_0-32bit-1.0.2p-3.49.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-hmac-32bit-1.0.2p-3.49.1 libopenssl1_0_0-steam-32bit-1.0.2p-3.49.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-3.49.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-3.49.1 libopenssl10-1.0.2p-3.49.1 libopenssl10-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-1.0.2p-3.49.1 libopenssl1_0_0-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-hmac-1.0.2p-3.49.1 libopenssl1_0_0-steam-1.0.2p-3.49.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-1.0.2p-3.49.1 openssl-1_0_0-cavs-1.0.2p-3.49.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-debuginfo-1.0.2p-3.49.1 openssl-1_0_0-debugsource-1.0.2p-3.49.1 - openSUSE Leap 15.3 (noarch): openssl-1_0_0-doc-1.0.2p-3.49.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-3.49.1 libopenssl1_0_0-32bit-1.0.2p-3.49.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-3.49.1 libopenssl1_0_0-hmac-32bit-1.0.2p-3.49.1 libopenssl1_0_0-steam-32bit-1.0.2p-3.49.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-3.49.1 References: https://www.suse.com/security/cve/CVE-2022-0778.html https://bugzilla.suse.com/1196877

1 0

openSUSE-SU-2022:0847-1: important: Security update for php7
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0847-1 Rating: important References: #1196252 Cross-References: CVE-2021-21708 CVSS scores: CVE-2021-21708 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21708 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21708: Fixed a memory corruption issue when processing integers from an untrusted source (bsc#1196252). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-847=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-847=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): php7-firebird-7.4.6-3.35.1 php7-firebird-debuginfo-7.4.6-3.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.35.1 apache2-mod_php7-debuginfo-7.4.6-3.35.1 php7-7.4.6-3.35.1 php7-bcmath-7.4.6-3.35.1 php7-bcmath-debuginfo-7.4.6-3.35.1 php7-bz2-7.4.6-3.35.1 php7-bz2-debuginfo-7.4.6-3.35.1 php7-calendar-7.4.6-3.35.1 php7-calendar-debuginfo-7.4.6-3.35.1 php7-ctype-7.4.6-3.35.1 php7-ctype-debuginfo-7.4.6-3.35.1 php7-curl-7.4.6-3.35.1 php7-curl-debuginfo-7.4.6-3.35.1 php7-dba-7.4.6-3.35.1 php7-dba-debuginfo-7.4.6-3.35.1 php7-debuginfo-7.4.6-3.35.1 php7-debugsource-7.4.6-3.35.1 php7-devel-7.4.6-3.35.1 php7-dom-7.4.6-3.35.1 php7-dom-debuginfo-7.4.6-3.35.1 php7-embed-7.4.6-3.35.1 php7-embed-debuginfo-7.4.6-3.35.1 php7-enchant-7.4.6-3.35.1 php7-enchant-debuginfo-7.4.6-3.35.1 php7-exif-7.4.6-3.35.1 php7-exif-debuginfo-7.4.6-3.35.1 php7-fastcgi-7.4.6-3.35.1 php7-fastcgi-debuginfo-7.4.6-3.35.1 php7-fileinfo-7.4.6-3.35.1 php7-fileinfo-debuginfo-7.4.6-3.35.1 php7-firebird-7.4.6-3.35.1 php7-firebird-debuginfo-7.4.6-3.35.1 php7-fpm-7.4.6-3.35.1 php7-fpm-debuginfo-7.4.6-3.35.1 php7-ftp-7.4.6-3.35.1 php7-ftp-debuginfo-7.4.6-3.35.1 php7-gd-7.4.6-3.35.1 php7-gd-debuginfo-7.4.6-3.35.1 php7-gettext-7.4.6-3.35.1 php7-gettext-debuginfo-7.4.6-3.35.1 php7-gmp-7.4.6-3.35.1 php7-gmp-debuginfo-7.4.6-3.35.1 php7-iconv-7.4.6-3.35.1 php7-iconv-debuginfo-7.4.6-3.35.1 php7-intl-7.4.6-3.35.1 php7-intl-debuginfo-7.4.6-3.35.1 php7-json-7.4.6-3.35.1 php7-json-debuginfo-7.4.6-3.35.1 php7-ldap-7.4.6-3.35.1 php7-ldap-debuginfo-7.4.6-3.35.1 php7-mbstring-7.4.6-3.35.1 php7-mbstring-debuginfo-7.4.6-3.35.1 php7-mysql-7.4.6-3.35.1 php7-mysql-debuginfo-7.4.6-3.35.1 php7-odbc-7.4.6-3.35.1 php7-odbc-debuginfo-7.4.6-3.35.1 php7-opcache-7.4.6-3.35.1 php7-opcache-debuginfo-7.4.6-3.35.1 php7-openssl-7.4.6-3.35.1 php7-openssl-debuginfo-7.4.6-3.35.1 php7-pcntl-7.4.6-3.35.1 php7-pcntl-debuginfo-7.4.6-3.35.1 php7-pdo-7.4.6-3.35.1 php7-pdo-debuginfo-7.4.6-3.35.1 php7-pgsql-7.4.6-3.35.1 php7-pgsql-debuginfo-7.4.6-3.35.1 php7-phar-7.4.6-3.35.1 php7-phar-debuginfo-7.4.6-3.35.1 php7-posix-7.4.6-3.35.1 php7-posix-debuginfo-7.4.6-3.35.1 php7-readline-7.4.6-3.35.1 php7-readline-debuginfo-7.4.6-3.35.1 php7-shmop-7.4.6-3.35.1 php7-shmop-debuginfo-7.4.6-3.35.1 php7-snmp-7.4.6-3.35.1 php7-snmp-debuginfo-7.4.6-3.35.1 php7-soap-7.4.6-3.35.1 php7-soap-debuginfo-7.4.6-3.35.1 php7-sockets-7.4.6-3.35.1 php7-sockets-debuginfo-7.4.6-3.35.1 php7-sodium-7.4.6-3.35.1 php7-sodium-debuginfo-7.4.6-3.35.1 php7-sqlite-7.4.6-3.35.1 php7-sqlite-debuginfo-7.4.6-3.35.1 php7-sysvmsg-7.4.6-3.35.1 php7-sysvmsg-debuginfo-7.4.6-3.35.1 php7-sysvsem-7.4.6-3.35.1 php7-sysvsem-debuginfo-7.4.6-3.35.1 php7-sysvshm-7.4.6-3.35.1 php7-sysvshm-debuginfo-7.4.6-3.35.1 php7-test-7.4.6-3.35.1 php7-tidy-7.4.6-3.35.1 php7-tidy-debuginfo-7.4.6-3.35.1 php7-tokenizer-7.4.6-3.35.1 php7-tokenizer-debuginfo-7.4.6-3.35.1 php7-xmlreader-7.4.6-3.35.1 php7-xmlreader-debuginfo-7.4.6-3.35.1 php7-xmlrpc-7.4.6-3.35.1 php7-xmlrpc-debuginfo-7.4.6-3.35.1 php7-xmlwriter-7.4.6-3.35.1 php7-xmlwriter-debuginfo-7.4.6-3.35.1 php7-xsl-7.4.6-3.35.1 php7-xsl-debuginfo-7.4.6-3.35.1 php7-zip-7.4.6-3.35.1 php7-zip-debuginfo-7.4.6-3.35.1 php7-zlib-7.4.6-3.35.1 php7-zlib-debuginfo-7.4.6-3.35.1 References: https://www.suse.com/security/cve/CVE-2021-21708.html https://bugzilla.suse.com/1196252

1 0

openSUSE-SU-2022:0843-1: moderate: Security update for rust, rust1.58, rust1.59
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for rust, rust1.58, rust1.59 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0843-1 Rating: moderate References: #1194767 Cross-References: CVE-2022-21658 CVSS scores: CVE-2022-21658 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2022-21658 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rust, rust1.58, rust1.59 fixes the following issues: This update provides both rust1.58 and rust1.59. Changes in rust1.58: - Add recommends for GCC for installs to be able to link. - Add suggests for lld/clang which are faster than gcc for linking to allow users choice on what they use. - CVE-2022-21658: Resolve race condition in std::fs::remove_dir_all (bsc#1194767) Version 1.58.0 (2022-01-13) ========================== Language -------- - [Format strings can now capture arguments simply by writing `{ident}` in the string.][90473] This works in all macros accepting format strings. Support for this in `panic!` (`panic!("{ident}")`) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect. - [`*const T` pointers can now be dereferenced in const contexts.][89551] - [The rules for when a generic struct implements `Unsize` have been relaxed.][90417] Compiler -------- - [Add LLVM CFI support to the Rust compiler][89652] - [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the `strip` option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo. - [Add support for LLVM coverage mapping format versions 5 and 6][91207] - [Emit LLVM optimization remarks when enabled with `-Cremark`][90833] - [Update the minimum external LLVM to 12][90175] - [Add `x86_64-unknown-none` at Tier 3*][89062] - [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries. - [Don't abort compilation after giving a lint error][87337] - [Error messages point at the source of trait bound obligations in more places][89580] \* Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. Libraries --------- - [All remaining functions in the standard library have `#[must_use]` annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value. - [Paths are automatically canonicalized on Windows for operations that support it][89174] - [Re-enable debug checks for `copy` and `copy_nonoverlapping`][90041] - [Implement `RefUnwindSafe` for `Rc<T>`][87467] - [Make RSplit<T, P>: Clone not require T: Clone][90117] - [Implement `Termination` for `Result<Infallible, E>`][88601]. This allows writing `fn main() -> Result<Infallible, ErrorType>`, for a program whose successful exits never involve returning from `main` (for instance, a program that calls `exit`, or that uses `exec` to run another program). Stabilized APIs --------------- - [`Metadata::is_symlink`] - [`Path::is_symlink`] - [`{integer}::saturating_div`] - [`Option::unwrap_unchecked`] - [`Result::unwrap_unchecked`] - [`Result::unwrap_err_unchecked`] - [`NonZero{unsigned}::is_power_of_two`] - [`File::options`] These APIs are now usable in const contexts: - [`Duration::new`] - [`Duration::checked_add`] - [`Duration::saturating_add`] - [`Duration::checked_sub`] - [`Duration::saturating_sub`] - [`Duration::checked_mul`] - [`Duration::saturating_mul`] - [`Duration::checked_div`] - [`MaybeUninit::as_ptr`] - [`MaybeUninit::as_mut_ptr`] - [`MaybeUninit::assume_init`] - [`MaybeUninit::assume_init_ref`] Cargo ----- - [Add --message-format for install command][cargo/10107] - [Warn when alias shadows external subcommand][cargo/10082] Rustdoc ------- - [Show all Deref implementations recursively in rustdoc][90183] - [Use computed visibility in rustdoc][88447] Compatibility Notes ------------------- - [Try all stable method candidates first before trying unstable ones][90329]. This change ensures that adding new nightly-only methods to the Rust standard library will not break code invoking methods of the same name from traits outside the standard library. - Windows: [`std::process::Command` will no longer search the current directory for executables.][87704] - [All proc-macro backward-compatibility lints are now deny-by-default.][88041] - [proc_macro: Append .0 to unsuffixed float if it would otherwise become int token][90297] - [Refactor weak symbols in std::sys::unix][90846]. This optimizes accesses to glibc functions, by avoiding the use of dlopen. This does not increase the [minimum expected version of glibc](https://doc.rust-lang.org/nightly/rustc/platform-support.html). However, software distributions that use symbol versions to detect library dependencies, and which take weak symbols into account in that analysis, may detect rust binaries as requiring newer versions of glibc. - [rustdoc now rejects some unexpected semicolons in doctests][91026] Version 1.59.0 (2022-02-24) ========================== Language -------- - [Stabilize default arguments for const generics][90207] - [Stabilize destructuring assignment][90521] - [Relax private in public lint on generic bounds and where clauses of trait impls][90586] - [Stabilize asm! and global_asm! for x86, x86_64, ARM, Aarch64, and RISC-V][91728] Compiler -------- - [Stabilize new symbol mangling format, leaving it opt-in (-Csymbol-mangling-version=v0)][90128] - [Emit LLVM optimization remarks when enabled with `-Cremark`][90833] - [Fix sparc64 ABI for aggregates with floating point members][91003] - [Warn when a `#[test]`-like built-in attribute macro is present multiple times.][91172] - [Add support for riscv64gc-unknown-freebsd][91284] - [Stabilize `-Z emit-future-incompat` as `--json future-incompat`][91535] Libraries --------- - [Remove unnecessary bounds for some Hash{Map,Set} methods][91593] Stabilized APIs --------------- - [`std::thread::available_parallelism`][available_parallelism] - [`Result::copied`][result-copied] - [`Result::cloned`][result-cloned] - [`arch::asm!`][asm] - [`arch::global_asm!`][global_asm] - [`ops::ControlFlow::is_break`][is_break] - [`ops::ControlFlow::is_continue`][is_continue] - [`TryFrom<char> for u8`][try_from_char_u8] - [`char::TryFromCharError`][try_from_char_err] implementing `Clone`, `Debug`, `Display`, `PartialEq`, `Copy`, `Eq`, `Error` - [`iter::zip`][zip] - [`NonZeroU8::is_power_of_two`][is_power_of_two8] - [`NonZeroU16::is_power_of_two`][is_power_of_two16] - [`NonZeroU32::is_power_of_two`][is_power_of_two32] - [`NonZeroU64::is_power_of_two`][is_power_of_two64] - [`NonZeroU128::is_power_of_two`][is_power_of_two128] - [`DoubleEndedIterator for ToLowercase`][lowercase] - [`DoubleEndedIterator for ToUppercase`][uppercase] - [`TryFrom<&mut [T]> for [T; N]`][tryfrom_ref_arr] - [`UnwindSafe for Once`][unwindsafe_once] - [`RefUnwindSafe for Once`][refunwindsafe_once] - [armv8 neon intrinsics for aarch64][stdarch/1266] Const-stable: - [`mem::MaybeUninit::as_ptr`][muninit_ptr] - [`mem::MaybeUninit::assume_init`][muninit_init] - [`mem::MaybeUninit::assume_init_ref`][muninit_init_ref] - [`ffi::CStr::from_bytes_with_nul_unchecked`][cstr_from_bytes] Cargo ----- - [Stabilize the `strip` profile option][cargo/10088] - [Stabilize future-incompat-report][cargo/10165] - [Support abbreviating `--release` as `-r`][cargo/10133] - [Support `term.quiet` configuration][cargo/10152] - [Remove `--host` from cargo {publish,search,login}][cargo/10145] Compatibility Notes ------------------- - [Refactor weak symbols in std::sys::unix][90846] This may add new, versioned, symbols when building with a newer glibc, as the standard library uses weak linkage rather than dynamically attempting to load certain symbols at runtime. - [Deprecate crate_type and crate_name nested inside `#![cfg_attr]`][83744] This adds a future compatibility lint to supporting the use of cfg_attr wrapping either crate_type or crate_name specification within Rust files; it is recommended that users migrate to setting the equivalent command line flags. - [Remove effect of `#[no_link]` attribute on name resolution][92034] This may expose new names, leading to conflicts with preexisting names in a given namespace and a compilation failure. - [Cargo will document libraries before binaries.][cargo/10172] - [Respect doc=false in dependencies, not just the root crate][cargo/10201] - [Weaken guarantee around advancing underlying iterators in zip][83791] - [Make split_inclusive() on an empty slice yield an empty output][89825] - [Update std::env::temp_dir to use GetTempPath2 on Windows when available.][89999] Changes in rust wrapper package: - Update to version 1.59.0 - for details see the rust1.59 package - Update package description to help users choose what tooling to install. - Provide rust+cargo by cargo: all cargo<n> package provide this symbol too. Having the meta package provide it allows OBS to have a generic prefernece on the meta package for all packages 'just' requiring rust+cargo. - Update to version 1.58.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-843=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-843=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cargo-1.59.0-150300.21.20.1 rust-1.59.0-150300.21.20.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo-1.59.0-150300.21.20.1 cargo1.58-1.58.0-150300.7.3.1 cargo1.58-debuginfo-1.58.0-150300.7.3.1 cargo1.59-1.59.0-150300.7.4.2 cargo1.59-debuginfo-1.59.0-150300.7.4.2 rust-1.59.0-150300.21.20.1 rust1.58-1.58.0-150300.7.3.1 rust1.58-debuginfo-1.58.0-150300.7.3.1 rust1.59-1.59.0-150300.7.4.2 rust1.59-debuginfo-1.59.0-150300.7.4.2 References: https://www.suse.com/security/cve/CVE-2022-21658.html https://bugzilla.suse.com/1194767

1 0

openSUSE-SU-2022:0841-1: important: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0841-1 Rating: important References: #1195386 #1196501 Cross-References: CVE-2022-23853 CVE-2022-25255 CVSS scores: CVE-2022-23853 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-23853 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25255 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25255 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libqt5-qtbase fixes the following issues: - CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD (bsc#1195386, bsc#1196501). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-841=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libQt5Bootstrap-devel-static-5.12.7-4.17.1 libQt5Concurrent-devel-5.12.7-4.17.1 libQt5Concurrent5-5.12.7-4.17.1 libQt5Concurrent5-debuginfo-5.12.7-4.17.1 libQt5Core-devel-5.12.7-4.17.1 libQt5Core5-5.12.7-4.17.1 libQt5Core5-debuginfo-5.12.7-4.17.1 libQt5DBus-devel-5.12.7-4.17.1 libQt5DBus-devel-debuginfo-5.12.7-4.17.1 libQt5DBus5-5.12.7-4.17.1 libQt5DBus5-debuginfo-5.12.7-4.17.1 libQt5Gui-devel-5.12.7-4.17.1 libQt5Gui5-5.12.7-4.17.1 libQt5Gui5-debuginfo-5.12.7-4.17.1 libQt5KmsSupport-devel-static-5.12.7-4.17.1 libQt5Network-devel-5.12.7-4.17.1 libQt5Network5-5.12.7-4.17.1 libQt5Network5-debuginfo-5.12.7-4.17.1 libQt5OpenGL-devel-5.12.7-4.17.1 libQt5OpenGL5-5.12.7-4.17.1 libQt5OpenGL5-debuginfo-5.12.7-4.17.1 libQt5OpenGLExtensions-devel-static-5.12.7-4.17.1 libQt5PlatformHeaders-devel-5.12.7-4.17.1 libQt5PlatformSupport-devel-static-5.12.7-4.17.1 libQt5PrintSupport-devel-5.12.7-4.17.1 libQt5PrintSupport5-5.12.7-4.17.1 libQt5PrintSupport5-debuginfo-5.12.7-4.17.1 libQt5Sql-devel-5.12.7-4.17.1 libQt5Sql5-5.12.7-4.17.1 libQt5Sql5-debuginfo-5.12.7-4.17.1 libQt5Sql5-mysql-5.12.7-4.17.1 libQt5Sql5-mysql-debuginfo-5.12.7-4.17.1 libQt5Sql5-postgresql-5.12.7-4.17.1 libQt5Sql5-postgresql-debuginfo-5.12.7-4.17.1 libQt5Sql5-sqlite-5.12.7-4.17.1 libQt5Sql5-sqlite-debuginfo-5.12.7-4.17.1 libQt5Sql5-unixODBC-5.12.7-4.17.1 libQt5Sql5-unixODBC-debuginfo-5.12.7-4.17.1 libQt5Test-devel-5.12.7-4.17.1 libQt5Test5-5.12.7-4.17.1 libQt5Test5-debuginfo-5.12.7-4.17.1 libQt5Widgets-devel-5.12.7-4.17.1 libQt5Widgets5-5.12.7-4.17.1 libQt5Widgets5-debuginfo-5.12.7-4.17.1 libQt5Xml-devel-5.12.7-4.17.1 libQt5Xml5-5.12.7-4.17.1 libQt5Xml5-debuginfo-5.12.7-4.17.1 libqt5-qtbase-common-devel-5.12.7-4.17.1 libqt5-qtbase-common-devel-debuginfo-5.12.7-4.17.1 libqt5-qtbase-debugsource-5.12.7-4.17.1 libqt5-qtbase-devel-5.12.7-4.17.1 libqt5-qtbase-examples-5.12.7-4.17.1 libqt5-qtbase-examples-debuginfo-5.12.7-4.17.1 libqt5-qtbase-platformtheme-gtk3-5.12.7-4.17.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.12.7-4.17.1 libqt5-qtbase-platformtheme-xdgdesktopportal-5.12.7-4.17.1 libqt5-qtbase-platformtheme-xdgdesktopportal-debuginfo-5.12.7-4.17.1 - openSUSE Leap 15.3 (x86_64): libQt5Bootstrap-devel-static-32bit-5.12.7-4.17.1 libQt5Concurrent-devel-32bit-5.12.7-4.17.1 libQt5Concurrent5-32bit-5.12.7-4.17.1 libQt5Concurrent5-32bit-debuginfo-5.12.7-4.17.1 libQt5Core-devel-32bit-5.12.7-4.17.1 libQt5Core5-32bit-5.12.7-4.17.1 libQt5Core5-32bit-debuginfo-5.12.7-4.17.1 libQt5DBus-devel-32bit-5.12.7-4.17.1 libQt5DBus-devel-32bit-debuginfo-5.12.7-4.17.1 libQt5DBus5-32bit-5.12.7-4.17.1 libQt5DBus5-32bit-debuginfo-5.12.7-4.17.1 libQt5Gui-devel-32bit-5.12.7-4.17.1 libQt5Gui5-32bit-5.12.7-4.17.1 libQt5Gui5-32bit-debuginfo-5.12.7-4.17.1 libQt5Network-devel-32bit-5.12.7-4.17.1 libQt5Network5-32bit-5.12.7-4.17.1 libQt5Network5-32bit-debuginfo-5.12.7-4.17.1 libQt5OpenGL-devel-32bit-5.12.7-4.17.1 libQt5OpenGL5-32bit-5.12.7-4.17.1 libQt5OpenGL5-32bit-debuginfo-5.12.7-4.17.1 libQt5OpenGLExtensions-devel-static-32bit-5.12.7-4.17.1 libQt5PlatformSupport-devel-static-32bit-5.12.7-4.17.1 libQt5PrintSupport-devel-32bit-5.12.7-4.17.1 libQt5PrintSupport5-32bit-5.12.7-4.17.1 libQt5PrintSupport5-32bit-debuginfo-5.12.7-4.17.1 libQt5Sql-devel-32bit-5.12.7-4.17.1 libQt5Sql5-32bit-5.12.7-4.17.1 libQt5Sql5-32bit-debuginfo-5.12.7-4.17.1 libQt5Sql5-mysql-32bit-5.12.7-4.17.1 libQt5Sql5-mysql-32bit-debuginfo-5.12.7-4.17.1 libQt5Sql5-postgresql-32bit-5.12.7-4.17.1 libQt5Sql5-postgresql-32bit-debuginfo-5.12.7-4.17.1 libQt5Sql5-sqlite-32bit-5.12.7-4.17.1 libQt5Sql5-sqlite-32bit-debuginfo-5.12.7-4.17.1 libQt5Sql5-unixODBC-32bit-5.12.7-4.17.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.12.7-4.17.1 libQt5Test-devel-32bit-5.12.7-4.17.1 libQt5Test5-32bit-5.12.7-4.17.1 libQt5Test5-32bit-debuginfo-5.12.7-4.17.1 libQt5Widgets-devel-32bit-5.12.7-4.17.1 libQt5Widgets5-32bit-5.12.7-4.17.1 libQt5Widgets5-32bit-debuginfo-5.12.7-4.17.1 libQt5Xml-devel-32bit-5.12.7-4.17.1 libQt5Xml5-32bit-5.12.7-4.17.1 libQt5Xml5-32bit-debuginfo-5.12.7-4.17.1 libqt5-qtbase-examples-32bit-5.12.7-4.17.1 libqt5-qtbase-examples-32bit-debuginfo-5.12.7-4.17.1 - openSUSE Leap 15.3 (noarch): libQt5Core-private-headers-devel-5.12.7-4.17.1 libQt5DBus-private-headers-devel-5.12.7-4.17.1 libQt5Gui-private-headers-devel-5.12.7-4.17.1 libQt5KmsSupport-private-headers-devel-5.12.7-4.17.1 libQt5Network-private-headers-devel-5.12.7-4.17.1 libQt5OpenGL-private-headers-devel-5.12.7-4.17.1 libQt5PlatformSupport-private-headers-devel-5.12.7-4.17.1 libQt5PrintSupport-private-headers-devel-5.12.7-4.17.1 libQt5Sql-private-headers-devel-5.12.7-4.17.1 libQt5Test-private-headers-devel-5.12.7-4.17.1 libQt5Widgets-private-headers-devel-5.12.7-4.17.1 libqt5-qtbase-private-headers-devel-5.12.7-4.17.1 References: https://www.suse.com/security/cve/CVE-2022-23853.html https://www.suse.com/security/cve/CVE-2022-25255.html https://bugzilla.suse.com/1195386 https://bugzilla.suse.com/1196501

1 0

openSUSE-SU-2022:0845-1: moderate: Security update for chrony
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for chrony ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0845-1 Rating: moderate References: #1099272 #1115529 #1128846 #1162964 #1172113 #1173277 #1174075 #1174911 #1180689 #1181826 #1187906 #1190926 #1194229 SLE-17334 Cross-References: CVE-2020-14367 CVSS scores: CVE-2020-14367 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVE-2020-14367 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 12 fixes is now available. Description: This update for chrony fixes the following issues: Chrony was updated to 4.1, bringing features and bugfixes. Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Fix pool package dependencies, so that SLE prefers chrony-pool-suse over chrony-pool-empty. (bsc#1194229) - Enable syscallfilter unconditionally [bsc#1181826]. Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don��t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don��t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - By default we don't write log files but log to journald, so only recommend logrotate. - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). Update to 3.5: + Add support for more accurate reading of PHC on Linux 5.0 + Add support for hardware timestamping on interfaces with read-only timestamping configuration + Add support for memory locking and real-time priority on FreeBSD, NetBSD, Solaris + Update seccomp filter to work on more architectures + Validate refclock driver options + Fix bindaddress directive on FreeBSD + Fix transposition of hardware RX timestamp on Linux 4.13 and later + Fix building on non-glibc systems - Fix location of helper script in chrony-dnssrv@.service (bsc#1128846). - Read runtime servers from /var/run/netconfig/chrony.servers to fix bsc#1099272. - Move chrony-helper to /usr/lib/chrony/helper, because there should be no executables in /usr/share. Update to version 3.4 * Enhancements + Add filter option to server/pool/peer directive + Add minsamples and maxsamples options to hwtimestamp directive + Add support for faster frequency adjustments in Linux 4.19 + Change default pidfile to /var/run/chrony/chronyd.pid to allow chronyd without root privileges to remove it on exit + Disable sub-second polling intervals for distant NTP sources + Extend range of supported sub-second polling intervals + Get/set IPv4 destination/source address of NTP packets on FreeBSD + Make burst options and command useful with short polling intervals + Modify auto_offline option to activate when sending request failed + Respond from interface that received NTP request if possible + Add onoffline command to switch between online and offline state according to current system network configuration + Improve example NetworkManager dispatcher script * Bug fixes + Avoid waiting in Linux getrandom system call + Fix PPS support on FreeBSD and NetBSD Update to version 3.3 * Enhancements: + Add burst option to server/pool directive + Add stratum and tai options to refclock directive + Add support for Nettle crypto library + Add workaround for missing kernel receive timestamps on Linux + Wait for late hardware transmit timestamps + Improve source selection with unreachable sources + Improve protection against replay attacks on symmetric mode + Allow PHC refclock to use socket in /var/run/chrony + Add shutdown command to stop chronyd + Simplify format of response to manual list command + Improve handling of unknown responses in chronyc * Bug fixes: + Respond to NTPv1 client requests with zero mode + Fix -x option to not require CAP_SYS_TIME under non-root user + Fix acquisitionport directive to work with privilege separation + Fix handling of socket errors on Linux to avoid high CPU usage + Fix chronyc to not get stuck in infinite loop after clock step Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-845=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): augeas-1.10.1-3.9.1 augeas-debuginfo-1.10.1-3.9.1 augeas-debugsource-1.10.1-3.9.1 augeas-devel-1.10.1-3.9.1 augeas-lense-tests-1.10.1-3.9.1 augeas-lenses-1.10.1-3.9.1 chrony-4.1-150300.16.3.1 chrony-debuginfo-4.1-150300.16.3.1 chrony-debugsource-4.1-150300.16.3.1 libaugeas0-1.10.1-3.9.1 libaugeas0-debuginfo-1.10.1-3.9.1 - openSUSE Leap 15.3 (x86_64): augeas-devel-32bit-1.10.1-3.9.1 libaugeas0-32bit-1.10.1-3.9.1 libaugeas0-32bit-debuginfo-1.10.1-3.9.1 - openSUSE Leap 15.3 (noarch): chrony-pool-empty-4.1-150300.16.3.1 chrony-pool-openSUSE-4.1-150300.16.3.1 chrony-pool-suse-4.1-150300.16.3.1 References: https://www.suse.com/security/cve/CVE-2020-14367.html https://bugzilla.suse.com/1099272 https://bugzilla.suse.com/1115529 https://bugzilla.suse.com/1128846 https://bugzilla.suse.com/1162964 https://bugzilla.suse.com/1172113 https://bugzilla.suse.com/1173277 https://bugzilla.suse.com/1174075 https://bugzilla.suse.com/1174911 https://bugzilla.suse.com/1180689 https://bugzilla.suse.com/1181826 https://bugzilla.suse.com/1187906 https://bugzilla.suse.com/1190926 https://bugzilla.suse.com/1194229

1 0

openSUSE-SU-2022:0844-1: important: Security update for expat
by opensuse-security＠opensuse.org 15 Mar '22

15 Mar '22

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0844-1 Rating: important References: #1196025 #1196784 Cross-References: CVE-2022-25236 CVSS scores: CVE-2022-25236 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25236 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for expat fixes the following issues: - Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-844=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): expat-2.2.5-3.19.1 expat-debuginfo-2.2.5-3.19.1 expat-debugsource-2.2.5-3.19.1 libexpat-devel-2.2.5-3.19.1 libexpat1-2.2.5-3.19.1 libexpat1-debuginfo-2.2.5-3.19.1 - openSUSE Leap 15.3 (x86_64): expat-32bit-debuginfo-2.2.5-3.19.1 libexpat-devel-32bit-2.2.5-3.19.1 libexpat1-32bit-2.2.5-3.19.1 libexpat1-32bit-debuginfo-2.2.5-3.19.1 References: https://www.suse.com/security/cve/CVE-2022-25236.html https://bugzilla.suse.com/1196025 https://bugzilla.suse.com/1196784

1 0

openSUSE-SU-2022:0821-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0821-1 Rating: important References: #1196900 Cross-References: CVE-2022-26381 CVE-2022-26383 CVE-2022-26384 CVE-2022-26386 CVE-2022-26387 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.7.0 ESR (bsc#1196900): - CVE-2022-26383: Browser window spoof using fullscreen mode - CVE-2022-26384: iframe allow-scripts sandbox bypass - CVE-2022-26387: Time-of-check time-of-use bug when verifying add-on signatures - CVE-2022-26381: Use-after-free in text reflows - CVE-2022-26386: Temporary files downloaded to /tmp and accessible by other local users Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-821=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-821=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.7.0-152.22.1 MozillaFirefox-branding-upstream-91.7.0-152.22.1 MozillaFirefox-debuginfo-91.7.0-152.22.1 MozillaFirefox-debugsource-91.7.0-152.22.1 MozillaFirefox-devel-91.7.0-152.22.1 MozillaFirefox-translations-common-91.7.0-152.22.1 MozillaFirefox-translations-other-91.7.0-152.22.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.7.0-152.22.1 MozillaFirefox-branding-upstream-91.7.0-152.22.1 MozillaFirefox-debuginfo-91.7.0-152.22.1 MozillaFirefox-debugsource-91.7.0-152.22.1 MozillaFirefox-devel-91.7.0-152.22.1 MozillaFirefox-translations-common-91.7.0-152.22.1 MozillaFirefox-translations-other-91.7.0-152.22.1 References: https://www.suse.com/security/cve/CVE-2022-26381.html https://www.suse.com/security/cve/CVE-2022-26383.html https://www.suse.com/security/cve/CVE-2022-26384.html https://www.suse.com/security/cve/CVE-2022-26386.html https://www.suse.com/security/cve/CVE-2022-26387.html https://bugzilla.suse.com/1196900

1 0

openSUSE-SU-2022:0823-1: moderate: Security update for protobuf
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for protobuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0823-1 Rating: moderate References: #1195258 Cross-References: CVE-2021-22570 CVSS scores: CVE-2021-22570 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22570 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for protobuf fixes the following issues: - CVE-2021-22570: Fix incorrect parsing of nullchar in the proto symbol (bsc#1195258). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-823=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-823=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libprotobuf-lite15-3.5.0-5.5.1 libprotobuf-lite15-debuginfo-3.5.0-5.5.1 libprotobuf15-3.5.0-5.5.1 libprotobuf15-debuginfo-3.5.0-5.5.1 libprotoc15-3.5.0-5.5.1 libprotoc15-debuginfo-3.5.0-5.5.1 - openSUSE Leap 15.4 (x86_64): libprotobuf-lite15-32bit-3.5.0-5.5.1 libprotobuf-lite15-32bit-debuginfo-3.5.0-5.5.1 libprotobuf15-32bit-3.5.0-5.5.1 libprotobuf15-32bit-debuginfo-3.5.0-5.5.1 libprotoc15-32bit-3.5.0-5.5.1 libprotoc15-32bit-debuginfo-3.5.0-5.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libprotobuf-lite15-3.5.0-5.5.1 libprotobuf-lite15-debuginfo-3.5.0-5.5.1 libprotobuf15-3.5.0-5.5.1 libprotobuf15-debuginfo-3.5.0-5.5.1 libprotoc15-3.5.0-5.5.1 libprotoc15-debuginfo-3.5.0-5.5.1 - openSUSE Leap 15.3 (x86_64): libprotobuf-lite15-32bit-3.5.0-5.5.1 libprotobuf-lite15-32bit-debuginfo-3.5.0-5.5.1 libprotobuf15-32bit-3.5.0-5.5.1 libprotobuf15-32bit-debuginfo-3.5.0-5.5.1 libprotoc15-32bit-3.5.0-5.5.1 libprotoc15-32bit-debuginfo-3.5.0-5.5.1 References: https://www.suse.com/security/cve/CVE-2021-22570.html https://bugzilla.suse.com/1195258

1 0

openSUSE-SU-2022:0817-1: moderate: Security update for xstream
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0817-1 Rating: moderate References: #1195458 Cross-References: CVE-2021-43859 CVSS scores: CVE-2021-43859 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-43859 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: - CVE-2021-43859: Fixed a denial of service when unmarshalling highly recursive collections or maps (bsc#1195458). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-817=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-817=1 Package List: - openSUSE Leap 15.4 (noarch): xstream-1.4.19-3.18.2 xstream-benchmark-1.4.19-3.18.2 xstream-javadoc-1.4.19-3.18.2 xstream-parent-1.4.19-3.18.2 - openSUSE Leap 15.3 (noarch): xstream-1.4.19-3.18.2 xstream-benchmark-1.4.19-3.18.2 xstream-javadoc-1.4.19-3.18.2 xstream-parent-1.4.19-3.18.2 References: https://www.suse.com/security/cve/CVE-2021-43859.html https://bugzilla.suse.com/1195458

1 0

openSUSE-SU-2022:0816-1: moderate: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0816-1 Rating: moderate References: #1194925 #1194926 #1194927 #1194928 #1194929 #1194930 #1194931 #1194932 #1194933 #1194934 #1194935 #1194937 #1194939 #1194940 #1194941 Cross-References: CVE-2022-21248 CVE-2022-21277 CVE-2022-21282 CVE-2022-21283 CVE-2022-21291 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 CVE-2022-21366 CVSS scores: CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-11-openjdk fixes the following issues: - CVE-2022-21248: Fixed incomplete deserialization class filtering in ObjectInputStream. (bnc#1194926) - CVE-2022-21277: Fixed incorrect reading of TIFF files in TIFFNullDecompressor. (bnc#1194930) - CVE-2022-21282: Fixed Insufficient URI checks in the XSLT TransformerImpl. (bnc#1194933) - CVE-2022-21283: Fixed unexpected exception thrown in regex Pattern. (bnc#1194937) - CVE-2022-21291: Fixed Incorrect marking of writeable fields. (bnc#1194925) - CVE-2022-21293: Fixed Incomplete checks of StringBuffer and StringBuilder during deserialization. (bnc#1194935) - CVE-2022-21294: Fixed Incorrect IdentityHashMap size checks during deserialization. (bnc#1194934) - CVE-2022-21296: Fixed Incorrect access checks in XMLEntityManager. (bnc#1194932) - CVE-2022-21299: Fixed Infinite loop related to incorrect handling of newlines in XMLEntityScanner. (bnc#1194931) - CVE-2022-21305: Fixed Array indexing issues in LIRGenerator. (bnc#1194939) - CVE-2022-21340: Fixed Excessive resource use when reading JAR manifest attributes. (bnc#1194940) - CVE-2022-21341: Fixed OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream. (bnc#1194941) - CVE-2022-21360: Fixed Excessive memory allocation in BMPImageReader. (bnc#1194929) - CVE-2022-21365: Fixed Integer overflow in BMPImageReader. (bnc#1194928) - CVE-2022-21366: Fixed Excessive memory allocation in TIFF*Decompressor. (bnc#1194927) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-816=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.14.0-3.74.2 java-11-openjdk-accessibility-11.0.14.0-3.74.2 java-11-openjdk-accessibility-debuginfo-11.0.14.0-3.74.2 java-11-openjdk-debugsource-11.0.14.0-3.74.2 java-11-openjdk-demo-11.0.14.0-3.74.2 java-11-openjdk-devel-11.0.14.0-3.74.2 java-11-openjdk-headless-11.0.14.0-3.74.2 java-11-openjdk-jmods-11.0.14.0-3.74.2 java-11-openjdk-src-11.0.14.0-3.74.2 - openSUSE Leap 15.3 (noarch): java-11-openjdk-javadoc-11.0.14.0-3.74.2 References: https://www.suse.com/security/cve/CVE-2022-21248.html https://www.suse.com/security/cve/CVE-2022-21277.html https://www.suse.com/security/cve/CVE-2022-21282.html https://www.suse.com/security/cve/CVE-2022-21283.html https://www.suse.com/security/cve/CVE-2022-21291.html https://www.suse.com/security/cve/CVE-2022-21293.html https://www.suse.com/security/cve/CVE-2022-21294.html https://www.suse.com/security/cve/CVE-2022-21296.html https://www.suse.com/security/cve/CVE-2022-21299.html https://www.suse.com/security/cve/CVE-2022-21305.html https://www.suse.com/security/cve/CVE-2022-21340.html https://www.suse.com/security/cve/CVE-2022-21341.html https://www.suse.com/security/cve/CVE-2022-21360.html https://www.suse.com/security/cve/CVE-2022-21365.html https://www.suse.com/security/cve/CVE-2022-21366.html https://bugzilla.suse.com/1194925 https://bugzilla.suse.com/1194926 https://bugzilla.suse.com/1194927 https://bugzilla.suse.com/1194928 https://bugzilla.suse.com/1194929 https://bugzilla.suse.com/1194930 https://bugzilla.suse.com/1194931 https://bugzilla.suse.com/1194932 https://bugzilla.suse.com/1194933 https://bugzilla.suse.com/1194934 https://bugzilla.suse.com/1194935 https://bugzilla.suse.com/1194937 https://bugzilla.suse.com/1194939 https://bugzilla.suse.com/1194940 https://bugzilla.suse.com/1194941

1 0

openSUSE-SU-2022:0818-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0818-1 Rating: important References: #1195255 #1196137 Cross-References: CVE-2022-23181 CVSS scores: CVE-2022-23181 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23181 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tomcat fixes the following issues: Security issues fixed: - CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255) - Remove log4j (bsc#1196137) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-818=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-818=1 Package List: - openSUSE Leap 15.4 (noarch): tomcat-9.0.36-19.1 tomcat-admin-webapps-9.0.36-19.1 tomcat-docs-webapp-9.0.36-19.1 tomcat-el-3_0-api-9.0.36-19.1 tomcat-embed-9.0.36-19.1 tomcat-javadoc-9.0.36-19.1 tomcat-jsp-2_3-api-9.0.36-19.1 tomcat-jsvc-9.0.36-19.1 tomcat-lib-9.0.36-19.1 tomcat-servlet-4_0-api-9.0.36-19.1 tomcat-webapps-9.0.36-19.1 - openSUSE Leap 15.3 (noarch): tomcat-9.0.36-19.1 tomcat-admin-webapps-9.0.36-19.1 tomcat-docs-webapp-9.0.36-19.1 tomcat-el-3_0-api-9.0.36-19.1 tomcat-embed-9.0.36-19.1 tomcat-javadoc-9.0.36-19.1 tomcat-jsp-2_3-api-9.0.36-19.1 tomcat-jsvc-9.0.36-19.1 tomcat-lib-9.0.36-19.1 tomcat-servlet-4_0-api-9.0.36-19.1 tomcat-webapps-9.0.36-19.1 References: https://www.suse.com/security/cve/CVE-2022-23181.html https://bugzilla.suse.com/1195255 https://bugzilla.suse.com/1196137

1 0

openSUSE-SU-2022:0815-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0815-1 Rating: moderate References: #1196660 Cross-References: CVE-2021-0561 CVSS scores: CVE-2021-0561 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0561 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flac fixes the following issues: - CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-815=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-815=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): flac-1.3.2-3.9.1 flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.4 (x86_64): flac-devel-32bit-1.3.2-3.9.1 libFLAC++6-32bit-1.3.2-3.9.1 libFLAC++6-32bit-debuginfo-1.3.2-3.9.1 libFLAC8-32bit-1.3.2-3.9.1 libFLAC8-32bit-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.4 (noarch): flac-doc-1.3.2-3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): flac-1.3.2-3.9.1 flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.3 (x86_64): flac-devel-32bit-1.3.2-3.9.1 libFLAC++6-32bit-1.3.2-3.9.1 libFLAC++6-32bit-debuginfo-1.3.2-3.9.1 libFLAC8-32bit-1.3.2-3.9.1 libFLAC8-32bit-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.3 (noarch): flac-doc-1.3.2-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0561.html https://bugzilla.suse.com/1196660

1 0

openSUSE-SU-2022:0079-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 11 Mar '22

11 Mar '22

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0079-1 Rating: moderate References: #1181400 #1196814 Cross-References: CVE-2022-26505 CVSS scores: CVE-2022-26505 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for minidlna fixes the following issues: minidlna was updated to version 1.3.1 (boo#1196814) - Fixed a potential crash in SSDP request parsing. - Fixed a configure script failure on some platforms. - Protect against DNS rebinding attacks. (CVE-2022-26505) - Fix an socket leakage issue on some platforms. - Minor bug fixes. - add "su minidlna minidlna" to the logrotate config - Added hardening to systemd service(s) (boo#1181400). - Use sysusers macros to create minidlna user - Don't hardrequire logrotate, we don't write log files anymore Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-79=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): minidlna-1.3.1-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-26505.html https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1196814

1 0

openSUSE-SU-2022:0802-1: important: Security update for python-libxml2-python
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for python-libxml2-python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0802-1 Rating: important References: #1196490 Cross-References: CVE-2022-23308 CVSS scores: CVE-2022-23308 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23308 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-libxml2-python fixes the following issues: - CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-802=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-802=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-libxml2-python-debugsource-2.9.7-3.40.1 python2-libxml2-python-2.9.7-3.40.1 python2-libxml2-python-debuginfo-2.9.7-3.40.1 python3-libxml2-python-2.9.7-3.40.1 python3-libxml2-python-debuginfo-2.9.7-3.40.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-libxml2-python-debugsource-2.9.7-3.40.1 python2-libxml2-python-2.9.7-3.40.1 python2-libxml2-python-debuginfo-2.9.7-3.40.1 python3-libxml2-python-2.9.7-3.40.1 python3-libxml2-python-debuginfo-2.9.7-3.40.1 References: https://www.suse.com/security/cve/CVE-2022-23308.html https://bugzilla.suse.com/1196490

1 0

openSUSE-SU-2022:0803-1: important: Security update for python-lxml
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for python-lxml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0803-1 Rating: important References: #1118088 #1179534 #1184177 #1193752 Cross-References: CVE-2018-19787 CVE-2020-27783 CVE-2021-28957 CVE-2021-43818 CVSS scores: CVE-2018-19787 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-19787 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2020-27783 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-27783 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-28957 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-28957 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43818 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-43818 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-lxml fixes the following issues: - CVE-2018-19787: Fixed XSS vulnerability via unescaped URL (bsc#1118088). - CVE-2021-28957: Fixed XSS vulnerability ia HTML5 attributes unescaped (bsc#1184177). - CVE-2021-43818: Fixed XSS vulnerability via script content in SVG images using data URIs (bnc#1193752). - CVE-2020-27783: Fixed mutation XSS with improper parser use (bnc#1179534). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-803=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-803=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-3.7.1 python-lxml-debugsource-4.7.1-3.7.1 python2-lxml-4.7.1-3.7.1 python2-lxml-debuginfo-4.7.1-3.7.1 python2-lxml-devel-4.7.1-3.7.1 python3-lxml-4.7.1-3.7.1 python3-lxml-debuginfo-4.7.1-3.7.1 python3-lxml-devel-4.7.1-3.7.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-3.7.1 python-lxml-debugsource-4.7.1-3.7.1 python2-lxml-4.7.1-3.7.1 python2-lxml-debuginfo-4.7.1-3.7.1 python2-lxml-devel-4.7.1-3.7.1 python3-lxml-4.7.1-3.7.1 python3-lxml-debuginfo-4.7.1-3.7.1 python3-lxml-devel-4.7.1-3.7.1 References: https://www.suse.com/security/cve/CVE-2018-19787.html https://www.suse.com/security/cve/CVE-2020-27783.html https://www.suse.com/security/cve/CVE-2021-28957.html https://www.suse.com/security/cve/CVE-2021-43818.html https://bugzilla.suse.com/1118088 https://bugzilla.suse.com/1179534 https://bugzilla.suse.com/1184177 https://bugzilla.suse.com/1193752

1 0

openSUSE-SU-2022:0804-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0804-1 Rating: important References: #1196809 Cross-References: CVE-2022-26485 CVE-2022-26486 CVSS scores: CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 91.6.2 (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-804=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-804=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.6.2-8.59.1 MozillaThunderbird-debuginfo-91.6.2-8.59.1 MozillaThunderbird-debugsource-91.6.2-8.59.1 MozillaThunderbird-translations-common-91.6.2-8.59.1 MozillaThunderbird-translations-other-91.6.2-8.59.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.6.2-8.59.1 MozillaThunderbird-debuginfo-91.6.2-8.59.1 MozillaThunderbird-debugsource-91.6.2-8.59.1 MozillaThunderbird-translations-common-91.6.2-8.59.1 MozillaThunderbird-translations-other-91.6.2-8.59.1 References: https://www.suse.com/security/cve/CVE-2022-26485.html https://www.suse.com/security/cve/CVE-2022-26486.html https://bugzilla.suse.com/1196809

1 0

openSUSE-SU-2022:0783-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0783-1 Rating: important References: #1196809 Cross-References: CVE-2022-26485 CVE-2022-26486 CVSS scores: CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.1 ESR (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-783=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-783=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.1-152.19.1 MozillaFirefox-branding-upstream-91.6.1-152.19.1 MozillaFirefox-debuginfo-91.6.1-152.19.1 MozillaFirefox-debugsource-91.6.1-152.19.1 MozillaFirefox-devel-91.6.1-152.19.1 MozillaFirefox-translations-common-91.6.1-152.19.1 MozillaFirefox-translations-other-91.6.1-152.19.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.1-152.19.1 MozillaFirefox-branding-upstream-91.6.1-152.19.1 MozillaFirefox-debuginfo-91.6.1-152.19.1 MozillaFirefox-debugsource-91.6.1-152.19.1 MozillaFirefox-devel-91.6.1-152.19.1 MozillaFirefox-translations-common-91.6.1-152.19.1 MozillaFirefox-translations-other-91.6.1-152.19.1 References: https://www.suse.com/security/cve/CVE-2022-26485.html https://www.suse.com/security/cve/CVE-2022-26486.html https://bugzilla.suse.com/1196809

1 0

openSUSE-SU-2022:0769-1: important: Security update for libcaca
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for libcaca ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0769-1 Rating: important References: #1184751 #1184752 Cross-References: CVE-2021-30498 CVE-2021-30499 CVSS scores: CVE-2021-30498 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30498 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30499 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30499 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcaca fixes the following issues: - CVE-2021-30498, CVE-2021-30499: If an image has a size of 0x0, when exporting, no data is written and space is allocated for the header only, not taking into account that sprintf appends a NUL byte (bsc#1184751, bsc#1184752). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-769=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-769=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-11.3.1 caca-utils-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca-debugsource-0.99.beta19.git20171003-11.3.1 libcaca-devel-0.99.beta19.git20171003-11.3.1 libcaca-ruby-0.99.beta19.git20171003-11.3.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-0.99.beta19.git20171003-11.3.1 libcaca0-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.4 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.4 (noarch): python3-caca-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-11.3.1 caca-utils-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca-debugsource-0.99.beta19.git20171003-11.3.1 libcaca-devel-0.99.beta19.git20171003-11.3.1 libcaca-ruby-0.99.beta19.git20171003-11.3.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-0.99.beta19.git20171003-11.3.1 libcaca0-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (noarch): python3-caca-0.99.beta19.git20171003-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-30498.html https://www.suse.com/security/cve/CVE-2021-30499.html https://bugzilla.suse.com/1184751 https://bugzilla.suse.com/1184752

1 0

openSUSE-SU-2022:0774-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0774-1 Rating: moderate References: #1195825 Cross-References: CVE-2018-16301 CVSS scores: CVE-2018-16301 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tcpdump fixes the following issues: - CVE-2018-16301: Fixed segfault when handling large files (bsc#1195825). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-774=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): tcpdump-4.9.2-3.18.1 tcpdump-debuginfo-4.9.2-3.18.1 tcpdump-debugsource-4.9.2-3.18.1 References: https://www.suse.com/security/cve/CVE-2018-16301.html https://bugzilla.suse.com/1195825

1 0

openSUSE-SU-2022:0770-1: moderate: Security update for buildah
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0770-1 Rating: moderate References: #1187812 #1192999 SLE-23503 Cross-References: CVE-2019-10214 CVE-2020-10696 CVE-2021-20206 CVSS scores: CVE-2019-10214 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-10214 (SUSE): 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-20206 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20206 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities, contains one feature is now available. Description: This update for buildah fixes the following issues: buildah was updated to version 1.23.1: Update to version 1.22.3: * Update dependencies * Post-branch commit * Accept repositories on login/logout Update to version 1.22.0: * c/image, c/storage, c/common vendor before Podman 3.3 release * Proposed patch for 3399 (shadowutils) * Fix handling of --restore shadow-utils * runtime-flag (debug) test: handle old & new runc * Allow dst and destination for target in secret mounts * Multi-arch: Always push updated version-tagged img * imagebuildah.stageExecutor.prepare(): remove pseudonym check * refine dangling filter * Chown with environment variables not set should fail * Just restore protections of shadow-utils * Remove specific kernel version number requirement from install.md * Multi-arch image workflow: Make steps generic * chroot: fix environment value leakage to intermediate processes * Update nix pin with `make nixpkgs` * buildah source - create and manage source images * Update cirrus-cron notification GH workflow * Reuse code from containers/common/pkg/parse * Cirrus: Freshen VM images * Fix excludes exception begining with / or ./ * Fix syntax for --manifest example * vendor containers/common@main * Cirrus: Drop dependence on fedora-minimal * Adjust conformance-test error-message regex * Workaround appearance of differing debug messages * Cirrus: Install docker from package cache * Switch rusagelogfile to use options.Out * Turn stdio back to blocking when command finishes * Add support for default network creation * Cirrus: Updates for master->main rename * Change references from master to main * Add `--env` and `--workingdir` flags to run command * [CI:DOCS] buildah bud: spelling --ignore-file requires parameter * [CI:DOCS] push/pull: clarify supported transports * Remove unused function arguments * Create mountOptions for mount command flags * Extract version command implementation to function * Add --json flags to `mount` and `version` commands * copier.Put(): set xattrs after ownership * buildah add/copy: spelling * buildah copy and buildah add should support .containerignore * Remove unused util.StartsWithValidTransport * Fix documentation of the --format option of buildah push * Don't use alltransports.ParseImageName with known transports * man pages: clarify `rmi` removes dangling parents * [CI:DOCS] Fix links to c/image master branch * imagebuildah: use the specified logger for logging preprocessing warnings * Fix copy into workdir for a single file * Fix docs links due to branch rename * Update nix pin with `make nixpkgs` * fix(docs): typo * Move to v1.22.0-dev * Fix handling of auth.json file while in a user namespace * Add rusage-logfile flag to optionally send rusage to a file * imagebuildah: redo step logging * Add volumes to make running buildah within a container easier * Add and use a "copy" helper instead of podman load/save * Bump github.com/containers/common from 0.38.4 to 0.39.0 * containerImageRef/containerImageSource: don't buffer uncompressed layers * containerImageRef(): squashed images have no parent images * Sync. workflow across skopeo, buildah, and podman * Bump github.com/containers/storage from 1.31.1 to 1.31.2 * Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95 * Bump to v1.21.1-dev [NO TESTS NEEDED] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-770=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): buildah-1.23.1-150300.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2021-20206.html https://bugzilla.suse.com/1187812 https://bugzilla.suse.com/1192999

1 0

openSUSE-SU-2022:0768-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 Mar '22

08 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0768-1 Rating: important References: #1185973 #1191580 #1194516 #1195536 #1195543 #1195612 #1195840 #1195897 #1195908 #1195949 #1195987 #1196079 #1196155 #1196584 #1196612 Cross-References: CVE-2021-44879 CVE-2022-0001 CVE-2022-0002 CVE-2022-0487 CVE-2022-0492 CVE-2022-0617 CVE-2022-0644 CVE-2022-24448 CVE-2022-24959 CVSS scores: CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0492 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has 6 fixes is now available. Description: The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. The following security bugs were fixed: - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). The following non-security bugs were fixed: - crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840). - lib/iov_iter: initialize "flags" in new pipe_buffer (bsc#1196584). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-768=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-768=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-4.12.14-197.108.1 kernel-vanilla-base-4.12.14-197.108.1 kernel-vanilla-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-debuginfo-4.12.14-197.108.1 kernel-vanilla-debugsource-4.12.14-197.108.1 kernel-vanilla-devel-4.12.14-197.108.1 kernel-vanilla-devel-debuginfo-4.12.14-197.108.1 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 - openSUSE Leap 15.4 (ppc64le x86_64): kernel-debug-base-4.12.14-197.108.1 kernel-debug-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.4 (x86_64): kernel-kvmsmall-base-4.12.14-197.108.1 kernel-kvmsmall-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.4 (s390x): kernel-default-man-4.12.14-197.108.1 kernel-zfcpdump-man-4.12.14-197.108.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-4.12.14-197.108.1 kernel-vanilla-base-4.12.14-197.108.1 kernel-vanilla-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-debuginfo-4.12.14-197.108.1 kernel-vanilla-debugsource-4.12.14-197.108.1 kernel-vanilla-devel-4.12.14-197.108.1 kernel-vanilla-devel-debuginfo-4.12.14-197.108.1 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-197.108.1 kernel-debug-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-197.108.1 kernel-kvmsmall-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-197.108.1 kernel-zfcpdump-man-4.12.14-197.108.1 References: https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0492.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24959.html https://bugzilla.suse.com/1185973 https://bugzilla.suse.com/1191580 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1195536 https://bugzilla.suse.com/1195543 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195840 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195908 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196584 https://bugzilla.suse.com/1196612

1 0

openSUSE-SU-2022:0755-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 Mar '22

08 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0755-1 Rating: important References: #1089644 #1154353 #1156395 #1157038 #1157923 #1176447 #1176940 #1178134 #1181147 #1181588 #1183872 #1187716 #1188404 #1189126 #1190812 #1190972 #1191580 #1191655 #1191741 #1192210 #1192483 #1193096 #1193233 #1193243 #1193787 #1194163 #1194967 #1195012 #1195081 #1195142 #1195352 #1195378 #1195476 #1195477 #1195478 #1195479 #1195480 #1195481 #1195482 #1195506 #1195516 #1195543 #1195668 #1195701 #1195798 #1195799 #1195823 #1195908 #1195928 #1195947 #1195957 #1195995 #1196195 #1196235 #1196339 #1196400 #1196403 #1196516 #1196584 #1196601 #1196612 #1196776 SLE-20807 SLE-22135 SLE-22494 Cross-References: CVE-2022-0001 CVE-2022-0002 CVE-2022-0492 CVE-2022-0516 CVE-2022-0847 CVE-2022-25375 CVSS scores: CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0492 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0516 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0847 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25375 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-25375 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities, contains three features and has 56 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. The following security bugs were fixed: - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584). - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235). - CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). The following non-security bugs were fixed: - ACPI/IORT: Check node revision for PMCG resources (git-fixes). - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes). - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes). - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes). - ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes). - ALSA: hda: Fix regression on forced probe mask option (git-fixes). - ALSA: usb-audio: Correct quirk for VF0770 (git-fixes). - ALSA: usb-audio: initialize variables that could ignore errors (git-fixes). - ASoC: Revert "ASoC: mediatek: Check for error clk pointer" (git-fixes). - ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes). - ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes). - ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes). - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes). - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes). - ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes). - Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494). - Bluetooth: refactor malicious adv data check (git-fixes). - EDAC/xgene: Fix deferred probing (bsc#1178134). - HID:Add support for UGTABLET WP5540 (git-fixes). - IB/cm: Avoid a loop when device has 255 ports (git-fixes) - IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes). - IB/hfi1: Fix AIP early init panic (jsc#SLE-13208). - IB/hfi1: Fix error return code in parse_platform_config() (git-fixes) - IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes) - IB/isert: Fix a use after free in isert_connect_request (git-fixes) - IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes) - IB/mlx5: Add missing error code (git-fixes) - IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes) - IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes) - IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes) - IB/umad: Return EIO in case of when device disassociated (git-fixes) - IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes) - Input: wm97xx: Simplify resource management (git-fixes). - KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674). - NFS: Ensure the server had an up to date ctime before renaming (git-fixes). - NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957). - NFSv4: Handle case where the lookup of a directory fails (git-fixes). - NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes). - PM: hibernate: Remove register_nosave_region_late() (git-fixes). - PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes). - PM: wakeup: simplify the output logic of pm_show_wakelocks() (git-fixes). - RDMA/addr: Be strict with gid size (git-fixes) - RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes) - RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes) - RDMA/bnxt_re: Set queue pair state when being queried (git-fixes) - RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait (git-fixes) - RDMA/cma: Use correct address when leaving multicast group (bsc#1181147). - RDMA/core: Always release restrack object (git-fixes) - RDMA/core: Do not access cm_id after its destruction (git-fixes) - RDMA/core: Do not indicate device ready when device enablement fails (git-fixes) - RDMA/core: Fix corrupted SL on passive side (git-fixes) - RDMA/core: Unify RoCE check and re-factor code (git-fixes) - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes) - RDMA/cxgb4: Fix the reported max_recv_sge value (git-fixes) - RDMA/cxgb4: Validate the number of CQEs (git-fixes) - RDMA/cxgb4: add missing qpid increment (git-fixes) - RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes) - RDMA/hns: Add a check for current state before modifying QP (git-fixes) - RDMA/hns: Remove the portn field in UD SQ WQE (git-fixes) - RDMA/hns: Remove unnecessary access right set during INIT2INIT (git-fixes) - RDMA/i40iw: Address an mmap handler exploit in i40iw (git-fixes) - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes) - RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr() (git-fixes) - RDMA/mlx5: Fix potential race between destroy and CQE poll (git-fixes) - RDMA/mlx5: Fix query DCT via DEVX (git-fixes) - RDMA/mlx5: Fix type warning of sizeof in __mlx5_ib_alloc_counters() (git-fixes) - RDMA/mlx5: Fix wrong free of blue flame register on error (git-fixes) - RDMA/mlx5: Issue FW command to destroy SRQ on reentry (git-fixes) - RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes) - RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation (git-fixes) - RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() (git-fixes) - RDMA/rxe: Clear all QP fields if creation failed (git-fixes) - RDMA/rxe: Compute PSN windows correctly (git-fixes) - RDMA/rxe: Correct skb on loopback path (git-fixes) - RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt (git-fixes) - RDMA/rxe: Fix coding error in rxe_recv.c (git-fixes) - RDMA/rxe: Fix missing kconfig dependency on CRYPTO (git-fixes) - RDMA/rxe: Remove useless code in rxe_recv.c (git-fixes) - RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes) - RDMA/siw: Fix calculation of tx_valid_cpus size (git-fixes) - RDMA/siw: Fix handling of zero-sized Read and Receive Queues. (git-fixes) - RDMA/siw: Properly check send and receive CQ pointers (git-fixes) - RDMA/siw: Release xarray entry (git-fixes) - RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147). - RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp (git-fixes) - RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes) - RDMA/uverbs: Tidy input validation of ib_uverbs_rereg_mr() (git-fixes) - RMDA/sw: Do not allow drivers using dma_virt_ops on highmem configs (git-fixes) - USB: core: Fix hang in usb_kill_urb by adding memory barriers (git-fixes). - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes). - USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes). - USB: serial: cp210x: add NCR Retail IO box id (git-fixes). - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes). - USB: serial: mos7840: fix probe error handling (git-fixes). - USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes). - USB: serial: option: add ZTE MF286D modem (git-fixes). - ata: libata-core: Disable TRIM on M88V29 (git-fixes). - ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes). - blk-cgroup: fix missing put device in error path from blkg_conf_pref() (bsc#1195481). - blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787). - blk-mq: avoid to iterate over stale request (bsc#1193787). - blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787). - blk-mq: clearing flush request reference in tags->rqs (bsc#1193787). - blk-mq: do not grab rq's refcount in blk_mq_check_expired() (bsc#1193787 git-fixes). - blk-mq: fix is_flush_rq (bsc#1193787 git-fixes). - blk-mq: fix kernel panic during iterating over flush request (bsc#1193787 git-fixes). - blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter (bsc#1193787). - blk-mq: introduce blk_mq_set_request_complete (git-fixes). - blk-mq: mark flush request as IDLE in flush_end_io() (bsc#1193787). - blk-tag: Hide spin_lock (bsc#1193787). - block: avoid double io accounting for flush request (bsc#1193787). - block: do not send a rezise udev event for hidden block device (bsc#1193096). - block: mark flush request as IDLE when it is really finished (bsc#1193787). - bonding: pair enable_port with slave_arr_updates (git-fixes). - bpf: Adjust BTF log size limit (git-fixes). - bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) (git-fixes). - btrfs: check for missing device in btrfs_trim_fs (bsc#1195701). - btrfs: check worker before need_preemptive_reclaim (bsc#1196195). - btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1196195). - btrfs: do not include the global rsv size in the preemptive used amount (bsc#1196195). - btrfs: handle preemptive delalloc flushing slightly differently (bsc#1196195). - btrfs: make sure SB_I_VERSION does not get unset by remount (bsc#1192210). - btrfs: only clamp the first time we have to start flushing (bsc#1196195). - btrfs: only ignore delalloc if delalloc is much smaller than ordered (bsc#1196195). - btrfs: reduce the preemptive flushing threshold to 90% (bsc#1196195). - btrfs: take into account global rsv in need_preemptive_reclaim (bsc#1196195). - btrfs: use the global rsv size in the preemptive thresh calculation (bsc#1196195). - ceph: properly put ceph_string reference after async create attempt (bsc#1195798). - ceph: set pool_ns in new inode layout for async creates (bsc#1195799). - dma-buf: heaps: Fix potential spectre v1 gadget (git-fixes). - drm/amdgpu: fix logic inversion in check (git-fixes). - drm/i915/gvt: Make DRM_I915_GVT depend on X86 (git-fixes). - drm/i915/gvt: clean up kernel-doc in gtt.c (git-fixes). - drm/i915/opregion: check port number bounds for SWSCI display power state (git-fixes). - drm/i915/overlay: Prevent divide by zero bugs in scaling (git-fixes). - drm/i915: Correctly populate use_sagv_wm for all pipes (git-fixes). - drm/i915: Fix bw atomic check when switching between SAGV vs. no SAGV (git-fixes). - drm/msm/dsi: Fix missing put_device() call in dsi_get_phy (git-fixes). - drm/nouveau: fix off by one in BIOS boundary checking (git-fixes). - drm/panel: simple: Assign data from panel_dpi_probe() correctly (git-fixes). - drm/radeon: Fix backlight control on iMac 12,1 (git-fixes). - drm/rockchip: dw_hdmi: Do not leave clock enabled in error case (git-fixes). - drm/rockchip: vop: Correct RK3399 VOP register fields (git-fixes). - drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd (git-fixes). - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer (git-fixes). - ext4: check for inconsistent extents between index and leaf block (bsc#1194163 bsc#1196339). - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (bsc#1194163 bsc#1196339). - ext4: fix an use-after-free issue about data=journal writeback mode (bsc#1195482). - ext4: make sure quota gets properly shutdown on error (bsc#1195480). - ext4: prevent partial update of the extent blocks (bsc#1194163 bsc#1196339). - fsnotify: fix fsnotify hooks in pseudo filesystems (bsc#1195479). - fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478). - gve: Add RX context (bsc#1191655). - gve: Add a jumbo-frame device option (bsc#1191655). - gve: Add consumed counts to ethtool stats (bsc#1191655). - gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655). - gve: Correct order of processing device options (bsc#1191655). - gve: Fix GFP flags when allocing pages (git-fixes). - gve: Fix off by one in gve_tx_timeout() (bsc#1191655). - gve: Implement packet continuation for RX (bsc#1191655). - gve: Implement suspend/resume/shutdown (bsc#1191655). - gve: Move the irq db indexes out of the ntfy block struct (bsc#1191655). - gve: Recording rx queue before sending to napi (bsc#1191655). - gve: Recover from queue stall due to missed IRQ (bsc#1191655). - gve: Update gve_free_queue_page_list signature (bsc#1191655). - gve: Use kvcalloc() instead of kvzalloc() (bsc#1191655). - gve: fix for null pointer dereference (bsc#1191655). - gve: fix the wrong AdminQ buffer queue index check (bsc#1176940). - gve: fix unmatched u64_stats_update_end() (bsc#1191655). - gve: remove memory barrier around seqno (bsc#1191655). - i2c: brcmstb: fix support for DSL and CM variants (git-fixes). - i40e: Fix for failed to init adminq while VF reset (git-fixes). - i40e: Fix issue when maximum queues is exceeded (git-fixes). - i40e: Fix queues reservation for XDP (git-fixes). - i40e: Increase delay to 1 s after global EMP reset (git-fixes). - i40e: fix unsigned stat widths (git-fixes). - i40iw: Add support to make destroy QP synchronous (git-fixes) - ibmvnic: Allow queueing resets during probe (bsc#1196516 ltc#196391). - ibmvnic: clear fop when retrying probe (bsc#1196516 ltc#196391). - ibmvnic: complete init_done on transport events (bsc#1196516 ltc#196391). - ibmvnic: define flush_reset_queue helper (bsc#1196516 ltc#196391). - ibmvnic: do not release napi in __ibmvnic_open() (bsc#1195668 ltc#195811). - ibmvnic: free reset-work-item when flushing (bsc#1196516 ltc#196391). - ibmvnic: init init_done_rc earlier (bsc#1196516 ltc#196391). - ibmvnic: initialize rc before completing wait (bsc#1196516 ltc#196391). - ibmvnic: register netdev after init of adapter (bsc#1196516 ltc#196391). - ibmvnic: schedule failover only if vioctl fails (bsc#1196400 ltc#195815). - ice: fix IPIP and SIT TSO offload (git-fixes). - ice: fix an error code in ice_cfg_phy_fec() (jsc#SLE-12878). - ima: Allow template selection with ima_template[_fmt]= after ima_hash= (git-fixes). - ima: Do not print policy rule with inactive LSM labels (git-fixes). - ima: Remove ima_policy file before directory (git-fixes). - integrity: Make function integrity_add_key() static (git-fixes). - integrity: check the return value of audit_log_start() (git-fixes). - integrity: double check iint_cache was initialized (git-fixes). - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() (git-fixes). - iommu/amd: Remove useless irq affinity notifier (git-fixes). - iommu/amd: Restore GA log/tail pointer on host resume (git-fixes). - iommu/amd: X2apic mode: mask/unmask interrupts on suspend/resume (git-fixes). - iommu/amd: X2apic mode: re-enable after resume (git-fixes). - iommu/amd: X2apic mode: setup the INTX registers on mask/unmask (git-fixes). - iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure (git-fixes). - iommu/io-pgtable-arm: Fix table descriptor paddr formatting (git-fixes). - iommu/iova: Fix race between FQ timeout and teardown (git-fixes). - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (git-fixes). - iwlwifi: fix use-after-free (git-fixes). - iwlwifi: pcie: fix locking when "HW not ready" (git-fixes). - iwlwifi: pcie: gen2: fix locking when "HW not ready" (git-fixes). - ixgbevf: Require large buffers for build_skb on 82599VF (git-fixes). - kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190972 LTC#194674). - kABI: Fix kABI for AMD IOMMU driver (git-fixes). - kabi: Hide changes to s390/AP structures (jsc#SLE-20807). - lib/iov_iter: initialize "flags" in new pipe_buffer (bsc#1196584). - libsubcmd: Fix use-after-free for realloc(..., 0) (git-fixes). - md/raid5: fix oops during stripe resizing (bsc#1181588). - misc: fastrpc: avoid double fput() on failed usercopy (git-fixes). - mmc: sdhci-of-esdhc: Check for error num after setting mask (git-fixes). - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status (git-fixes). - mtd: rawnand: gpmi: do not leak PM reference in error path (git-fixes). - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe() (git-fixes). - net/ibmvnic: Cleanup workaround doing an EOI after partition migration (bsc#1089644 ltc#166495 ltc#165544 git-fixes). - net/mlx5e: Fix handling of wrong devices during bond netevent (jsc#SLE-15172). - net: macb: Align the dma and coherent dma masks (git-fixes). - net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE (bsc#1176447). - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs (git-fixes). - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs (git-fixes). - net: phy: marvell: configure RGMII delays for 88E1118 (git-fixes). - net: usb: qmi_wwan: Add support for Dell DW5829e (git-fixes). - nfp: flower: fix ida_idx not being released (bsc#1154353). - nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483). - nfsd: allow lock state ids to be revoked and then freed (bsc#1192483). - nfsd: allow open state ids to be revoked and then freed (bsc#1192483). - nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483). - nfsd: prepare for supporting admin-revocation of state (bsc#1192483). - nvme-core: use list_add_tail_rcu instead of list_add_tail for nvme_init_ns_head (git-fixes). - nvme-fabrics: avoid double completions in nvmf_fail_nonready_command (git-fixes). - nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() (bsc#1195012). - nvme-fabrics: ignore invalid fast_io_fail_tmo values (git-fixes). - nvme-fabrics: remove superfluous nvmf_host_put in nvmf_parse_options (git-fixes). - nvme-multipath: fix ANA state updates when a namespace is not present (git-fixes). - nvme-tcp: fix data digest pointer calculation (git-fixes). - nvme-tcp: fix incorrect h2cdata pdu offset accounting (git-fixes). - nvme-tcp: fix memory leak when freeing a queue (git-fixes). - nvme-tcp: fix possible use-after-completion (git-fixes). - nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() (git-fixes). - nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info (git-fixes). - nvme: do not return an error from nvme_configure_metadata (git-fixes). - nvme: fix use after free when disconnecting a reconnecting ctrl (git-fixes). - nvme: introduce a nvme_host_path_error helper (git-fixes). - nvme: let namespace probing continue for unsupported features (git-fixes). - nvme: refactor ns->ctrl by request (git-fixes). - pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line (git-fixes). - pinctrl: intel: fix unexpected interrupt (git-fixes). - powerpc/64: Move paca allocation later in boot (bsc#1190812). - powerpc/64s: Fix debugfs_simple_attr.cocci warnings (bsc#1157038 bsc#1157923 ltc#182612 git-fixes). - powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending (bsc#1156395). - powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory" (bsc#1195995 ltc#196394). - powerpc/pseries: read the lpar name from the firmware (bsc#1187716 ltc#193451). - powerpc: Set crashkernel offset to mid of RMA region (bsc#1190812). - powerpc: add link stack flush mitigation status in debugfs (bsc#1157038 bsc#1157923 ltc#182612 git-fixes). - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (git-fixes). - rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev (git-fixes). - s390/AP: support new dynamic AP bus size limit (jsc#SLE-20807). - s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant (git-fixes). - s390/bpf: Fix optimizing out zero-extensions (git-fixes). - s390/cio: make ccw_device_dma_* more robust (bsc#1193243 LTC#195549). - s390/cio: verify the driver availability for path_event call (bsc#1195928 LTC#196418). - s390/cpumf: Support for CPU Measurement Facility CSVN 7 (bsc#1195081 LTC#196088). - s390/cpumf: Support for CPU Measurement Sampling Facility LS bit (bsc#1195081 LTC#196088). - s390/pci: add s390_iommu_aperture kernel parameter (bsc#1193233 LTC#195540). - s390/pci: move pseudo-MMIO to prevent MIO overlap (bsc#1194967 LTC#196028). - s390/protvirt: fix error return code in uv_info_init() (jsc#SLE-22135). - s390/sclp: fix Secure-IPL facility detection (bsc#1191741 LTC#194816). - s390/uv: add prot virt guest/host indication files (jsc#SLE-22135). - s390/uv: fix prot virt host indication compilation (jsc#SLE-22135). - scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting (git-fixes). - scsi: core: Add a new error code DID_TRANSPORT_MARGINAL in scsi.h (bsc#1195506). - scsi: core: Add limitless cmd retry support (bsc#1195506). - scsi: core: No retries on abort success (bsc#1195506). - scsi: kABI fix for 'eh_should_retry_cmd' (bsc#1195506). - scsi: lpfc: Add support for eh_should_retry_cmd() (bsc#1195506). - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (bsc#1189126). - scsi: qla2xxx: Add devids and conditionals for 28xx (bsc#1195823). - scsi: qla2xxx: Add marginal path handling support (bsc#1195506). - scsi: qla2xxx: Add ql2xnvme_queues module param to configure number of NVMe queues (bsc#1195823). - scsi: qla2xxx: Add qla2x00_async_done() for async routines (bsc#1195823). - scsi: qla2xxx: Add retry for exec firmware (bsc#1195823). - scsi: qla2xxx: Check for firmware dump already collected (bsc#1195823). - scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters (bsc#1195823). - scsi: qla2xxx: Fix device reconnect in loop topology (bsc#1195823). - scsi: qla2xxx: Fix premature hw access after PCI error (bsc#1195823). - scsi: qla2xxx: Fix scheduling while atomic (bsc#1195823). - scsi: qla2xxx: Fix stuck session in gpdb (bsc#1195823). - scsi: qla2xxx: Fix unmap of already freed sgl (bsc#1195823). - scsi: qla2xxx: Fix warning for missing error code (bsc#1195823). - scsi: qla2xxx: Fix warning message due to adisc being flushed (bsc#1195823). - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter (bsc#1195823). - scsi: qla2xxx: Implement ref count for SRB (bsc#1195823). - scsi: qla2xxx: Refactor asynchronous command initialization (bsc#1195823). - scsi: qla2xxx: Remove a declaration (bsc#1195823). - scsi: qla2xxx: Remove unused qla_sess_op_cmd_list from scsi_qla_host_t (bsc#1195823). - scsi: qla2xxx: Return -ENOMEM if kzalloc() fails (bsc#1195823). - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (bsc#1195823). - scsi: qla2xxx: Update version to 10.02.07.200-k (bsc#1195823). - scsi: qla2xxx: Update version to 10.02.07.300-k (bsc#1195823). - scsi: qla2xxx: edif: Fix clang warning (bsc#1195823). - scsi: qla2xxx: edif: Fix inconsistent check of db_flags (bsc#1195823). - scsi: qla2xxx: edif: Reduce connection thrash (bsc#1195823). - scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe (bsc#1195823). - scsi: qla2xxx: edif: Tweak trace message (bsc#1195823). - scsi: scsi_transport_fc: Add a new rport state FC_PORTSTATE_MARGINAL (bsc#1195506). - scsi: scsi_transport_fc: Add store capability to rport port_state in sysfs (bsc#1195506). - scsi: target: iscsi: Fix cmd abort fabric stop race (bsc#1195286). - scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices (bsc#1195378 LTC#196244). - scsi_transport_fc: kabi fix blank out FC_PORTSTATE_MARGINAL (bsc#1195506). - spi: bcm-qspi: check for valid cs before applying chip select (git-fixes). - spi: mediatek: Avoid NULL pointer crash in interrupt (git-fixes). - spi: meson-spicc: add IRQ check in meson_spicc_probe (git-fixes). - staging/fbtft: Fix backlight (git-fixes). - staging: fbtft: Fix error path in fbtft_driver_module_init() (git-fixes). - tracing: Do not inc err_log entry count if entry allocation fails (git-fixes). - tracing: Dump stacktrace trigger to the corresponding instance (git-fixes). - tracing: Fix smatch warning for null glob in event_hist_trigger_parse() (git-fixes). - tracing: Have traceon and traceoff trigger honor the instance (git-fixes). - tracing: Propagate is_signed to expression (git-fixes). - tty: Add support for Brainboxes UC cards (git-fixes). - udf: Fix NULL ptr deref when converting from inline format (bsc#1195476). - udf: Restore i_lenAlloc when inode expansion fails (bsc#1195477). - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge (git-fixes). - usb: dwc2: Fix NULL qh in dwc2_queue_transaction (git-fixes). - usb: dwc2: gadget: do not try to disable ep0 in dwc2_hsotg_suspend (git-fixes). - usb: dwc3: do not set gadget->is_otg flag (git-fixes). - usb: dwc3: gadget: Prevent core from processing stale TRBs (git-fixes). - usb: f_fs: Fix use-after-free for epfile (git-fixes). - usb: gadget: f_uac2: Define specific wTerminalType (git-fixes). - usb: gadget: rndis: check size of RNDIS_MSG_SET command (git-fixes). - usb: gadget: s3c: remove unused 'udc' variable (git-fixes). - usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition (git-fixes). - usb: host: ehci-tegra: Fix error handling in tegra_ehci_probe() (git-fixes). - usb: ulpi: Call of_node_put correctly (git-fixes). - usb: ulpi: Move of_node_put to ulpi_dev_release (git-fixes). - xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-755=1 Package List: - openSUSE Leap 15.3 (x86_64): cluster-md-kmp-azure-5.3.18-150300.38.47.1 cluster-md-kmp-azure-debuginfo-5.3.18-150300.38.47.1 dlm-kmp-azure-5.3.18-150300.38.47.1 dlm-kmp-azure-debuginfo-5.3.18-150300.38.47.1 gfs2-kmp-azure-5.3.18-150300.38.47.1 gfs2-kmp-azure-debuginfo-5.3.18-150300.38.47.1 kernel-azure-5.3.18-150300.38.47.1 kernel-azure-debuginfo-5.3.18-150300.38.47.1 kernel-azure-debugsource-5.3.18-150300.38.47.1 kernel-azure-devel-5.3.18-150300.38.47.1 kernel-azure-devel-debuginfo-5.3.18-150300.38.47.1 kernel-azure-extra-5.3.18-150300.38.47.1 kernel-azure-extra-debuginfo-5.3.18-150300.38.47.1 kernel-azure-livepatch-devel-5.3.18-150300.38.47.1 kernel-azure-optional-5.3.18-150300.38.47.1 kernel-azure-optional-debuginfo-5.3.18-150300.38.47.1 kernel-syms-azure-5.3.18-150300.38.47.1 kselftests-kmp-azure-5.3.18-150300.38.47.1 kselftests-kmp-azure-debuginfo-5.3.18-150300.38.47.1 ocfs2-kmp-azure-5.3.18-150300.38.47.1 ocfs2-kmp-azure-debuginfo-5.3.18-150300.38.47.1 reiserfs-kmp-azure-5.3.18-150300.38.47.1 reiserfs-kmp-azure-debuginfo-5.3.18-150300.38.47.1 - openSUSE Leap 15.3 (noarch): kernel-devel-azure-5.3.18-150300.38.47.1 kernel-source-azure-5.3.18-150300.38.47.1 References: https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://www.suse.com/security/cve/CVE-2022-0492.html https://www.suse.com/security/cve/CVE-2022-0516.html https://www.suse.com/security/cve/CVE-2022-0847.html https://www.suse.com/security/cve/CVE-2022-25375.html https://bugzilla.suse.com/1089644 https://bugzilla.suse.com/1154353 https://bugzilla.suse.com/1156395 https://bugzilla.suse.com/1157038 https://bugzilla.suse.com/1157923 https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176940 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1181588 https://bugzilla.suse.com/1183872 https://bugzilla.suse.com/1187716 https://bugzilla.suse.com/1188404 https://bugzilla.suse.com/1189126 https://bugzilla.suse.com/1190812 https://bugzilla.suse.com/1190972 https://bugzilla.suse.com/1191580 https://bugzilla.suse.com/1191655 https://bugzilla.suse.com/1191741 https://bugzilla.suse.com/1192210 https://bugzilla.suse.com/1192483 https://bugzilla.suse.com/1193096 https://bugzilla.suse.com/1193233 https://bugzilla.suse.com/1193243 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1194163 https://bugzilla.suse.com/1194967 https://bugzilla.suse.com/1195012 https://bugzilla.suse.com/1195081 https://bugzilla.suse.com/1195142 https://bugzilla.suse.com/1195352 https://bugzilla.suse.com/1195378 https://bugzilla.suse.com/1195476 https://bugzilla.suse.com/1195477 https://bugzilla.suse.com/1195478 https://bugzilla.suse.com/1195479 https://bugzilla.suse.com/1195480 https://bugzilla.suse.com/1195481 https://bugzilla.suse.com/1195482 https://bugzilla.suse.com/1195506 https://bugzilla.suse.com/1195516 https://bugzilla.suse.com/1195543 https://bugzilla.suse.com/1195668 https://bugzilla.suse.com/1195701 https://bugzilla.suse.com/1195798 https://bugzilla.suse.com/1195799 https://bugzilla.suse.com/1195823 https://bugzilla.suse.com/1195908 https://bugzilla.suse.com/1195928 https://bugzilla.suse.com/1195947 https://bugzilla.suse.com/1195957 https://bugzilla.suse.com/1195995 https://bugzilla.suse.com/1196195 https://bugzilla.suse.com/1196235 https://bugzilla.suse.com/1196339 https://bugzilla.suse.com/1196400 https://bugzilla.suse.com/1196403 https://bugzilla.suse.com/1196516 https://bugzilla.suse.com/1196584 https://bugzilla.suse.com/1196601 https://bugzilla.suse.com/1196612 https://bugzilla.suse.com/1196776

1 0

openSUSE-SU-2022:0760-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 Mar '22

08 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0760-1 Rating: important References: #1089644 #1154353 #1157038 #1157923 #1176447 #1176940 #1178134 #1181147 #1181588 #1183872 #1187716 #1188404 #1189126 #1190812 #1190972 #1191580 #1191655 #1191741 #1192210 #1192483 #1193096 #1193233 #1193243 #1193787 #1194163 #1194967 #1195012 #1195081 #1195286 #1195352 #1195378 #1195506 #1195516 #1195543 #1195668 #1195701 #1195798 #1195799 #1195823 #1195908 #1195928 #1195947 #1195957 #1195995 #1196195 #1196235 #1196339 #1196373 #1196400 #1196403 #1196516 #1196584 #1196585 #1196601 #1196612 #1196776 SLE-20807 SLE-22135 SLE-22494 Cross-References: CVE-2022-0001 CVE-2022-0002 CVE-2022-0492 CVE-2022-0516 CVE-2022-0847 CVE-2022-25375 CVSS scores: CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0492 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0516 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0847 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25375 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-25375 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 6 vulnerabilities, contains three features and has 50 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. The following security bugs were fixed: - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584). - CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). - CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516). The following non-security bugs were fixed: - ACPI/IORT: Check node revision for PMCG resources (git-fixes). - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes). - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes). - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes). - ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes). - ALSA: hda: Fix regression on forced probe mask option (git-fixes). - ASoC: Revert "ASoC: mediatek: Check for error clk pointer" (git-fixes). - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes). - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes). - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes). - Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494). - Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352) - EDAC/xgene: Fix deferred probing (bsc#1178134). - HID:Add support for UGTABLET WP5540 (git-fixes). - IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes). - IB/hfi1: Fix AIP early init panic (jsc#SLE-13208). - KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674). - NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957). - PM: hibernate: Remove register_nosave_region_late() (git-fixes). - PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes). - RDMA/cma: Use correct address when leaving multicast group (bsc#1181147). - RDMA/core: Always release restrack object (git-fixes) - RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes) - RDMA/siw: Release xarray entry (git-fixes) - RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147). - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes). - USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes). - USB: serial: cp210x: add NCR Retail IO box id (git-fixes). - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes). - USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes). - USB: serial: option: add ZTE MF286D modem (git-fixes). - ata: libata-core: Disable TRIM on M88V29 (git-fixes). - ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes). - blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787). - blk-mq: avoid to iterate over stale request (bsc#1193787). - blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787). - blk-mq: clearing flush request reference in tags->rqs (bsc#1193787). - blk-mq: do not grab rq's refcount in blk_mq_check_expired() (bsc#1193787 git-fixes). - blk-mq: fix is_flush_rq (bsc#1193787 git-fixes). - blk-mq: fix kernel panic during iterating over flush request (bsc#1193787 git-fixes). - blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter (bsc#1193787). - blk-mq: mark flush request as IDLE in flush_end_io() (bsc#1193787). - blk-tag: Hide spin_lock (bsc#1193787). - block: avoid double io accounting for flush request (bsc#1193787). - block: do not send a rezise udev event for hidden block device (bsc#1193096). - block: mark flush request as IDLE when it is really finished (bsc#1193787). - bonding: pair enable_port with slave_arr_updates (git-fixes). - bpf: Adjust BTF log size limit (git-fixes). - bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) (git-fixes). - btrfs: check for missing device in btrfs_trim_fs (bsc#1195701). - btrfs: check worker before need_preemptive_reclaim (bsc#1196195). - btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1196195). - btrfs: do not include the global rsv size in the preemptive used amount (bsc#1196195). - btrfs: handle preemptive delalloc flushing slightly differently (bsc#1196195). - btrfs: make sure SB_I_VERSION does not get unset by remount (bsc#1192210). - btrfs: only clamp the first time we have to start flushing (bsc#1196195). - btrfs: only ignore delalloc if delalloc is much smaller than ordered (bsc#1196195). - btrfs: reduce the preemptive flushing threshold to 90% (bsc#1196195). - btrfs: take into account global rsv in need_preemptive_reclaim (bsc#1196195). - btrfs: use the global rsv size in the preemptive thresh calculation (bsc#1196195). - ceph: properly put ceph_string reference after async create attempt (bsc#1195798). - ceph: set pool_ns in new inode layout for async creates (bsc#1195799). - drm/amdgpu: fix logic inversion in check (git-fixes). - drm/i915/gvt: Make DRM_I915_GVT depend on X86 (git-fixes). - drm/i915/gvt: clean up kernel-doc in gtt.c (git-fixes). - drm/i915/opregion: check port number bounds for SWSCI display power state (git-fixes). - drm/i915: Correctly populate use_sagv_wm for all pipes (git-fixes). - drm/i915: Fix bw atomic check when switching between SAGV vs. no SAGV (git-fixes). - drm/panel: simple: Assign data from panel_dpi_probe() correctly (git-fixes). - drm/radeon: Fix backlight control on iMac 12,1 (git-fixes). - drm/rockchip: dw_hdmi: Do not leave clock enabled in error case (git-fixes). - drm/rockchip: vop: Correct RK3399 VOP register fields (git-fixes). - drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd (git-fixes). - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer (git-fixes). - ext4: check for inconsistent extents between index and leaf block (bsc#1194163 bsc#1196339). - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (bsc#1194163 bsc#1196339). - ext4: prevent partial update of the extent blocks (bsc#1194163 bsc#1196339). - gve: Add RX context (bsc#1191655). - gve: Add a jumbo-frame device option (bsc#1191655). - gve: Add consumed counts to ethtool stats (bsc#1191655). - gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655). - gve: Correct order of processing device options (bsc#1191655). - gve: Fix GFP flags when allocing pages (git-fixes). - gve: Fix off by one in gve_tx_timeout() (bsc#1191655). - gve: Implement packet continuation for RX (bsc#1191655). - gve: Implement suspend/resume/shutdown (bsc#1191655). - gve: Move the irq db indexes out of the ntfy block struct (bsc#1191655). - gve: Recording rx queue before sending to napi (bsc#1191655). - gve: Recover from queue stall due to missed IRQ (bsc#1191655). - gve: Update gve_free_queue_page_list signature (bsc#1191655). - gve: Use kvcalloc() instead of kvzalloc() (bsc#1191655). - gve: fix for null pointer dereference (bsc#1191655). - gve: fix the wrong AdminQ buffer queue index check (bsc#1176940). - gve: fix unmatched u64_stats_update_end() (bsc#1191655). - gve: remove memory barrier around seqno (bsc#1191655). - i2c: brcmstb: fix support for DSL and CM variants (git-fixes). - i40e: Fix for failed to init adminq while VF reset (git-fixes). - i40e: Fix issue when maximum queues is exceeded (git-fixes). - i40e: Fix queues reservation for XDP (git-fixes). - i40e: Increase delay to 1 s after global EMP reset (git-fixes). - i40e: fix unsigned stat widths (git-fixes). - ibmvnic: Allow queueing resets during probe (bsc#1196516 ltc#196391). - ibmvnic: clear fop when retrying probe (bsc#1196516 ltc#196391). - ibmvnic: complete init_done on transport events (bsc#1196516 ltc#196391). - ibmvnic: define flush_reset_queue helper (bsc#1196516 ltc#196391). - ibmvnic: do not release napi in __ibmvnic_open() (bsc#1195668 ltc#195811). - ibmvnic: free reset-work-item when flushing (bsc#1196516 ltc#196391). - ibmvnic: init init_done_rc earlier (bsc#1196516 ltc#196391). - ibmvnic: initialize rc before completing wait (bsc#1196516 ltc#196391). - ibmvnic: register netdev after init of adapter (bsc#1196516 ltc#196391). - ibmvnic: schedule failover only if vioctl fails (bsc#1196400 ltc#195815). - ice: fix IPIP and SIT TSO offload (git-fixes). - ice: fix an error code in ice_cfg_phy_fec() (jsc#SLE-12878). - ima: Allow template selection with ima_template[_fmt]= after ima_hash= (git-fixes). - ima: Do not print policy rule with inactive LSM labels (git-fixes). - ima: Remove ima_policy file before directory (git-fixes). - integrity: Make function integrity_add_key() static (git-fixes). - integrity: check the return value of audit_log_start() (git-fixes). - integrity: double check iint_cache was initialized (git-fixes). - iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() (git-fixes). - iommu/amd: Remove useless irq affinity notifier (git-fixes). - iommu/amd: Restore GA log/tail pointer on host resume (git-fixes). - iommu/amd: X2apic mode: mask/unmask interrupts on suspend/resume (git-fixes). - iommu/amd: X2apic mode: re-enable after resume (git-fixes). - iommu/amd: X2apic mode: setup the INTX registers on mask/unmask (git-fixes). - iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure (git-fixes). - iommu/io-pgtable-arm: Fix table descriptor paddr formatting (git-fixes). - iommu/iova: Fix race between FQ timeout and teardown (git-fixes). - iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (git-fixes). - iwlwifi: fix use-after-free (git-fixes). - iwlwifi: pcie: fix locking when "HW not ready" (git-fixes). - iwlwifi: pcie: gen2: fix locking when "HW not ready" (git-fixes). - ixgbevf: Require large buffers for build_skb on 82599VF (git-fixes). - kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190972 LTC#194674). - kABI: Fix kABI for AMD IOMMU driver (git-fixes). - kabi: Hide changes to s390/AP structures (jsc#SLE-20807). - lib/iov_iter: initialize "flags" in new pipe_buffer (bsc#1196584). - libsubcmd: Fix use-after-free for realloc(..., 0) (git-fixes). - md/raid5: fix oops during stripe resizing (bsc#1181588). - misc: fastrpc: avoid double fput() on failed usercopy (git-fixes). - mmc: sdhci-of-esdhc: Check for error num after setting mask (git-fixes). - mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status (git-fixes). - mtd: rawnand: gpmi: do not leak PM reference in error path (git-fixes). - mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe() (git-fixes). - net/ibmvnic: Cleanup workaround doing an EOI after partition migration (bsc#1089644 ltc#166495 ltc#165544 git-fixes). - net/mlx5e: Fix handling of wrong devices during bond netevent (jsc#SLE-15172). - net: macb: Align the dma and coherent dma masks (git-fixes). - net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE (bsc#1176447). - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs (git-fixes). - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs (git-fixes). - net: phy: marvell: configure RGMII delays for 88E1118 (git-fixes). - net: usb: qmi_wwan: Add support for Dell DW5829e (git-fixes). - nfp: flower: fix ida_idx not being released (bsc#1154353). - nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483). - nfsd: allow lock state ids to be revoked and then freed (bsc#1192483). - nfsd: allow open state ids to be revoked and then freed (bsc#1192483). - nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483). - nfsd: prepare for supporting admin-revocation of state (bsc#1192483). - nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() (bsc#1195012). - nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info (git-fixes). - nvme: do not return an error from nvme_configure_metadata (git-fixes). - nvme: let namespace probing continue for unsupported features (git-fixes). - powerpc/64: Move paca allocation later in boot (bsc#1190812). - powerpc/64s: Fix debugfs_simple_attr.cocci warnings (bsc#1157038 bsc#1157923 ltc#182612 git-fixes). - powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory" (bsc#1195995 ltc#196394). - powerpc/pseries: read the lpar name from the firmware (bsc#1187716 ltc#193451). - powerpc: Set crashkernel offset to mid of RMA region (bsc#1190812). - powerpc: add link stack flush mitigation status in debugfs (bsc#1157038 bsc#1157923 ltc#182612 git-fixes). - s390/AP: support new dynamic AP bus size limit (jsc#SLE-20807). - s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant (git-fixes). - s390/bpf: Fix optimizing out zero-extensions (git-fixes). - s390/cio: make ccw_device_dma_* more robust (bsc#1193243 LTC#195549). - s390/cio: verify the driver availability for path_event call (bsc#1195928 LTC#196418). - s390/cpumf: Support for CPU Measurement Facility CSVN 7 (bsc#1195081 LTC#196088). - s390/cpumf: Support for CPU Measurement Sampling Facility LS bit (bsc#1195081 LTC#196088). - s390/pci: add s390_iommu_aperture kernel parameter (bsc#1193233 LTC#195540). - s390/pci: move pseudo-MMIO to prevent MIO overlap (bsc#1194967 LTC#196028). - s390/protvirt: fix error return code in uv_info_init() (jsc#SLE-22135). - s390/sclp: fix Secure-IPL facility detection (bsc#1191741 LTC#194816). - s390/uv: add prot virt guest/host indication files (jsc#SLE-22135). - s390/uv: fix prot virt host indication compilation (jsc#SLE-22135). - scsi: core: Add a new error code DID_TRANSPORT_MARGINAL in scsi.h (bsc#1195506). - scsi: core: Add limitless cmd retry support (bsc#1195506). - scsi: core: No retries on abort success (bsc#1195506). - scsi: kABI fix for 'eh_should_retry_cmd' (bsc#1195506). - scsi: lpfc: Add support for eh_should_retry_cmd() (bsc#1195506). - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (bsc#1189126). - scsi: qla2xxx: Add devids and conditionals for 28xx (bsc#1195823). - scsi: qla2xxx: Add marginal path handling support (bsc#1195506). - scsi: qla2xxx: Add ql2xnvme_queues module param to configure number of NVMe queues (bsc#1195823). - scsi: qla2xxx: Add qla2x00_async_done() for async routines (bsc#1195823). - scsi: qla2xxx: Add retry for exec firmware (bsc#1195823). - scsi: qla2xxx: Check for firmware dump already collected (bsc#1195823). - scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters (bsc#1195823). - scsi: qla2xxx: Fix device reconnect in loop topology (bsc#1195823). - scsi: qla2xxx: Fix premature hw access after PCI error (bsc#1195823). - scsi: qla2xxx: Fix scheduling while atomic (bsc#1195823). - scsi: qla2xxx: Fix stuck session in gpdb (bsc#1195823). - scsi: qla2xxx: Fix unmap of already freed sgl (bsc#1195823). - scsi: qla2xxx: Fix warning for missing error code (bsc#1195823). - scsi: qla2xxx: Fix warning message due to adisc being flushed (bsc#1195823). - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter (bsc#1195823). - scsi: qla2xxx: Implement ref count for SRB (bsc#1195823). - scsi: qla2xxx: Refactor asynchronous command initialization (bsc#1195823). - scsi: qla2xxx: Remove a declaration (bsc#1195823). - scsi: qla2xxx: Remove unused qla_sess_op_cmd_list from scsi_qla_host_t (bsc#1195823). - scsi: qla2xxx: Return -ENOMEM if kzalloc() fails (bsc#1195823). - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (bsc#1195823). - scsi: qla2xxx: Update version to 10.02.07.200-k (bsc#1195823). - scsi: qla2xxx: Update version to 10.02.07.300-k (bsc#1195823). - scsi: qla2xxx: edif: Fix clang warning (bsc#1195823). - scsi: qla2xxx: edif: Fix inconsistent check of db_flags (bsc#1195823). - scsi: qla2xxx: edif: Reduce connection thrash (bsc#1195823). - scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe (bsc#1195823). - scsi: qla2xxx: edif: Tweak trace message (bsc#1195823). - scsi: scsi_transport_fc: Add a new rport state FC_PORTSTATE_MARGINAL (bsc#1195506). - scsi: scsi_transport_fc: Add store capability to rport port_state in sysfs (bsc#1195506). - scsi: target: iscsi: Fix cmd abort fabric stop race (bsc#1195286). - scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices (bsc#1195378 LTC#196244). - scsi_transport_fc: kabi fix blank out FC_PORTSTATE_MARGINAL (bsc#1195506). - staging/fbtft: Fix backlight (git-fixes). - staging: fbtft: Fix error path in fbtft_driver_module_init() (git-fixes). - tracing: Do not inc err_log entry count if entry allocation fails (git-fixes). - tracing: Dump stacktrace trigger to the corresponding instance (git-fixes). - tracing: Fix smatch warning for null glob in event_hist_trigger_parse() (git-fixes). - tracing: Have traceon and traceoff trigger honor the instance (git-fixes). - tracing: Propagate is_signed to expression (git-fixes). - usb: dwc2: Fix NULL qh in dwc2_queue_transaction (git-fixes). - usb: dwc2: gadget: do not try to disable ep0 in dwc2_hsotg_suspend (git-fixes). - usb: dwc3: do not set gadget->is_otg flag (git-fixes). - usb: dwc3: gadget: Prevent core from processing stale TRBs (git-fixes). - usb: f_fs: Fix use-after-free for epfile (git-fixes). - usb: gadget: f_uac2: Define specific wTerminalType (git-fixes). - usb: gadget: rndis: check size of RNDIS_MSG_SET command (git-fixes). - usb: gadget: s3c: remove unused 'udc' variable (git-fixes). - usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition (git-fixes). - usb: host: ehci-tegra: Fix error handling in tegra_ehci_probe() (git-fixes). - usb: ulpi: Call of_node_put correctly (git-fixes). - usb: ulpi: Move of_node_put to ulpi_dev_release (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-760=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-760=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.54.1 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 dlm-kmp-preempt-5.3.18-150300.59.54.1 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 gfs2-kmp-preempt-5.3.18-150300.59.54.1 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-5.3.18-150300.59.54.1 kernel-preempt-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-debugsource-5.3.18-150300.59.54.1 kernel-preempt-devel-5.3.18-150300.59.54.1 kernel-preempt-devel-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-extra-5.3.18-150300.59.54.1 kernel-preempt-extra-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-livepatch-devel-5.3.18-150300.59.54.1 kernel-preempt-optional-5.3.18-150300.59.54.1 kernel-preempt-optional-debuginfo-5.3.18-150300.59.54.1 kselftests-kmp-preempt-5.3.18-150300.59.54.1 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 ocfs2-kmp-preempt-5.3.18-150300.59.54.1 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 reiserfs-kmp-preempt-5.3.18-150300.59.54.1 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 - openSUSE Leap 15.4 (aarch64): dtb-al-5.3.18-150300.59.54.1 dtb-zte-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-5.3.18-150300.59.54.1 cluster-md-kmp-default-debuginfo-5.3.18-150300.59.54.1 dlm-kmp-default-5.3.18-150300.59.54.1 dlm-kmp-default-debuginfo-5.3.18-150300.59.54.1 gfs2-kmp-default-5.3.18-150300.59.54.1 gfs2-kmp-default-debuginfo-5.3.18-150300.59.54.1 kernel-default-5.3.18-150300.59.54.1 kernel-default-base-5.3.18-150300.59.54.1.150300.18.35.3 kernel-default-base-rebuild-5.3.18-150300.59.54.1.150300.18.35.3 kernel-default-debuginfo-5.3.18-150300.59.54.1 kernel-default-debugsource-5.3.18-150300.59.54.1 kernel-default-devel-5.3.18-150300.59.54.1 kernel-default-devel-debuginfo-5.3.18-150300.59.54.1 kernel-default-extra-5.3.18-150300.59.54.1 kernel-default-extra-debuginfo-5.3.18-150300.59.54.1 kernel-default-livepatch-5.3.18-150300.59.54.1 kernel-default-livepatch-devel-5.3.18-150300.59.54.1 kernel-default-optional-5.3.18-150300.59.54.1 kernel-default-optional-debuginfo-5.3.18-150300.59.54.1 kernel-obs-build-5.3.18-150300.59.54.1 kernel-obs-build-debugsource-5.3.18-150300.59.54.1 kernel-obs-qa-5.3.18-150300.59.54.1 kernel-syms-5.3.18-150300.59.54.1 kselftests-kmp-default-5.3.18-150300.59.54.1 kselftests-kmp-default-debuginfo-5.3.18-150300.59.54.1 ocfs2-kmp-default-5.3.18-150300.59.54.1 ocfs2-kmp-default-debuginfo-5.3.18-150300.59.54.1 reiserfs-kmp-default-5.3.18-150300.59.54.1 reiserfs-kmp-default-debuginfo-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.54.1 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 dlm-kmp-preempt-5.3.18-150300.59.54.1 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 gfs2-kmp-preempt-5.3.18-150300.59.54.1 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-5.3.18-150300.59.54.1 kernel-preempt-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-debugsource-5.3.18-150300.59.54.1 kernel-preempt-devel-5.3.18-150300.59.54.1 kernel-preempt-devel-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-extra-5.3.18-150300.59.54.1 kernel-preempt-extra-debuginfo-5.3.18-150300.59.54.1 kernel-preempt-livepatch-devel-5.3.18-150300.59.54.1 kernel-preempt-optional-5.3.18-150300.59.54.1 kernel-preempt-optional-debuginfo-5.3.18-150300.59.54.1 kselftests-kmp-preempt-5.3.18-150300.59.54.1 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 ocfs2-kmp-preempt-5.3.18-150300.59.54.1 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 reiserfs-kmp-preempt-5.3.18-150300.59.54.1 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-5.3.18-150300.59.54.1 kernel-debug-debuginfo-5.3.18-150300.59.54.1 kernel-debug-debugsource-5.3.18-150300.59.54.1 kernel-debug-devel-5.3.18-150300.59.54.1 kernel-debug-devel-debuginfo-5.3.18-150300.59.54.1 kernel-debug-livepatch-devel-5.3.18-150300.59.54.1 kernel-kvmsmall-5.3.18-150300.59.54.1 kernel-kvmsmall-debuginfo-5.3.18-150300.59.54.1 kernel-kvmsmall-debugsource-5.3.18-150300.59.54.1 kernel-kvmsmall-devel-5.3.18-150300.59.54.1 kernel-kvmsmall-devel-debuginfo-5.3.18-150300.59.54.1 kernel-kvmsmall-livepatch-devel-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (aarch64): cluster-md-kmp-64kb-5.3.18-150300.59.54.1 cluster-md-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 dlm-kmp-64kb-5.3.18-150300.59.54.1 dlm-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 dtb-al-5.3.18-150300.59.54.1 dtb-allwinner-5.3.18-150300.59.54.1 dtb-altera-5.3.18-150300.59.54.1 dtb-amd-5.3.18-150300.59.54.1 dtb-amlogic-5.3.18-150300.59.54.1 dtb-apm-5.3.18-150300.59.54.1 dtb-arm-5.3.18-150300.59.54.1 dtb-broadcom-5.3.18-150300.59.54.1 dtb-cavium-5.3.18-150300.59.54.1 dtb-exynos-5.3.18-150300.59.54.1 dtb-freescale-5.3.18-150300.59.54.1 dtb-hisilicon-5.3.18-150300.59.54.1 dtb-lg-5.3.18-150300.59.54.1 dtb-marvell-5.3.18-150300.59.54.1 dtb-mediatek-5.3.18-150300.59.54.1 dtb-nvidia-5.3.18-150300.59.54.1 dtb-qcom-5.3.18-150300.59.54.1 dtb-renesas-5.3.18-150300.59.54.1 dtb-rockchip-5.3.18-150300.59.54.1 dtb-socionext-5.3.18-150300.59.54.1 dtb-sprd-5.3.18-150300.59.54.1 dtb-xilinx-5.3.18-150300.59.54.1 dtb-zte-5.3.18-150300.59.54.1 gfs2-kmp-64kb-5.3.18-150300.59.54.1 gfs2-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 kernel-64kb-5.3.18-150300.59.54.1 kernel-64kb-debuginfo-5.3.18-150300.59.54.1 kernel-64kb-debugsource-5.3.18-150300.59.54.1 kernel-64kb-devel-5.3.18-150300.59.54.1 kernel-64kb-devel-debuginfo-5.3.18-150300.59.54.1 kernel-64kb-extra-5.3.18-150300.59.54.1 kernel-64kb-extra-debuginfo-5.3.18-150300.59.54.1 kernel-64kb-livepatch-devel-5.3.18-150300.59.54.1 kernel-64kb-optional-5.3.18-150300.59.54.1 kernel-64kb-optional-debuginfo-5.3.18-150300.59.54.1 kselftests-kmp-64kb-5.3.18-150300.59.54.1 kselftests-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 ocfs2-kmp-64kb-5.3.18-150300.59.54.1 ocfs2-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 reiserfs-kmp-64kb-5.3.18-150300.59.54.1 reiserfs-kmp-64kb-debuginfo-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (noarch): kernel-devel-5.3.18-150300.59.54.1 kernel-docs-5.3.18-150300.59.54.1 kernel-docs-html-5.3.18-150300.59.54.1 kernel-macros-5.3.18-150300.59.54.1 kernel-source-5.3.18-150300.59.54.1 kernel-source-vanilla-5.3.18-150300.59.54.1 - openSUSE Leap 15.3 (s390x): kernel-zfcpdump-5.3.18-150300.59.54.1 kernel-zfcpdump-debuginfo-5.3.18-150300.59.54.1 kernel-zfcpdump-debugsource-5.3.18-150300.59.54.1 References: https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://www.suse.com/security/cve/CVE-2022-0492.html https://www.suse.com/security/cve/CVE-2022-0516.html https://www.suse.com/security/cve/CVE-2022-0847.html https://www.suse.com/security/cve/CVE-2022-25375.html https://bugzilla.suse.com/1089644 https://bugzilla.suse.com/1154353 https://bugzilla.suse.com/1157038 https://bugzilla.suse.com/1157923 https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176940 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1181588 https://bugzilla.suse.com/1183872 https://bugzilla.suse.com/1187716 https://bugzilla.suse.com/1188404 https://bugzilla.suse.com/1189126 https://bugzilla.suse.com/1190812 https://bugzilla.suse.com/1190972 https://bugzilla.suse.com/1191580 https://bugzilla.suse.com/1191655 https://bugzilla.suse.com/1191741 https://bugzilla.suse.com/1192210 https://bugzilla.suse.com/1192483 https://bugzilla.suse.com/1193096 https://bugzilla.suse.com/1193233 https://bugzilla.suse.com/1193243 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1194163 https://bugzilla.suse.com/1194967 https://bugzilla.suse.com/1195012 https://bugzilla.suse.com/1195081 https://bugzilla.suse.com/1195286 https://bugzilla.suse.com/1195352 https://bugzilla.suse.com/1195378 https://bugzilla.suse.com/1195506 https://bugzilla.suse.com/1195516 https://bugzilla.suse.com/1195543 https://bugzilla.suse.com/1195668 https://bugzilla.suse.com/1195701 https://bugzilla.suse.com/1195798 https://bugzilla.suse.com/1195799 https://bugzilla.suse.com/1195823 https://bugzilla.suse.com/1195908 https://bugzilla.suse.com/1195928 https://bugzilla.suse.com/1195947 https://bugzilla.suse.com/1195957 https://bugzilla.suse.com/1195995 https://bugzilla.suse.com/1196195 https://bugzilla.suse.com/1196235 https://bugzilla.suse.com/1196339 https://bugzilla.suse.com/1196373 https://bugzilla.suse.com/1196400 https://bugzilla.suse.com/1196403 https://bugzilla.suse.com/1196516 https://bugzilla.suse.com/1196584 https://bugzilla.suse.com/1196585 https://bugzilla.suse.com/1196601 https://bugzilla.suse.com/1196612 https://bugzilla.suse.com/1196776

1 0

openSUSE-SU-2022:0743-1: important: Security update for cyrus-sasl
by opensuse-security＠opensuse.org 08 Mar '22

08 Mar '22

openSUSE Security Update: Security update for cyrus-sasl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0743-1 Rating: important References: #1194265 #1196036 Cross-References: CVE-2022-24407 CVSS scores: CVE-2022-24407 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24407 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for cyrus-sasl fixes the following issues: - CVE-2022-24407: Fixed SQL injection in sql_auxprop_store in plugins/sql.c (bsc#1196036). The following non-security bugs were fixed: - postfix: sasl authentication with password fails (bsc#1194265). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-743=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-743=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cyrus-sasl-2.1.27-150300.4.6.1 cyrus-sasl-bdb-2.1.27-150300.4.6.1 cyrus-sasl-bdb-crammd5-2.1.27-150300.4.6.1 cyrus-sasl-bdb-crammd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-bdb-devel-2.1.27-150300.4.6.1 cyrus-sasl-bdb-digestmd5-2.1.27-150300.4.6.1 cyrus-sasl-bdb-digestmd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gs2-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gs2-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gssapi-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gssapi-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-ntlm-2.1.27-150300.4.6.1 cyrus-sasl-bdb-ntlm-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-otp-2.1.27-150300.4.6.1 cyrus-sasl-bdb-otp-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-plain-2.1.27-150300.4.6.1 cyrus-sasl-bdb-plain-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-scram-2.1.27-150300.4.6.1 cyrus-sasl-bdb-scram-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-devel-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gs2-2.1.27-150300.4.6.1 cyrus-sasl-gs2-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-bdb-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ntlm-2.1.27-150300.4.6.1 cyrus-sasl-ntlm-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-otp-2.1.27-150300.4.6.1 cyrus-sasl-otp-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-plain-2.1.27-150300.4.6.1 cyrus-sasl-plain-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-scram-2.1.27-150300.4.6.1 cyrus-sasl-scram-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-bdb-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.27-150300.4.6.1 libsasl2-3-2.1.27-150300.4.6.1 libsasl2-3-debuginfo-2.1.27-150300.4.6.1 - openSUSE Leap 15.4 (x86_64): cyrus-sasl-32bit-2.1.27-150300.4.6.1 cyrus-sasl-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-32bit-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-devel-32bit-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-32bit-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-32bit-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-32bit-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-otp-32bit-2.1.27-150300.4.6.1 cyrus-sasl-otp-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-plain-32bit-2.1.27-150300.4.6.1 cyrus-sasl-plain-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-32bit-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-32bit-debuginfo-2.1.27-150300.4.6.1 libsasl2-3-32bit-2.1.27-150300.4.6.1 libsasl2-3-32bit-debuginfo-2.1.27-150300.4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cyrus-sasl-2.1.27-150300.4.6.1 cyrus-sasl-bdb-2.1.27-150300.4.6.1 cyrus-sasl-bdb-crammd5-2.1.27-150300.4.6.1 cyrus-sasl-bdb-crammd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-bdb-devel-2.1.27-150300.4.6.1 cyrus-sasl-bdb-digestmd5-2.1.27-150300.4.6.1 cyrus-sasl-bdb-digestmd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gs2-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gs2-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gssapi-2.1.27-150300.4.6.1 cyrus-sasl-bdb-gssapi-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-ntlm-2.1.27-150300.4.6.1 cyrus-sasl-bdb-ntlm-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-otp-2.1.27-150300.4.6.1 cyrus-sasl-bdb-otp-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-plain-2.1.27-150300.4.6.1 cyrus-sasl-bdb-plain-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-bdb-scram-2.1.27-150300.4.6.1 cyrus-sasl-bdb-scram-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-devel-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gs2-2.1.27-150300.4.6.1 cyrus-sasl-gs2-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-bdb-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ntlm-2.1.27-150300.4.6.1 cyrus-sasl-ntlm-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-otp-2.1.27-150300.4.6.1 cyrus-sasl-otp-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-plain-2.1.27-150300.4.6.1 cyrus-sasl-plain-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-bdb-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-saslauthd-debugsource-2.1.27-150300.4.6.1 cyrus-sasl-scram-2.1.27-150300.4.6.1 cyrus-sasl-scram-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-bdb-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-bdb-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.27-150300.4.6.1 libsasl2-3-2.1.27-150300.4.6.1 libsasl2-3-debuginfo-2.1.27-150300.4.6.1 - openSUSE Leap 15.3 (x86_64): cyrus-sasl-32bit-2.1.27-150300.4.6.1 cyrus-sasl-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-32bit-2.1.27-150300.4.6.1 cyrus-sasl-crammd5-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-devel-32bit-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-32bit-2.1.27-150300.4.6.1 cyrus-sasl-digestmd5-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-32bit-2.1.27-150300.4.6.1 cyrus-sasl-gssapi-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-32bit-2.1.27-150300.4.6.1 cyrus-sasl-ldap-auxprop-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-otp-32bit-2.1.27-150300.4.6.1 cyrus-sasl-otp-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-plain-32bit-2.1.27-150300.4.6.1 cyrus-sasl-plain-32bit-debuginfo-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-32bit-2.1.27-150300.4.6.1 cyrus-sasl-sqlauxprop-32bit-debuginfo-2.1.27-150300.4.6.1 libsasl2-3-32bit-2.1.27-150300.4.6.1 libsasl2-3-32bit-debuginfo-2.1.27-150300.4.6.1 References: https://www.suse.com/security/cve/CVE-2022-24407.html https://bugzilla.suse.com/1194265 https://bugzilla.suse.com/1196036

1 0

openSUSE-SU-2022:0077-1: important: Security update for opera
by opensuse-security＠opensuse.org 07 Mar '22

07 Mar '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0077-1 Rating: important References: Cross-References: CVE-2022-0603 CVE-2022-0604 CVE-2022-0605 CVE-2022-0606 CVE-2022-0607 CVE-2022-0608 CVE-2022-0609 CVE-2022-0610 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to 84.0.4316.21: - CHR-8762 Update chromium on desktop-stable-98-4316 to 98.0.4758.102 - DNA-97333 ��Add a site�� label on start page tile barely visible - DNA-97691 Opera 84 translations - DNA-97767 Wrong string in FR - DNA-97855 Crash at ScopedProfileKeepAlive::~ScopedProfileKeepAlive() - DNA-97982 Enable #snap-upstream-implementation on all streams - The update to chromium 98.0.4758.102 fixes following issues: CVE-2022-0603, CVE-2022-0604, CVE-2022-0605, CVE-2022-0606, CVE-2022-0607, CVE-2022-0608, CVE-2022-0609, CVE-2022-0610 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2022-77=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-84.0.4316.21-lp153.2.39.1 References: https://www.suse.com/security/cve/CVE-2022-0603.html https://www.suse.com/security/cve/CVE-2022-0604.html https://www.suse.com/security/cve/CVE-2022-0605.html https://www.suse.com/security/cve/CVE-2022-0606.html https://www.suse.com/security/cve/CVE-2022-0607.html https://www.suse.com/security/cve/CVE-2022-0608.html https://www.suse.com/security/cve/CVE-2022-0609.html https://www.suse.com/security/cve/CVE-2022-0610.html

1 0

openSUSE-SU-2022:0075-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Mar '22

07 Mar '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0075-1 Rating: important References: #1196641 Cross-References: CVE-2022-0789 CVE-2022-0790 CVE-2022-0791 CVE-2022-0792 CVE-2022-0793 CVE-2022-0794 CVE-2022-0795 CVE-2022-0796 CVE-2022-0797 CVE-2022-0798 CVE-2022-0799 CVE-2022-0800 CVE-2022-0801 CVE-2022-0802 CVE-2022-0803 CVE-2022-0804 CVE-2022-0805 CVE-2022-0806 CVE-2022-0807 CVE-2022-0808 CVE-2022-0809 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 99.0.4844.51 (boo#1196641) * CVE-2022-0789: Heap buffer overflow in ANGLE * CVE-2022-0790: Use after free in Cast UI * CVE-2022-0791: Use after free in Omnibox * CVE-2022-0792: Out of bounds read in ANGLE * CVE-2022-0793: Use after free in Views * CVE-2022-0794: Use after free in WebShare * CVE-2022-0795: Type Confusion in Blink Layout * CVE-2022-0796: Use after free in Media * CVE-2022-0797: Out of bounds memory access in Mojo * CVE-2022-0798: Use after free in MediaStream * CVE-2022-0799: Insufficient policy enforcement in Installer * CVE-2022-0800: Heap buffer overflow in Cast UI * CVE-2022-0801: Inappropriate implementation in HTML parser * CVE-2022-0802: Inappropriate implementation in Full screen mode * CVE-2022-0803: Inappropriate implementation in Permissions * CVE-2022-0804: Inappropriate implementation in Full screen mode * CVE-2022-0805: Use after free in Browser Switcher * CVE-2022-0806: Data leak in Canvas * CVE-2022-0807: Inappropriate implementation in Autofill * CVE-2022-0808: Use after free in Chrome OS Shell * CVE-2022-0809: Out of bounds memory access in WebXR Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-75=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-99.0.4844.51-bp153.2.66.1 chromium-99.0.4844.51-bp153.2.66.1 References: https://www.suse.com/security/cve/CVE-2022-0789.html https://www.suse.com/security/cve/CVE-2022-0790.html https://www.suse.com/security/cve/CVE-2022-0791.html https://www.suse.com/security/cve/CVE-2022-0792.html https://www.suse.com/security/cve/CVE-2022-0793.html https://www.suse.com/security/cve/CVE-2022-0794.html https://www.suse.com/security/cve/CVE-2022-0795.html https://www.suse.com/security/cve/CVE-2022-0796.html https://www.suse.com/security/cve/CVE-2022-0797.html https://www.suse.com/security/cve/CVE-2022-0798.html https://www.suse.com/security/cve/CVE-2022-0799.html https://www.suse.com/security/cve/CVE-2022-0800.html https://www.suse.com/security/cve/CVE-2022-0801.html https://www.suse.com/security/cve/CVE-2022-0802.html https://www.suse.com/security/cve/CVE-2022-0803.html https://www.suse.com/security/cve/CVE-2022-0804.html https://www.suse.com/security/cve/CVE-2022-0805.html https://www.suse.com/security/cve/CVE-2022-0806.html https://www.suse.com/security/cve/CVE-2022-0807.html https://www.suse.com/security/cve/CVE-2022-0808.html https://www.suse.com/security/cve/CVE-2022-0809.html https://bugzilla.suse.com/1196641

1 0

openSUSE-SU-2022:0074-1: moderate: Security update for perl-App-cpanminus
by opensuse-security＠opensuse.org 06 Mar '22

06 Mar '22

openSUSE Security Update: Security update for perl-App-cpanminus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0074-1 Rating: moderate References: Cross-References: CVE-2020-16154 CVSS scores: CVE-2020-16154 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-App-cpanminus fixes the following issues: updated to 1.7045 see /usr/share/doc/packages/perl-App-cpanminus/Changes Security fixes: - [CVE-2020-16154] remove the functionality to verify CHECKSUMS signature updated to 1.7044 see /usr/share/doc/packages/perl-App-cpanminus/Changes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-74=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): perl-App-cpanminus-1.7045-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-16154.html

1 0

openSUSE-SU-2022:0735-1: important: Security update for zsh
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for zsh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0735-1 Rating: important References: #1163882 #1196435 Cross-References: CVE-2019-20044 CVE-2021-45444 CVSS scores: CVE-2019-20044 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-20044 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-45444 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45444 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zsh fixes the following issues: - CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion (bsc#1196435). - CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEGED option (bsc#1163882). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-735=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-735=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): zsh-5.6-7.5.1 zsh-debuginfo-5.6-7.5.1 zsh-debugsource-5.6-7.5.1 zsh-htmldoc-5.6-7.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): zsh-5.6-7.5.1 zsh-debuginfo-5.6-7.5.1 zsh-debugsource-5.6-7.5.1 zsh-htmldoc-5.6-7.5.1 References: https://www.suse.com/security/cve/CVE-2019-20044.html https://www.suse.com/security/cve/CVE-2021-45444.html https://bugzilla.suse.com/1163882 https://bugzilla.suse.com/1196435

1 0

openSUSE-SU-2022:0731-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0731-1 Rating: important References: #1195325 #1195334 #1195339 #1196016 SLE-22245 Cross-References: CVE-2021-46657 CVE-2021-46658 CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVSS scores: CVE-2021-46657 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46657 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46658 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46658 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46659 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46659 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46661 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46665 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46668 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24048 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24050 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24052 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities, contains one feature is now available. Description: This update for mariadb fixes the following issues: - Update to 10.5.15 (bsc#1196016): * 10.5.15: CVE-2021-46665 CVE-2021-46664 CVE-2021-46661 CVE-2021-46668 CVE-2021-46663 * 10.5.14: CVE-2022-24052 CVE-2022-24051 CVE-2022-24050 CVE-2022-24048 CVE-2021-46659, bsc#1195339 - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2021-46658, bsc#1195334 CVE-2021-46657, bsc#1195325 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-731=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.15-150300.3.15.1 libmariadbd19-10.5.15-150300.3.15.1 libmariadbd19-debuginfo-10.5.15-150300.3.15.1 mariadb-10.5.15-150300.3.15.1 mariadb-bench-10.5.15-150300.3.15.1 mariadb-bench-debuginfo-10.5.15-150300.3.15.1 mariadb-client-10.5.15-150300.3.15.1 mariadb-client-debuginfo-10.5.15-150300.3.15.1 mariadb-debuginfo-10.5.15-150300.3.15.1 mariadb-debugsource-10.5.15-150300.3.15.1 mariadb-rpm-macros-10.5.15-150300.3.15.1 mariadb-test-10.5.15-150300.3.15.1 mariadb-test-debuginfo-10.5.15-150300.3.15.1 mariadb-tools-10.5.15-150300.3.15.1 mariadb-tools-debuginfo-10.5.15-150300.3.15.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.15-150300.3.15.1 References: https://www.suse.com/security/cve/CVE-2021-46657.html https://www.suse.com/security/cve/CVE-2021-46658.html https://www.suse.com/security/cve/CVE-2021-46659.html https://www.suse.com/security/cve/CVE-2021-46661.html https://www.suse.com/security/cve/CVE-2021-46663.html https://www.suse.com/security/cve/CVE-2021-46664.html https://www.suse.com/security/cve/CVE-2021-46665.html https://www.suse.com/security/cve/CVE-2021-46668.html https://www.suse.com/security/cve/CVE-2022-24048.html https://www.suse.com/security/cve/CVE-2022-24050.html https://www.suse.com/security/cve/CVE-2022-24051.html https://www.suse.com/security/cve/CVE-2022-24052.html https://bugzilla.suse.com/1195325 https://bugzilla.suse.com/1195334 https://bugzilla.suse.com/1195339 https://bugzilla.suse.com/1196016

1 0

openSUSE-SU-2022:0736-1: important: Security update for vim
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0736-1 Rating: important References: #1190533 #1190570 #1191893 #1192478 #1192481 #1193294 #1193298 #1194216 #1194556 #1195004 #1195066 #1195126 #1195202 #1195356 Cross-References: CVE-2021-3778 CVE-2021-3796 CVE-2021-3872 CVE-2021-3927 CVE-2021-3928 CVE-2021-3984 CVE-2021-4019 CVE-2021-4193 CVE-2021-46059 CVE-2022-0318 CVE-2022-0319 CVE-2022-0351 CVE-2022-0361 CVE-2022-0413 CVSS scores: CVE-2021-3778 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3778 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-3796 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H CVE-2021-3796 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-3872 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3872 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3927 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3927 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3928 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3928 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3984 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3984 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-4019 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-4019 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-4193 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-4193 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-46059 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0318 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0319 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2022-0351 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0351 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-0361 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-0361 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVE-2022-0413 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-0413 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for vim fixes the following issues: - CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004). - CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570). - CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893). - CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481). - CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478). - CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294). - CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298). - CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533). - CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216). - CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556). - CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066). - CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126). - CVE-2022-0361: Fixed buffer overflow (bsc#1195126). - CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-736=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-736=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): gvim-8.0.1568-5.17.1 gvim-debuginfo-8.0.1568-5.17.1 vim-8.0.1568-5.17.1 vim-debuginfo-8.0.1568-5.17.1 vim-debugsource-8.0.1568-5.17.1 vim-small-8.0.1568-5.17.1 vim-small-debuginfo-8.0.1568-5.17.1 - openSUSE Leap 15.4 (noarch): vim-data-8.0.1568-5.17.1 vim-data-common-8.0.1568-5.17.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gvim-8.0.1568-5.17.1 gvim-debuginfo-8.0.1568-5.17.1 vim-8.0.1568-5.17.1 vim-debuginfo-8.0.1568-5.17.1 vim-debugsource-8.0.1568-5.17.1 vim-small-8.0.1568-5.17.1 vim-small-debuginfo-8.0.1568-5.17.1 - openSUSE Leap 15.3 (noarch): vim-data-8.0.1568-5.17.1 vim-data-common-8.0.1568-5.17.1 References: https://www.suse.com/security/cve/CVE-2021-3778.html https://www.suse.com/security/cve/CVE-2021-3796.html https://www.suse.com/security/cve/CVE-2021-3872.html https://www.suse.com/security/cve/CVE-2021-3927.html https://www.suse.com/security/cve/CVE-2021-3928.html https://www.suse.com/security/cve/CVE-2021-3984.html https://www.suse.com/security/cve/CVE-2021-4019.html https://www.suse.com/security/cve/CVE-2021-4193.html https://www.suse.com/security/cve/CVE-2021-46059.html https://www.suse.com/security/cve/CVE-2022-0318.html https://www.suse.com/security/cve/CVE-2022-0319.html https://www.suse.com/security/cve/CVE-2022-0351.html https://www.suse.com/security/cve/CVE-2022-0361.html https://www.suse.com/security/cve/CVE-2022-0413.html https://bugzilla.suse.com/1190533 https://bugzilla.suse.com/1190570 https://bugzilla.suse.com/1191893 https://bugzilla.suse.com/1192478 https://bugzilla.suse.com/1192481 https://bugzilla.suse.com/1193294 https://bugzilla.suse.com/1193298 https://bugzilla.suse.com/1194216 https://bugzilla.suse.com/1194556 https://bugzilla.suse.com/1195004 https://bugzilla.suse.com/1195066 https://bugzilla.suse.com/1195126 https://bugzilla.suse.com/1195202 https://bugzilla.suse.com/1195356

1 0

openSUSE-SU-2022:0713-1: important: Security update for expat
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0713-1 Rating: important References: #1196025 #1196026 #1196168 #1196169 #1196171 Cross-References: CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315 CVSS scores: CVE-2022-25235 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25235 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25236 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25236 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25313 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-25313 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-25314 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25314 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25315 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25315 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for expat fixes the following issues: - CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025). - CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026). - CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168). - CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169). - CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-713=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): expat-2.2.5-3.15.1 expat-debuginfo-2.2.5-3.15.1 expat-debugsource-2.2.5-3.15.1 libexpat-devel-2.2.5-3.15.1 libexpat1-2.2.5-3.15.1 libexpat1-debuginfo-2.2.5-3.15.1 - openSUSE Leap 15.3 (x86_64): expat-32bit-debuginfo-2.2.5-3.15.1 libexpat-devel-32bit-2.2.5-3.15.1 libexpat1-32bit-2.2.5-3.15.1 libexpat1-32bit-debuginfo-2.2.5-3.15.1 References: https://www.suse.com/security/cve/CVE-2022-25235.html https://www.suse.com/security/cve/CVE-2022-25236.html https://www.suse.com/security/cve/CVE-2022-25313.html https://www.suse.com/security/cve/CVE-2022-25314.html https://www.suse.com/security/cve/CVE-2022-25315.html https://bugzilla.suse.com/1196025 https://bugzilla.suse.com/1196026 https://bugzilla.suse.com/1196168 https://bugzilla.suse.com/1196169 https://bugzilla.suse.com/1196171

1 0

openSUSE-SU-2022:0725-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0725-1 Rating: important References: #1195325 #1195334 #1195339 #1196016 Cross-References: CVE-2021-46657 CVE-2021-46658 CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVSS scores: CVE-2021-46657 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46657 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46658 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46658 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46659 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46659 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46661 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46665 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46668 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24048 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24050 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24052 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: - Update to 10.2.43 (bsc#1196016): 10.2.43: CVE-2021-46665 CVE-2021-46664 CVE-2021-46661 CVE-2021-46668 CVE-2021-46663 10.2.42: CVE-2022-24052 CVE-2022-24051 CVE-2022-24050 CVE-2022-24048 CVE-2021-46659, bsc#1195339 - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2021-46658, bsc#1195334 CVE-2021-46657, bsc#1195325 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-725=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libmysqld-devel-10.2.43-3.51.1 libmysqld19-10.2.43-3.51.1 libmysqld19-debuginfo-10.2.43-3.51.1 References: https://www.suse.com/security/cve/CVE-2021-46657.html https://www.suse.com/security/cve/CVE-2021-46658.html https://www.suse.com/security/cve/CVE-2021-46659.html https://www.suse.com/security/cve/CVE-2021-46661.html https://www.suse.com/security/cve/CVE-2021-46663.html https://www.suse.com/security/cve/CVE-2021-46664.html https://www.suse.com/security/cve/CVE-2021-46665.html https://www.suse.com/security/cve/CVE-2021-46668.html https://www.suse.com/security/cve/CVE-2022-24048.html https://www.suse.com/security/cve/CVE-2022-24050.html https://www.suse.com/security/cve/CVE-2022-24051.html https://www.suse.com/security/cve/CVE-2022-24052.html https://bugzilla.suse.com/1195325 https://bugzilla.suse.com/1195334 https://bugzilla.suse.com/1195339 https://bugzilla.suse.com/1196016

1 0

openSUSE-SU-2022:0726-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0726-1 Rating: important References: #1195325 #1195334 #1195339 #1196016 Cross-References: CVE-2021-46657 CVE-2021-46658 CVE-2021-46659 CVE-2021-46661 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052 CVSS scores: CVE-2021-46657 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46657 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46658 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46658 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46659 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46659 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-46661 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46663 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46665 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46668 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24048 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24050 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24051 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24052 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: - Update to 10.4.24 (bsc#1196016): * 10.4.24: CVE-2021-46665 CVE-2021-46664 CVE-2021-46661 CVE-2021-46668 CVE-2021-46663 * 10.4.23: CVE-2022-24052 CVE-2022-24051 CVE-2022-24050 CVE-2022-24048 CVE-2021-46659, bsc#1195339 - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2021-46658, bsc#1195334 CVE-2021-46657, bsc#1195325 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-726=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.4.24-3.25.1 References: https://www.suse.com/security/cve/CVE-2021-46657.html https://www.suse.com/security/cve/CVE-2021-46658.html https://www.suse.com/security/cve/CVE-2021-46659.html https://www.suse.com/security/cve/CVE-2021-46661.html https://www.suse.com/security/cve/CVE-2021-46663.html https://www.suse.com/security/cve/CVE-2021-46664.html https://www.suse.com/security/cve/CVE-2021-46665.html https://www.suse.com/security/cve/CVE-2021-46668.html https://www.suse.com/security/cve/CVE-2022-24048.html https://www.suse.com/security/cve/CVE-2022-24050.html https://www.suse.com/security/cve/CVE-2022-24051.html https://www.suse.com/security/cve/CVE-2022-24052.html https://bugzilla.suse.com/1195325 https://bugzilla.suse.com/1195334 https://bugzilla.suse.com/1195339 https://bugzilla.suse.com/1196016

1 0

openSUSE-SU-2022:0717-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0717-1 Rating: moderate References: #1196167 Cross-References: CVE-2021-4209 CVSS scores: CVE-2021-4209 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gnutls fixes the following issues: - CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-717=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gnutls-3.6.7-14.16.1 gnutls-debuginfo-3.6.7-14.16.1 gnutls-debugsource-3.6.7-14.16.1 gnutls-guile-3.6.7-14.16.1 gnutls-guile-debuginfo-3.6.7-14.16.1 libgnutls-devel-3.6.7-14.16.1 libgnutls30-3.6.7-14.16.1 libgnutls30-debuginfo-3.6.7-14.16.1 libgnutls30-hmac-3.6.7-14.16.1 libgnutlsxx-devel-3.6.7-14.16.1 libgnutlsxx28-3.6.7-14.16.1 libgnutlsxx28-debuginfo-3.6.7-14.16.1 - openSUSE Leap 15.3 (x86_64): libgnutls-devel-32bit-3.6.7-14.16.1 libgnutls30-32bit-3.6.7-14.16.1 libgnutls30-32bit-debuginfo-3.6.7-14.16.1 libgnutls30-hmac-32bit-3.6.7-14.16.1 References: https://www.suse.com/security/cve/CVE-2021-4209.html https://bugzilla.suse.com/1196167

1 0

openSUSE-SU-2022:0727-1: moderate: Security update for libeconf, shadow and util-linux
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for libeconf, shadow and util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0727-1 Rating: moderate References: #1188507 #1192954 #1193632 #1194976 SLE-23384 SLE-23402 Cross-References: CVE-2021-3995 CVE-2021-3996 CVSS scores: CVE-2021-3995 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3996 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities, contains two features and has two fixes is now available. Description: This security update for libeconf, shadow and util-linux fix the following issues: libeconf: - Add libeconf to SLE-Module-Basesystem_15-SP3 because needed by 'util-linux' and 'shadow' to fix autoyast handling of security related parameters (bsc#1192954, jsc#SLE-23384, jsc#SLE-23402) Issues fixed in libeconf: - Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157) - Fixed different issues while writing string values to file. - Writing comments to file too. - Fixed crash while merging values. - Added econftool cat option (#146) - new API call: econf_readDirsHistory (showing ALL locations) - new API call: econf_getPath (absolute path of the configuration file) - Man pages libeconf.3 and econftool.8. - Handling multiline strings. - Added libeconf_ext which returns more information like line_nr, comments, path of the configuration file,... - Econftool, an command line interface for handling configuration files. - Generating HTML API documentation with doxygen. - Improving error handling and semantic file check. - Joining entries with the same key to one single entry if env variable ECONF_JOIN_SAME_ENTRIES has been set. shadow: - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954, jsc#SLE-23384, jsc#SLE-23402) util-linux: - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954, jsc#SLE-23384, jsc#SLE-23402) - Allow use of larger values for start sector to prevent `blockdev --report` aborting (bsc#1188507) - Fixed `blockdev --report` using non-space characters as a field separator (bsc#1188507) - CVE-2021-3995: Fixed unauthorized unmount in util-linux's libmount. (bsc#1194976) - CVE-2021-3996: Fixed unauthorized unmount in util-linux's libmount. (bsc#1194976) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-727=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libblkid-devel-2.36.2-150300.4.14.3 libblkid-devel-static-2.36.2-150300.4.14.3 libblkid1-2.36.2-150300.4.14.3 libblkid1-debuginfo-2.36.2-150300.4.14.3 libeconf-debugsource-0.4.4+git20220104.962774f-150300.3.6.2 libeconf-devel-0.4.4+git20220104.962774f-150300.3.6.2 libeconf0-0.4.4+git20220104.962774f-150300.3.6.2 libeconf0-debuginfo-0.4.4+git20220104.962774f-150300.3.6.2 libfdisk-devel-2.36.2-150300.4.14.3 libfdisk-devel-static-2.36.2-150300.4.14.3 libfdisk1-2.36.2-150300.4.14.3 libfdisk1-debuginfo-2.36.2-150300.4.14.3 libmount-devel-2.36.2-150300.4.14.3 libmount-devel-static-2.36.2-150300.4.14.3 libmount1-2.36.2-150300.4.14.3 libmount1-debuginfo-2.36.2-150300.4.14.3 libsmartcols-devel-2.36.2-150300.4.14.3 libsmartcols-devel-static-2.36.2-150300.4.14.3 libsmartcols1-2.36.2-150300.4.14.3 libsmartcols1-debuginfo-2.36.2-150300.4.14.3 libuuid-devel-2.36.2-150300.4.14.3 libuuid-devel-static-2.36.2-150300.4.14.3 libuuid1-2.36.2-150300.4.14.3 libuuid1-debuginfo-2.36.2-150300.4.14.3 python3-libmount-2.36.2-150300.4.14.2 python3-libmount-debuginfo-2.36.2-150300.4.14.2 python3-libmount-debugsource-2.36.2-150300.4.14.2 shadow-4.8.1-150300.4.3.8 shadow-debuginfo-4.8.1-150300.4.3.8 shadow-debugsource-4.8.1-150300.4.3.8 util-linux-2.36.2-150300.4.14.3 util-linux-debuginfo-2.36.2-150300.4.14.3 util-linux-debugsource-2.36.2-150300.4.14.3 util-linux-systemd-2.36.2-150300.4.14.2 util-linux-systemd-debuginfo-2.36.2-150300.4.14.2 util-linux-systemd-debugsource-2.36.2-150300.4.14.2 uuidd-2.36.2-150300.4.14.2 uuidd-debuginfo-2.36.2-150300.4.14.2 - openSUSE Leap 15.3 (x86_64): libblkid-devel-32bit-2.36.2-150300.4.14.3 libblkid1-32bit-2.36.2-150300.4.14.3 libblkid1-32bit-debuginfo-2.36.2-150300.4.14.3 libeconf0-32bit-0.4.4+git20220104.962774f-150300.3.6.2 libeconf0-32bit-debuginfo-0.4.4+git20220104.962774f-150300.3.6.2 libfdisk-devel-32bit-2.36.2-150300.4.14.3 libfdisk1-32bit-2.36.2-150300.4.14.3 libfdisk1-32bit-debuginfo-2.36.2-150300.4.14.3 libmount-devel-32bit-2.36.2-150300.4.14.3 libmount1-32bit-2.36.2-150300.4.14.3 libmount1-32bit-debuginfo-2.36.2-150300.4.14.3 libsmartcols-devel-32bit-2.36.2-150300.4.14.3 libsmartcols1-32bit-2.36.2-150300.4.14.3 libsmartcols1-32bit-debuginfo-2.36.2-150300.4.14.3 libuuid-devel-32bit-2.36.2-150300.4.14.3 libuuid1-32bit-2.36.2-150300.4.14.3 libuuid1-32bit-debuginfo-2.36.2-150300.4.14.3 - openSUSE Leap 15.3 (noarch): login_defs-4.8.1-150300.4.3.8 util-linux-lang-2.36.2-150300.4.14.3 References: https://www.suse.com/security/cve/CVE-2021-3995.html https://www.suse.com/security/cve/CVE-2021-3996.html https://bugzilla.suse.com/1188507 https://bugzilla.suse.com/1192954 https://bugzilla.suse.com/1193632 https://bugzilla.suse.com/1194976

1 0

openSUSE-SU-2022:0716-1: important: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0716-1 Rating: important References: #1194732 #1194733 Cross-References: CVE-2022-23303 CVE-2022-23304 CVSS scores: CVE-2022-23303 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23303 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23304 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23304 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wpa_supplicant fixes the following issues: - CVE-2022-23303: Fixed side-channel attacks in SAE (bsc#1194732). - CVE-2022-23304: Fixed side-channel attacks in EAP-pwd (bsc#1194733). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-716=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-716=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): wpa_supplicant-2.9-4.33.1 wpa_supplicant-debuginfo-2.9-4.33.1 wpa_supplicant-debugsource-2.9-4.33.1 wpa_supplicant-gui-2.9-4.33.1 wpa_supplicant-gui-debuginfo-2.9-4.33.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): wpa_supplicant-2.9-4.33.1 wpa_supplicant-debuginfo-2.9-4.33.1 wpa_supplicant-debugsource-2.9-4.33.1 wpa_supplicant-gui-2.9-4.33.1 wpa_supplicant-gui-debuginfo-2.9-4.33.1 References: https://www.suse.com/security/cve/CVE-2022-23303.html https://www.suse.com/security/cve/CVE-2022-23304.html https://bugzilla.suse.com/1194732 https://bugzilla.suse.com/1194733

1 0

openSUSE-SU-2022:0712-1: important: Security update for flatpak
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0712-1 Rating: important References: #1194610 #1194611 Cross-References: CVE-2021-43860 CVE-2022-21682 CVSS scores: CVE-2021-43860 (NVD) : 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2022-21682 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2022-21682 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for flatpak fixes the following issues: Update to flatpak 1.10.7: - CVE-2022-21682: Introduce new option --nofilesystem=host:reset to support flatpak-builder 1.2.2 (bsc#1194611). - CVE-2021-43860: A malicious repository could hav sent invalid application metadata in a way that hides some of the app permissions displayed during installation (bsc#1194610). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-712=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): flatpak-1.10.7-4.12.1 flatpak-debuginfo-1.10.7-4.12.1 flatpak-debugsource-1.10.7-4.12.1 flatpak-devel-1.10.7-4.12.1 flatpak-zsh-completion-1.10.7-4.12.1 libflatpak0-1.10.7-4.12.1 libflatpak0-debuginfo-1.10.7-4.12.1 system-user-flatpak-1.10.7-4.12.1 typelib-1_0-Flatpak-1_0-1.10.7-4.12.1 References: https://www.suse.com/security/cve/CVE-2021-43860.html https://www.suse.com/security/cve/CVE-2022-21682.html https://bugzilla.suse.com/1194610 https://bugzilla.suse.com/1194611

1 0

openSUSE-SU-2022:0720-1: moderate: Security update for containerd
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for containerd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0720-1 Rating: moderate References: #1196441 Cross-References: CVE-2022-23648 CVSS scores: CVE-2022-23648 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for containerd fixes the following issues: - CVE-2022-23648: A specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host (bsc#1196441). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-720=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-720=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): containerd-1.4.12-63.1 containerd-ctr-1.4.12-63.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): containerd-1.4.12-63.1 containerd-ctr-1.4.12-63.1 References: https://www.suse.com/security/cve/CVE-2022-23648.html https://bugzilla.suse.com/1196441

1 0

openSUSE-SU-2022:0724-1: important: Security update for go1.16
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0724-1 Rating: important References: #1182345 #1195834 #1195835 #1195838 Cross-References: CVE-2022-23772 CVE-2022-23773 CVE-2022-23806 CVSS scores: CVE-2022-23772 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23772 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23773 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-23773 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N CVE-2022-23806 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-23806 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.16 fixes the following issues: - CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic IsOnCurve (bsc#1195838). - CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption (bsc#1195835). - CVE-2022-23773: Fixed incorrect access control in cmd/go (bsc#1195834). The following non-security bugs were fixed: - go#50977 crypto/elliptic: IsOnCurve returns true for invalid field elements - go#50700 math/big: Rat.SetString may consume large amount of RAM and crash - go#50686 cmd/go: do not treat branches with semantic-version names as releases - go#50866 cmd/compile: incorrect use of CMN on arm64 - go#50832 runtime/race: NoRaceMutexPureHappensBefore failures - go#50811 cmd/go: remove bitbucket VCS probing - go#50780 runtime: incorrect frame information in traceback traversal may hang the process. - go#50721 debug/pe: reading debug_info section of PE files that use the DWARF5 form DW_FORM_line_strp causes error - go#50682 cmd/compile: MOVWreg missing sign-extension following a Copy from a floating-point LoadReg - go#50645 testing: surprising interaction of subtests with TempDir - go#50585 net/http/httptest: add fipsonly compliant certificate in for NewTLSServer(), for dev.boringcrypto branch - go#50245 runtime: intermittent os/exec.Command.Start() Hang on Darwin in Presence of "plugin" Package Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-724=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-724=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.16-1.16.14-1.43.1 go1.16-doc-1.16.14-1.43.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.16-race-1.16.14-1.43.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.14-1.43.1 go1.16-doc-1.16.14-1.43.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.14-1.43.1 References: https://www.suse.com/security/cve/CVE-2022-23772.html https://www.suse.com/security/cve/CVE-2022-23773.html https://www.suse.com/security/cve/CVE-2022-23806.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1195834 https://bugzilla.suse.com/1195835 https://bugzilla.suse.com/1195838

1 0

openSUSE-SU-2022:0723-1: important: Security update for go1.17
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0723-1 Rating: important References: #1190649 #1195834 #1195835 #1195838 Cross-References: CVE-2022-23772 CVE-2022-23773 CVE-2022-23806 CVSS scores: CVE-2022-23772 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23772 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23773 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-23773 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N CVE-2022-23806 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-23806 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: - CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic IsOnCurve (bsc#1195838). - CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption (bsc#1195835). - CVE-2022-23773: Fixed incorrect access control in cmd/go (bsc#1195834). The following non-security bugs were fixed: - go#50978 crypto/elliptic: IsOnCurve returns true for invalid field elements - go#50701 math/big: Rat.SetString may consume large amount of RAM and crash - go#50687 cmd/go: do not treat branches with semantic-version names as releases - go#50942 cmd/asm: "compile: loop" compiler bug? - go#50867 cmd/compile: incorrect use of CMN on arm64 - go#50812 cmd/go: remove bitbucket VCS probing - go#50781 runtime: incorrect frame information in traceback traversal may hang the process. - go#50722 debug/pe: reading debug_info section of PE files that use the DWARF5 form DW_FORM_line_strp causes error - go#50683 cmd/compile: MOVWreg missing sign-extension following a Copy from a floating-point LoadReg - go#50586 net/http/httptest: add fipsonly compliant certificate in for NewTLSServer(), for dev.boringcrypto branch - go#50297 cmd/link: does not set section type of .init_array correctly - go#50246 runtime: intermittent os/exec.Command.Start() Hang on Darwin in Presence of "plugin" Package Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-723=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-723=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.17-1.17.7-1.20.1 go1.17-doc-1.17.7-1.20.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.17-race-1.17.7-1.20.1 - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.7-1.20.1 go1.17-doc-1.17.7-1.20.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.7-1.20.1 References: https://www.suse.com/security/cve/CVE-2022-23772.html https://www.suse.com/security/cve/CVE-2022-23773.html https://www.suse.com/security/cve/CVE-2022-23806.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1195834 https://bugzilla.suse.com/1195835 https://bugzilla.suse.com/1195838

1 0

openSUSE-SU-2022:0715-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0715-1 Rating: important References: #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-715=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-715=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs14-14.19.0-15.27.1 nodejs14-debuginfo-14.19.0-15.27.1 nodejs14-debugsource-14.19.0-15.27.1 nodejs14-devel-14.19.0-15.27.1 npm14-14.19.0-15.27.1 - openSUSE Leap 15.4 (noarch): nodejs14-docs-14.19.0-15.27.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.19.0-15.27.1 nodejs14-debuginfo-14.19.0-15.27.1 nodejs14-debugsource-14.19.0-15.27.1 nodejs14-devel-14.19.0-15.27.1 npm14-14.19.0-15.27.1 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.19.0-15.27.1 References: https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696

1 0

openSUSE-SU-2022:0722-1: important: Security update for wireshark
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0722-1 Rating: important References: #1195866 #1195867 #1195868 #1195869 #1195870 Cross-References: CVE-2022-0581 CVE-2022-0582 CVE-2022-0583 CVE-2022-0585 CVE-2022-0586 CVSS scores: CVE-2022-0581 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0581 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0582 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-0582 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0583 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0583 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0585 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0585 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0586 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0586 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Update to Wireshark 3.6.2: - CVE-2022-0586: RTMPT dissector infinite loop (bsc#1195866) - CVE-2022-0585: Large loops in multiple dissectors (bsc#1195867) - CVE-2022-0583: PVFS dissector crash (bsc#1195868) - CVE-2022-0582: CSN.1 dissector crash (bsc#1195869) - CVE-2022-0581: CMS dissector crash (bsc#1195870) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-722=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-722=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.2-3.71.1 libwireshark15-debuginfo-3.6.2-3.71.1 libwiretap12-3.6.2-3.71.1 libwiretap12-debuginfo-3.6.2-3.71.1 libwsutil13-3.6.2-3.71.1 libwsutil13-debuginfo-3.6.2-3.71.1 wireshark-3.6.2-3.71.1 wireshark-debuginfo-3.6.2-3.71.1 wireshark-debugsource-3.6.2-3.71.1 wireshark-devel-3.6.2-3.71.1 wireshark-ui-qt-3.6.2-3.71.1 wireshark-ui-qt-debuginfo-3.6.2-3.71.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.2-3.71.1 libwireshark15-debuginfo-3.6.2-3.71.1 libwiretap12-3.6.2-3.71.1 libwiretap12-debuginfo-3.6.2-3.71.1 libwsutil13-3.6.2-3.71.1 libwsutil13-debuginfo-3.6.2-3.71.1 wireshark-3.6.2-3.71.1 wireshark-debuginfo-3.6.2-3.71.1 wireshark-debugsource-3.6.2-3.71.1 wireshark-devel-3.6.2-3.71.1 wireshark-ui-qt-3.6.2-3.71.1 wireshark-ui-qt-debuginfo-3.6.2-3.71.1 References: https://www.suse.com/security/cve/CVE-2022-0581.html https://www.suse.com/security/cve/CVE-2022-0582.html https://www.suse.com/security/cve/CVE-2022-0583.html https://www.suse.com/security/cve/CVE-2022-0585.html https://www.suse.com/security/cve/CVE-2022-0586.html https://bugzilla.suse.com/1195866 https://bugzilla.suse.com/1195867 https://bugzilla.suse.com/1195868 https://bugzilla.suse.com/1195869 https://bugzilla.suse.com/1195870

1 0

openSUSE-SU-2022:23018-1: moderate: Security update for conmon, libcontainers-common, libseccomp, podman
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for conmon, libcontainers-common, libseccomp, podman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:23018-1 Rating: moderate References: #1176804 #1177598 #1181640 #1182998 #1188520 #1188914 #1193166 #1193273 SLE-22714 Cross-References: CVE-2020-14370 CVE-2020-15157 CVE-2021-20199 CVE-2021-20291 CVE-2021-3602 CVE-2021-4024 CVE-2021-41190 CVSS scores: CVE-2020-14370 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2020-15157 (NVD) : 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2020-15157 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-20199 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-20199 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-20291 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-20291 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3602 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-4024 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-4024 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-41190 (NVD) : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N CVE-2021-41190 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities, contains one feature and has one errata is now available. Description: This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues: podman was updated to 3.4.4. Security issues fixed: - fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion - fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs - fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost - Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2 Update to version 3.4.4: * Bugfixes - Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535). - Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523). - Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521). - Update to version 3.4.3: * Security - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777. - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients. * Features - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287). * Bugfixes - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065). - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933). - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438). - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189). - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263). - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642). - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248). - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329). - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532). - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086). - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400). - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402). - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452). - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457). - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416). * API - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services. - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842). - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315). - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419). - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420). - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378). - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392). - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409). - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453). - Update to version 3.4.2: * Fixed a bug where podman tag could not tag manifest lists (#12046). * Fixed a bug where built-in volumes specified by images would not be created correctly under some circumstances. * Fixed a bug where, when using Podman Machine on OS X, containers in pods did not have working port forwarding from the host (#12207). * Fixed a bug where the podman network reload command command on containers using the slirp4netns network mode and the rootlessport port forwarding driver would make an unnecessary attempt to restart rootlessport on containers that did not forward ports. * Fixed a bug where the podman generate kube command would generate YAML including some unnecessary (set to default) fields (e.g. empty SELinux and DNS configuration blocks, and the privileged flag when set to false) (#11995). * Fixed a bug where the podman pod rm command could, if interrupted at the right moment, leave a reference to an already-removed infra container behind (#12034). * Fixed a bug where the podman pod rm command would not remove pods with more than one container if all containers save for the infra container were stopped unless --force was specified (#11713). * Fixed a bug where the --memory flag to podman run and podman create did not accept a limit of 0 (which should specify unlimited memory) (#12002). * Fixed a bug where the remote Podman client's podman build command could attempt to build a Dockerfile in the working directory of the podman system service instance instead of the Dockerfile specified by the user (#12054). * Fixed a bug where the podman logs --tail command could function improperly (printing more output than requested) when the journald log driver was used. * Fixed a bug where containers run using the slirp4netns network mode with IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062). * Fixed a bug where some Podman commands could cause an extra dbus-daemon process to be created (#9727). * Fixed a bug where rootless Podman would sometimes print warnings about a failure to move the pause process into a given CGroup (#12065). * Fixed a bug where the checkpointed field in podman inspect on a container was not set to false after a container was restored. * Fixed a bug where the podman system service command would print overly-verbose logs about request IDs (#12181). * Fixed a bug where Podman could, when creating a new container without a name explicitly specified by the user, sometimes use an auto-generated name already in use by another container if multiple containers were being created in parallel (#11735). Update to version 3.4.1: * Bugfixes - Fixed a bug where podman machine init could, under some circumstances, create invalid machine configurations which could not be started (#11824). - Fixed a bug where the podman machine list command would not properly populate some output fields. - Fixed a bug where podman machine rm could leave dangling sockets from the removed machine (#11393). - Fixed a bug where podman run --pids-limit=-1 was not supported (it now sets the PID limit in the container to unlimited) (#11782). - Fixed a bug where podman run and podman attach could throw errors about a closed network connection when STDIN was closed by the client (#11856). - Fixed a bug where the podman stop command could fail when run on a container that had another podman stop command run on it previously. - Fixed a bug where the --sync flag to podman ps was nonfunctional. - Fixed a bug where the Windows and OS X remote clients' podman stats command would fail (#11909). - Fixed a bug where the podman play kube command did not properly handle environment variables whose values contained an = (#11891). - Fixed a bug where the podman generate kube command could generate invalid annotations when run on containers with volumes that use SELinux relabelling (:z or :Z) (#11929). - Fixed a bug where the podman generate kube command would generate YAML including some unnecessary (set to default) fields (e.g. user and group, entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965). - Fixed a bug where the podman generate kube command could, under some circumstances, generate YAML including an invalid targetPort field for forwarded ports (#11930). - Fixed a bug where rootless Podman's podman info command could, under some circumstances, not read available CGroup controllers (#11931). - Fixed a bug where podman container checkpoint --export would fail to checkpoint any container created with --log-driver=none (#11974). * API - Fixed a bug where the Compat Create endpoint for Containers could panic when no options were passed to a bind mount of tmpfs (#11961). Update to version 3.4.0: * Features - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option. - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created. - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container. - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML. - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command. - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time. - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file). - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again. - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option. - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp. - The podman image scp command has been added. This command allows images to be transferred between different hosts. - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed. - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified). - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation. - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited. - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265). - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use. - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf. - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine. - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527). * Changes - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so. - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages. - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file. - Podman no longer depends on ip for removing networks (#11403). - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release. - The podman machine start command now prints a message when the VM is successfully started. - The podman stats command can now be used on containers that are paused. - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run). - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam. - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry. * Bugfixes - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly. - Fixed a bug where the Windows remote client improperly validated volume paths (#10900). - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped. - Fixed a bug where images created by podman commit did not include ports exposed by the container. - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171). - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352). - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443). - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container. - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path. - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387). - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344). - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418). - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411). - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421). - Fixed a bug where the podman info command could segfault when accessing cgroup information. - Fixed a bug where the podman logs -f command could hang when a container exited (#11461). - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438). - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474). - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732). - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified. - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392). - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf. - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785). - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496). - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469). - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444). - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540). - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically. - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod. - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag. - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596). - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557). - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output. - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687). - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633). - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML. - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672). - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207). - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731). - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740). - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750). * API - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612). - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients. - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623). - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225). - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831). - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered. - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails. - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227). - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235). - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages. - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053). Update to version 3.3.1: * Bugfixes - Fixed a bug where unit files created by podman generate systemd could not cleanup shut down containers when stopped by systemctl stop (#11304). - Fixed a bug where podman machine commands would not properly locate the gvproxy binary in some circumstances. - Fixed a bug where containers created as part of a pod using the --pod-id-file option would not join the pod's network namespace (#11303). - Fixed a bug where Podman, when using the systemd cgroups driver, could sometimes leak dbus sessions. - Fixed a bug where the until filter to podman logs and podman events was improperly handled, requiring input to be negated (#11158). - Fixed a bug where rootless containers using CNI networking run on systems using systemd-resolved for DNS would fail to start if resolved symlinked /etc/resolv.conf to an absolute path (#11358). * API - A large number of potential file descriptor leaks from improperly closing client connections have been fixed. Update to version 3.3.0: * Fix network aliases with network id * machine: compute sha256 as we read the image file * machine: check for file exists instead of listing directory * pkg/bindings/images.nTar(): slashify hdr.Name values * Volumes: Only remove from DB if plugin removal succeeds * For compatibility, ignore Content-Type * [v3.3] Bump c/image 5.15.2, buildah v1.22.3 * Implement SD-NOTIFY proxy in conmon * Fix rootless cni dns without systemd stub resolver * fix rootlessport flake * Skip stats test in CGv1 container environments * Fix AVC denials in tests of volume mounts * Restore buildah-bud test requiring new images * Revert ".cirrus.yml: use fresh images for all VMs" * Fix device tests using ls test files * Enhance priv. dev. check * Workaround host availability of /dev/kvm * Skip cgroup-parent test due to frequent flakes * Cirrus: Fix not uploading logformatter html Switch to crun (bsc#1188914) Update to version 3.2.3: * Bump to v3.2.3 * Update release notes for v3.2.3 * vendor containers/common(a)v0.38.16 * vendor containers/buildah(a)v1.21.3 * Fix race conditions in rootless cni setup * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf * Make rootless-cni setup more robust * Support uid,gid,mode options for secrets * vendor containers/common(a)v0.38.15 * [CI:DOCS] podman search: clarify that results depend on implementation * vendor containers/common(a)v0.38.14 * vendor containers/common(a)v0.38.13 * [3.2] vendor containers/common(a)v0.38.12 * Bump README to v3.2.2 * Bump to v3.2.3-dev - Update to version 3.2.2: * Bump to v3.2.2 * fix systemcontext to use correct TMPDIR * Scrub podman commands to use report package * Fix volumes with uid and gid options * Vendor in c/common v0.38.11 * Initial release notes for v3.2.2 * Fix restoring of privileged containers * Fix handling of podman-remote build --device * Add support for podman remote build -f - . * Fix panic condition in cgroups.getAvailableControllers * Fix permissions on initially created named volumes * Fix building static podman-remote * add correct slirp ip to /etc/hosts * disable tty-size exec checks in system tests * Fix resize race with podman exec -it * Fix documentation of the --format option of podman push * Fix systemd-resolved detection. * Health Check is not handled in the compat LibpodToContainerJSON * Do not use inotify for OCICNI * getContainerNetworkInfo: lock netNsCtr before sync * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership * Create the /etc/mtab file if does not exists * [v3.2] cp: do not allow dir->file copying * create: support images with invalid platform * vendor containers/common(a)v0.38.10 * logs: k8s-file: restore poll sleep * logs: k8s-file: fix spurious error logs * utils: move message from warning to debug * Bump to v3.2.2-dev - Update to version 3.2.1: * Bump to v3.2.1 * Updated release notes for v3.2.1 * Fix network connect race with docker-compose * Revert "Ensure minimum API version is set correctly in tests" * Fall back to string for dockerfile parameter * remote events: fix --stream=false * [CI:DOCS] fix incorrect network remove api doc * remote: always send resize before the container starts * remote events: support labels * remote pull: cancel pull when connection is closed * Fix network prune api docs * Improve systemd-resolved detection * logs: k8s-file: fix race * Fix image prune --filter cmd behavior * Several shell completion fixes * podman-remote build should handle -f option properly * System tests: deal with crun 0.20.1 * Fix build tags for pkg/machine... * Fix pre-checkpointing * container: ignore named hierarchies * [v3.2] vendor containers/common(a)v0.38.9 * rootless: fix fast join userns path * [v3.2] vendor containers/common(a)v0.38.7 * [v3.2] vendor containers/common(a)v0.38.6 * Correct qemu options for Intel macs * Ensure minimum API version is set correctly in tests * Bump to v3.2.1-dev - Update to version 3.2.0: * Bump to v3.2.0 * Fix network create macvlan with subnet option * Final release notes updates for v3.2.0 * add ipv6 nameservers only when the container has ipv6 enabled * Use request context instead of background * [v.3.2] events: support disjunctive filters * System tests: add :Z to volume mounts * generate systemd: make mounts portable * vendor containers/storage(a)v1.31.3 * vendor containers/common(a)v0.38.5 * Bump to v3.2.0-dev * Bump to v3.2.0-RC3 * Update release notes for v3.2.0-RC3 * Fix race on podman start --all * Fix race condition in running ls container in a pod * docs: --cert-dir: point to containers-certs.d(5) * Handle hard links in different directories * Improve OCI Runtime error * Handle hard links in remote builds * Podman info add support for status of cgroup controllers * Drop container does not exist on removal to debugf * Downgrade API service routing table logging * add libimage events * docs: generate systemd: XDG_RUNTIME_DIR * Fix problem copying files when container is in host pid namespace * Bump to v3.2.0-dev * Bump to v3.2.0-RC2 * update c/common * Update Cirrus DEST_BRANCH to v3.2 * Updated vendors of c/image, c/storage, Buildah * Initial release notes for v3.2.0-RC2 * Add script for identifying commits in release branches * Add host.containers.internal entry into container's etc/hosts * image prune: remove unused images only with `--all` * podman network reload add rootless support * Use more recent `stale` release... * network tutorial: update with rootless cni changes * [CI:DOCS] Update first line in intro page * Use updated VM images + updated automation tooling * auto-update service: prune images * make vendor * fix system upgrade tests * Print "extracting" only on compressed file * podman image tree: restore previous behavior * fix network restart always test * fix incorrect log driver in podman container image * Add support for cli network prune --filter flag * Move filter parsing to common utils * Bump github.com/containers/storage from 1.30.2 to 1.30.3 * Update nix pin with `make nixpkgs` * [CI:DOCS] hack/bats - new helper for running system tests * fix restart always with slirp4netns * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94 * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2 * Add host.serviceIsRemote to podman info results * Add client disconnect to build handler loop * Remove obsolete skips * Fix podman-remote build --rm=false ... * fix: improved "containers/{name}/wait" endpoint * Bump github.com/containers/storage from 1.30.1 to 1.30.2 * Add envars to the generated systemd unit * fix: use UTC Time Stamps in response JSON * fix container startup for empty pidfile * Kube like pods should share ipc,net,uts by default * fix: compat API "images/get" for multiple images * Revert escaped double dash man page flag syntax * Report Download complete in Compatibility mode * Add documentation on short-names * Bump github.com/docker/docker * Adds support to preserve auto update labels in generate and play kube * [CI:DOCS] Stop conversion of `--` into en dash * Revert Patch to relabel if selinux not enabled * fix per review request * Add support for environment variable secrets * fix pre review request * Fix infinite loop in isPathOnVolume * Add containers.conf information for changing defaults * CI: run rootless tests under ubuntu * Fix wrong macvlan PNG in networking doc. * Add restart-policy to container filters & --filter to podman start * Fixes docker-compose cannot set static ip when use ipam * channel: simplify implementation * build: improve regex for iidfile * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0 * cgroup: fix rootless --cgroup-parent with pods * fix: docker APIv2 `images/get` * codespell cleanup * Minor podmanimage docs updates. * Fix handling of runlabel IMAGE and NAME * Bump to v3.2.0-dev * Bump to v3.2.0-rc1 * rootless: improve automatic range split * podman: set volatile storage flag for --rm containers * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2 * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0 * migrate Podman to containers/common/libimage * Add filepath glob support to --security-opt unmask * Force log_driver to k8s-file for containers in containers * add --mac-address to podman play kube * compat api: Networks must be empty instead of null * System tests: honor $OCI_RUNTIME (for CI) * is this a bug? * system test image: add arm64v8 image * Fix troubleshooting documentation on handling sublemental groups. * Add --all to podman start * Fix variable reference typo. in multi-arch image action * cgroup: always honor --cgroup-parent with cgroupfs * Bump github.com/uber/jaeger-client-go * Don't require tests for github-actions & metadata * Detect if in podman machine virtual vm * Fix multi-arch image workflow typo * [CI:DOCS] Add titles to remote docs (windows) * Remove unused VolumeList* structs * Cirrus: Update F34beta -> F34 * Update container image docs + fix unstable execution * Bump github.com/containers/storage from 1.30.0 to 1.30.1 * TODO complete * Docker returns 'die' status rather then 'died' status * Check if another VM is running on machine start * [CI:DOCS] Improve titles of command HTML pages * system tests: networking: fix another race condition * Use seccomp_profile as default profile if defined in containers.conf * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11 * Vendored * Autoupdate local label functional * System tests: fix two race conditions * Add more documentation on conmon * Allow docker volume create API to pass without name * Cirrus: Update Ubuntu images to 21.04 * Skip blkio-weight test when no kernel BFQ support * rootless: Tell the user what was led to the error, not just what it is * Add troubleshooting advice about the --userns option. * Fix images prune filter until * Fix logic for pushing stable multi-arch images * Fixes generate kube incorrect when bind-mounting "/" and "/root" * libpod/image: unit tests: don't use system's registries.conf.d * runtime: create userns when CAP_SYS_ADMIN is not present * rootless: attempt to copy current mappings first * [CI:DOCS] Restore missing content to manpages * [CI:DOCS] Fix Markdown layout bugs * Fix podman ps --filter ancestor to match exact ImageName/ImageID * Add machine-enabled to containers.conf for machine * Several multi-arch image build/push fixes * Add podman run --timeout option * Parse slirp4netns net options with compat api * Fix rootlesskit port forwarder with custom slirp cidr * Fix removal race condition in ListContainers * Add github-action workflow to build/push multi-arch * rootless: if root is not sub?id raise a debug message * Bump github.com/containers/common from 0.36.0 to 0.37.0 * Add go template shell completion for --format * Add --group-add keep-groups: suplimentary groups into container * Fixes from make codespell * Typo fix to usage text of --compress option * corrupt-image test: fix an oops * Add --noheading flag to all list commands * Bump github.com/containers/storage from 1.29.0 to 1.30.0 * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1 * [CI:DOCS] Fix Markdown table layout bugs * podman-remote should show podman.sock info * rmi: don't break when the image is missing a manifest * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md * Add support for CDI device configuration * [CI:DOCS] Add missing dash to verbose option * Bump github.com/uber/jaeger-client-go * Remove an advanced layer diff function * Ensure mount destination is clean, no trailing slash * add it for inspect pidfile * [CI:DOCS] Fix introduction page typo * support pidfile on container restore * fix start it * skip pidfile test on remote * improve document * set pidfile default value int containerconfig * add pidfile in inspection * add pidfile it for container start * skip pidfile it on remote * Modify according to comments * WIP: drop test requirement * runtime: bump required conmon version * runtime: return findConmon to libpod * oci: drop ExecContainerCleanup * oci: use `--full-path` option for conmon * use AttachSocketPath when removing conmon files * hide conmon-pidfile flag on remote mode * Fix possible panic in libpod/image/prune.go * add --ip to podman play kube * add flag autocomplete * add ut * add flag "--pidfile" for podman create/run * Add network bindings tests: remove and list * Fix build with GO111MODULE=off * system tests: build --pull-never: deal with flakes * compose test: diagnose flakes v3 * podman play kube apply correct log driver * Fixes podman-remote save to directories does not work * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2 * Update documentation of podman-run to reflect volume "U" option * Fix flake on failed podman-remote build : try 2 * compose test: ongoing efforts to diagnose flakes * Test that we don't error out on advertised --log-level values * At trace log level, print error text using %+v instead of %v * pkg/errorhandling.JoinErrors: don't throw away context for lone errors * Recognize --log-level=trace * Fix flake on failed podman-remote build * System tests: fix racy podman-inspect * Fixes invalid expression in save command * Bump github.com/containers/common from 0.35.4 to 0.36.0 * Update nix pin with `make nixpkgs` * compose test: try to get useful data from flakes * Remove in-memory state implementation * Fix message about runtime to show only the actual runtime * System tests: setup: better cleanup of stray images * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1 * Reflect current state of prune implementation in docs * Do not delete container twice * [CI:DOCS] Correct status code for /pods/create * vendor in containers/storage v1.29.0 * cgroup: do not set cgroup parent when rootless and cgroupfs * Overhaul Makefile binary and release worflows * Reorganize Makefile with sections and guide * Simplify Makefile help target * Don't shell to obtain current directory * Remove unnecessary/not-needed release.txt target * Fix incorrect version number output * Exclude .gitignore from test req. * Fix handling of $NAME and $IMAGE in runlabel * Update podman image Dockerfile to support Podman in container * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0 * Fix slashes in socket URLs * Add network prune filters support to bindings * Add support for play/generate kube volumes * Update manifest API endpoints * Fix panic when not giving a machine name for ssh * cgroups: force 64 bits to ParseUint * Bump k8s.io/api from 0.20.5 to 0.21.0 * [CI:DOCS] Fix formatting of podman-build man page * buildah-bud tests: simplify * Add missing return * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1 * speed up CI handling of images * Volumes prune endpoint should use only prune filters * Cirrus: Use Fedora 34beta images * Bump go.sum + Makefile for golang 1.16 * Exempt Makefile changes from test requirements * Adjust libpod API Container Wait documentation to the code * [CI:DOCS] Update swagger definition of inspect manifest * use updated ubuntu images * podman unshare: add --rootless-cni to join the ns * Update swagger-check * swagger: remove name wildcards * Update buildah-bud diffs * Handle podman-remote --arch, --platform, --os * buildah-bud tests: handle go pseudoversions, plus... * Fix flaking rootless compose test * rootless cni add /usr/sbin to PATH if not present * System tests: special case for RHEL: require runc * Add --requires flag to podman run/create * [CI:DOCS] swagger-check: compare operations * [CI:DOCS] Polish swagger OpertionIDs * [NO TESTS NEEDED] Update nix pin with `make nixpkgs` * Ensure that `--userns=keep-id` sets user in config * [CI:DOCS] Set all operation id to be compatibile * Move operationIds to swagger:operation line * swagger: add operationIds that match with docker * Cirrus: Make use of shared get_ci_vm container * Don't relabel volumes if running in a privileged container * Allow users to override default storage opts with --storage-opt * Add support for podman --context default * Verify existence of auth file if specified * fix machine naming conventions * Initial network bindings tests * Update release notes to indicate CVE fix * Move socket activation check into init() and set global condition. * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0 * Http api tests for network prune with until filter * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns * Fix typos --uidmapping and --gidmapping * Add transport and destination info to manifest doc * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1 * Add default template functions * Fix missing podman-remote build options * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1 * Add ssh connection to root user * Add rootless docker-compose test to the CI * Use the slrip4netns dns in the rootless cni ns * Cleanup the rootless cni namespace * Add new docker-compose test for two networks * Make the docker-compose test work rootless * Remove unused rootless-cni-infra container files * Only use rootless RLK when the container has ports * Fix dnsname test * Enable rootless network connect/disconnect * Move slirp4netns functions into an extra file * Fix pod infra container cni network setup * Add rootless support for cni and --uidmap * rootless cni without infra container * Recreate until container prune tests for bindings * Remove --execute from podman machine ssh * Fixed podman-remote --network flag * Makefile: introduce install.docker-full * Makefile: ensure install.docker creates BINDIR * Fix unmount doc reference in image.rst * Should send the OCI runtime path not just the name to buildah * podman machine shell completion * Fix handling of remove --log-rusage param * Fix bindings prune containers flaky test * [CI:DOCS] Add local html build info to docs/README.md * Add podman machine list * Trim white space from /top endpoint results * Remove semantic version suffices from API calls * podman machine init --ignition-path * Document --volume from podman-remote run/create client * Update main branch to reflect the release of v3.1.0 * Silence podman network reload errors with iptables-nft * Containers prune endpoint should use only prune filters * resolve proper aarch64 image names * APIv2 basic test: relax APIVersion check * Add machine support for qemu-system-aarch64 * podman machine init user input * manpage xref: helpful diagnostic for unescaped dash-dash * Bump to v3.2.0-dev * swagger: update system version response body * buildah-bud tests: reenable pull-never test * [NO TESTS NEEDED] Shrink the size of podman-remote * Add powershell completions * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted * Fix long option format on docs.podman.io * system tests: friendier messages for 2-arg is() * service: use LISTEN_FDS * man pages: correct seccomp-policy label * rootless: use is_fd_inherited * podman generate systemd --new do not duplicate params * play kube: add support for env vars defined from secrets * play kube: support optional/mandatory env var from config map * play kube: prepare supporting other env source than config maps * Add machine support for more Linux distros * [NO TESTS NEEDED] Use same function podman-remote rmi as podman * Podman machine enhancements * Add problematic volume name to kube play error messages * Fix podman build --pull-never * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS * [NO TESTS NEEDED] Turn on podman-remote build --isolation * Fix list pods filter handling in libpod api * Remove resize race condition * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0 * Use TMPDIR when commiting images * Add RequiresMountsFor= to systemd generate * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3 * Fix swapped dimensions from terminal.GetSize * Rename podman machine create to init and clean up * Correct json field name * system tests: new interactive tests * Improvements for machine * libpod/image: unit tests: use a `registries.conf` for aliases * libpod/image: unit tests: defer cleanup * libpod/image: unit tests: use `require.NoError` * Add --execute flag to podman machine ssh * introduce podman machine * Podman machine CLI and interface stub * Support multi doc yaml for generate/play kube * Fix filters in image http compat/libpod api endpoints * Bump github.com/containers/common from 0.35.3 to 0.35.4 * Bump github.com/containers/storage from 1.28.0 to 1.28.1 * Check if stdin is a term in --interactive --tty mode * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot * [NO TESTS NEEDED] Fix rootless volume plugins * Ensure manually-created volumes have correct ownership * Bump github.com/rootless-containers/rootlesskit * Unification of until filter across list/prune endpoints * Unification of label filter across list/prune endpoints * fixup * fix: build endpoint for compat API * [CI:DOCS] Add note to mappings for user/group userns in build * Bump k8s.io/api from 0.20.1 to 0.20.5 * Validate passed in timezone from tz option * WIP: run buildah bud tests using podman * Fix containers list/prune http api filter behaviour * Generate Kubernetes PersistentVolumeClaims from named volumes - Update to version 3.1.2: * Bump to v3.1.2 * Update release notes for v3.1.2 * Ensure mount destination is clean, no trailing slash * Fixes podman-remote save to directories does not work * [CI:DOCS] Add missing dash to verbose option * [CI:DOCS] Fix Markdown table layout bugs * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md * rmi: don't break when the image is missing a manifest * Bump containers/image to v5.11.1 * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1 * Fix lint * Bump to v3.1.2-dev - Split podman-remote into a subpackage - Add missing scriptlets for systemd units - Escape macros in comments - Drop some obsolete workarounds, including %{go_nostrip} - Update to version 3.1.1: * Bump to v3.1.1 * Update release notes for v3.1.1 * podman play kube apply correct log driver * Fix build with GO111MODULE=off * [CI:DOCS] Set all operation id to be compatibile * Move operationIds to swagger:operation line * swagger: add operationIds that match with docker * Fix missing podman-remote build options * [NO TESTS NEEDED] Shrink the size of podman-remote * Move socket activation check into init() and set global condition. * rootless: use is_fd_inherited * Recreate until container prune tests for bindings * System tests: special case for RHEL: require runc * Document --volume from podman-remote run/create client * Containers prune endpoint should use only prune filters * Trim white space from /top endpoint results * Fix unmount doc reference in image.rst * Fix handling of remove --log-rusage param * Makefile: introduce install.docker-full * Makefile: ensure install.docker creates BINDIR * Should send the OCI runtime path not just the name to buildah * Fixed podman-remote --network flag * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns * Fix typos --uidmapping and --gidmapping * Add default template functions * Don't relabel volumes if running in a privileged container * Allow users to override default storage opts with --storage-opt * Add transport and destination info to manifest doc * Verify existence of auth file if specified * Ensure that `--userns=keep-id` sets user in config * [CI:DOCS] Update swagger definition of inspect manifest * Volumes prune endpoint should use only prune filters * Adjust libpod API Container Wait documentation to the code * Add missing return * [CI:DOCS] Fix formatting of podman-build man page * cgroups: force 64 bits to ParseUint * Fix slashes in socket URLs * [CI:DOCS] Correct status code for /pods/create * cgroup: do not set cgroup parent when rootless and cgroupfs * Reflect current state of prune implementation in docs * Do not delete container twice * Test that we don't error out on advertised --log-level values * At trace log level, print error text using %+v instead of %v * pkg/errorhandling.JoinErrors: don't throw away context for lone errors * Recognize --log-level=trace * Fix message about runtime to show only the actual runtime * Fix handling of $NAME and $IMAGE in runlabel * Fix flake on failed podman-remote build : try 2 * Fix flake on failed podman-remote build * Update documentation of podman-run to reflect volume "U" option * Fixes invalid expression in save command * Fix possible panic in libpod/image/prune.go * Update all containers/ project vendors * Fix tests * Bump to v3.1.1-dev - Update to version 3.1.0: * Bump to v3.1.0 * Fix test failure * Update release notes for v3.1.0 final release * [NO TESTS NEEDED] Turn on podman-remote build --isolation * Fix long option format on docs.podman.io * Fix containers list/prune http api filter behaviour * [CI:DOCS] Add note to mappings for user/group userns in build * Validate passed in timezone from tz option * Generate Kubernetes PersistentVolumeClaims from named volumes * libpod/image: unit tests: use a `registries.conf` for aliases - Require systemd 241 or newer due to podman dependency go-systemd v22, otherwise build will fail with unknown C name errors - Create docker subpackage to allow replacing docker with corresponding aliases to podman. - Update to v3.0.1 * Changes - Several frequently-occurring WARN level log messages have been downgraded to INFO or DEBUG to not clutter terminal output. Bugfixes - Fixed a bug where the Created field of podman ps --format=json was formatted as a string instead of an Unix timestamp (integer) (#9315). - Fixed a bug where failing lookups of individual layers during the podman images command would cause the whole command to fail without printing output. - Fixed a bug where --cgroups=split did not function properly on cgroups v1 systems. - Fixed a bug where mounting a volume over an directory in the container that existed, but was empty, could fail (#9393). - Fixed a bug where mounting a volume over a directory in the container that existed could copy the entirety of the container's rootfs, instead of just the directory mounted over, into the volume (#9415). - Fixed a bug where Podman would treat the --entrypoint=[""] option to podman run and podman create as a literal empty string in the entrypoint, when instead it should have been ignored (#9377). - Fixed a bug where Podman would set the HOME environment variable to "" when the container ran as a user without an assigned home directory (#9378). - Fixed a bug where specifying a pod infra image that had no tags (by using its ID) would cause podman pod create to panic (#9374). - Fixed a bug where the --runtime option was not properly handled by the podman build command (#9365). - Fixed a bug where Podman would incorrectly print an error message related to the remote API when the remote API was not in use and starting Podman failed. - Fixed a bug where Podman would change ownership of a container's working directory, even if it already existed (#9387). - Fixed a bug where the podman generate systemd --new command would incorrectly escape %t when generating the path for the PID file (#9373). - Fixed a bug where Podman could, when run inside a Podman container with the host's containers/storage directory mounted into the container, erroneously detect a reboot and reset container state if the temporary directory was not also mounted in (#9191). - Fixed a bug where some options of the podman build command (including but not limited to --jobs) were nonfunctional (#9247). * API - Fixed a breaking change to the Libpod Wait API for Containers where the Conditions parameter changed type in Podman v3.0 (#9351). - Fixed a bug where the Compat Create endpoint for Containers did not properly handle forwarded ports that did not specify a host port. - Fixed a bug where the Libpod Wait endpoint for Containers could write duplicate headers after an error occurred. - Fixed a bug where the Compat Create endpoint for Images would not pull images that already had a matching tag present locally, even if a more recent version was available at the registry (#9232). - The Compat Create endpoint for Images has had its compatibility with Docker improved, allowing its use with the docker-java library. * Misc - Updated Buildah to v1.19.4 - Updated the containers/storage library to v1.24.6 - Changes from v3.0.0 * Features - Podman now features initial support for Docker Compose. - Added the podman rename command, which allows containers to be renamed after they are created (#1925). - The Podman remote client now supports the podman copy command. - A new command, podman network reload, has been added. This command will re-configure the network of all running containers, and can be used to recreate firewall rules lost when the system firewall was reloaded (e.g. via firewall-cmd --reload). - Podman networks now have IDs. They can be seen in podman network ls and can be used when removing and inspecting networks. Existing networks receive IDs automatically. - Podman networks now also support labels. They can be added via the --label option to network create, and podman network ls can filter labels based on them. - The podman network create command now supports setting bridge MTU and VLAN through the --opt option (#8454). - The podman container checkpoint and podman container restore commands can now checkpoint and restore containers that include volumes. - The podman container checkpoint command now supports the --with-previous and --pre-checkpoint options, and the podman container restore command now support the --import-previous option. These add support for two-step checkpointing with lowered dump times. - The podman push command can now push manifest lists. Podman will first attempt to push as an image, then fall back to pushing as a manifest list if that fails. - The podman generate kube command can now be run on multiple containers at once, and will generate a single pod containing all of them. - The podman generate kube and podman play kube commands now support Kubernetes DNS configuration, and will preserve custom DNS configuration when exporting or importing YAML (#9132). - The podman generate kube command now properly supports generating YAML for containers and pods creating using host networking (--net=host) (#9077). - The podman kill command now supports a --cidfile option to kill containers given a file containing the container's ID (#8443). - The podman pod create command now supports the --net=none option (#9165). - The podman volume create command can now specify volume UID and GID as options with the UID and GID fields passed to the the --opt option. - Initial support has been added for Docker Volume Plugins. Podman can now define available plugins in containers.conf and use them to create volumes with podman volume create --driver. - The podman run and podman create commands now support a new option, --platform, to specify the platform of the image to be used when creating the container. - The --security-opt option to podman run and podman create now supports the systempaths=unconfined option to unrestrict access to all paths in the container, as well as mask and unmask options to allow more granular restriction of container paths. - The podman stats --format command now supports a new format specified, MemUsageBytes, which prints the raw bytes of memory consumed by a container without human-readable formatting #8945. - The podman ps command can now filter containers based on what pod they are joined to via the pod filter (#8512). - The podman pod ps command can now filter pods based on what networks they are joined to via the network filter. The podman pod ps command can now print information on what networks a pod is joined to via the .Networks specifier to the --format option. - The podman system prune command now supports filtering what containers, pods, images, and volumes will be pruned. - The podman volume prune commands now supports filtering what volumes will be pruned. - The podman system prune command now includes information on space reclaimed (#8658). - The podman info command will now properly print information about packages in use on Gentoo and Arch systems. - The containers.conf file now contains an option for disabling creation of a new kernel keyring on container creation (#8384). - The podman image sign command can now sign multi-arch images by producing a signature for each image in a given manifest list. - The podman image sign command, when run as rootless, now supports per-user registry configuration files in $HOME/.config/containers/registries.d. - Configuration options for slirp4netns can now be set system-wide via the NetworkCmdOptions configuration option in containers.conf. - The MTU of slirp4netns can now be configured via the mtu= network command option (e.g. podman run --net slirp4netns:mtu=9000). * Security - A fix for CVE-2021-20199 is included. Podman between v1.8.0 and v2.2.1 used 127.0.0.1 as the source address for all traffic forwarded into rootless containers by a forwarded port; this has been changed to address the issue. * Changes - Shortname aliasing support has now been turned on by default. All Podman commands that must pull an image will, if a TTY is available, prompt the user about what image to pull. - The podman load command no longer accepts a NAME[:TAG] argument. The presence of this argument broke CLI compatibility with Docker by making docker load commands unusable with Podman (#7387). - The Go bindings for the HTTP API have been rewritten with a focus on limiting dependency footprint and improving extensibility. Read more here. - The legacy Varlink API has been completely removed from Podman. - The default log level for Podman has been changed from Error to Warn. - The podman network create command can now create macvlan networks using the --driver macvlan option for Docker compatibility. The existing --macvlan flag has been deprecated and will be removed in Podman 4.0 some time next year. - The podman inspect command has had the LogPath and LogTag fields moved into the LogConfig structure (from the root of the Inspect structure). The maximum size of the log file is also included. - The podman generate systemd command no longer generates unit files using the deprecated KillMode=none option (#8615). - The podman stop command now releases the container lock while waiting for it to stop - as such, commands like podman ps will no longer block until podman stop completes (#8501). - Networks created with podman network create --internal no longer use the dnsname plugin. This configuration never functioned as expected. - Error messages for the remote Podman client have been improved when it cannot connect to a Podman service. - Error messages for podman run when an invalid SELinux is specified have been improved. - Rootless Podman features improved support for containers with a single user mapped into the rootless user namespace. - Pod infra containers now respect default sysctls specified in containers.conf allowing for advanced configuration of the namespaces they will share. - SSH public key handling for remote Podman has been improved. * Bugfixes - Fixed a bug where the podman history --no-trunc command would truncate the Created By field (#9120). - Fixed a bug where root containers that did not explicitly specify a CNI network to join did not generate an entry for the network in use in the Networks field of the output of podman inspect (#6618). - Fixed a bug where, under some circumstances, container working directories specified by the image (via the WORKDIR instruction) but not present in the image, would not be created (#9040). - Fixed a bug where the podman generate systemd command would generate invalid unit files if the container was creating using a command line that included doubled braces ({{ and }}), e.g. --log-opt-tag={{.Name}} (#9034). - Fixed a bug where the podman generate systemd --new command could generate unit files including invalid Podman commands if the container was created using merged short options (e.g. podman run -dt) (#8847). - Fixed a bug where the podman generate systemd --new command could generate unit files that did not handle Podman commands including some special characters (e.g. $) (#9176 - Fixed a bug where rootless containers joining CNI networks could not set a static IP address (#7842). - Fixed a bug where rootless containers joining CNI networks could not set network aliases (#8567). - Fixed a bug where the remote client could, under some circumstances, not include the Containerfile when sending build context to the server (#8374). - Fixed a bug where rootless Podman did not mount /sys as a new sysfs in some circumstances where it was acceptable. - Fixed a bug where rootless containers that both joined a user namespace and a CNI networks would cause a segfault. These options are incompatible and now return an error. - Fixed a bug where the podman play kube command did not properly handle CMD and ARGS from images (#8803). - Fixed a bug where the podman play kube command did not properly handle environment variables from images (#8608). - Fixed a bug where the podman play kube command did not properly print errors that occurred when starting containers. - Fixed a bug where the podman play kube command errored when hostNetwork was used (#8790). - Fixed a bug where the podman play kube command would always pull images when the :latest tag was specified, even if the image was available locally (#7838). - Fixed a bug where the podman play kube command did not properly handle SELinux configuration, rending YAML with custom SELinux configuration unusable (#8710). - Fixed a bug where the podman generate kube command incorrectly populated the args and command fields of generated YAML (#9211). - Fixed a bug where containers in a pod would create a duplicate entry in the pod's shared /etc/hosts file every time the container restarted (#8921). - Fixed a bug where the podman search --list-tags command did not support the --format option (#8740). - Fixed a bug where the http_proxy option in containers.conf was not being respected, and instead was set unconditionally to true (#8843). - Fixed a bug where rootless Podman could, on systems with a recent Conmon and users with a long username, fail to attach to containers (#8798). - Fixed a bug where the podman images command would break and fail to display any images if an empty manifest list was present in storage (#8931). - Fixed a bug where locale environment variables were not properly passed on to Conmon. - Fixed a bug where Podman would not build on the MIPS architecture (#8782). - Fixed a bug where rootless Podman could fail to properly configure user namespaces for rootless containers when the user specified a --uidmap option that included a mapping beginning with UID 0. - Fixed a bug where the podman logs command using the k8s-file backend did not properly handle partial log lines with a length of 1 (#8879). - Fixed a bug where the podman logs command with the --follow option did not properly handle log rotation (#8733). - Fixed a bug where user-specified HOSTNAME environment variables were overwritten by Podman (#8886). - Fixed a bug where Podman would applied default sysctls from containers.conf in too many situations (e.g. applying network sysctls when the container shared its network with a pod). - Fixed a bug where Podman did not properly handle cases where a secondary image store was in use and an image was present in both the secondary and primary stores (#8176). - Fixed a bug where systemd-managed rootless Podman containers where the user in the container was not root could fail as the container's PID file was not accessible to systemd on the host (#8506). - Fixed a bug where the --privileged option to podman run and podman create would, under some circumstances, not disable Seccomp (#8849). - Fixed a bug where the podman exec command did not properly add capabilities when the container or exec session were run with --privileged. - Fixed a bug where rootless Podman would use the --enable-sandbox option to slirp4netns unconditionally, even when pivot_root was disabled, rendering slirp4netns unusable when pivot_root was disabled (#8846). - Fixed a bug where podman build --logfile did not actually write the build's log to the logfile. - Fixed a bug where the podman system service command did not close STDIN, and could display user-interactive prompts (#8700). - Fixed a bug where the podman system reset command could, under some circumstances, remove all the contents of the XDG_RUNTIME_DIR directory (#8680). - Fixed a bug where the podman network create command created CNI configurations that did not include a default gateway (#8748). - Fixed a bug where the podman.service systemd unit provided by default used the wrong service type, and would cause systemd to not correctly register the service as started (#8751). - Fixed a bug where, if the TMPDIR environment variable was set for the container engine in containers.conf, it was being ignored. - Fixed a bug where the podman events command did not properly handle future times given to the --until option (#8694). - Fixed a bug where the podman logs command wrote container STDERR logs to STDOUT instead of STDERR (#8683). - Fixed a bug where containers created from an image with multiple tags would report that they were created from the wrong tag (#8547). - Fixed a bug where container capabilities were not set properly when the --cap-add=all and --user options to podman create and podman run were combined. - Fixed a bug where the --layers option to podman build was nonfunctional (#8643). - Fixed a bug where the podman system prune command did not act recursively, and thus would leave images, containers, pods, and volumes present that would be removed by a subsequent call to podman system prune (#7990). - Fixed a bug where the --publish option to podman run and podman create did not properly handle ports specified as a range of ports with no host port specified (#8650). - Fixed a bug where --format did not support JSON output for individual fields (#8444). - Fixed a bug where the podman stats command would fail when run on root containers using the slirp4netns network mode (#7883). - Fixed a bug where the Podman remote client would ask for a password even if the server's SSH daemon did not support password authentication (#8498). - Fixed a bug where the podman stats command would fail if the system did not support one or more of the cgroup controllers Podman supports (#8588). - Fixed a bug where the --mount option to podman create and podman run did not ignore the consistency mount option. - Fixed a bug where failures during the resizing of a container's TTY would print the wrong error. - Fixed a bug where the podman network disconnect command could cause the podman inspect command to fail for a container until it was restarted (#9234). - Fixed a bug where containers created from a read-only rootfs (using the --rootfs option to podman create and podman run) would fail (#9230). - Fixed a bug where specifying Go templates to the --format option to multiple Podman commands did not support the join function (#8773). - Fixed a bug where the podman rmi command could, when run in parallel on multiple images, return layer not known errors (#6510). - Fixed a bug where the podman inspect command on containers displayed unlimited ulimits incorrectly (#9303). - Fixed a bug where Podman would fail to start when a volume was mounted over a directory in a container that contained symlinks that terminated outside the directory and its subdirectories (#6003). API - Libpod API version has been bumped to v3.0.0. - All Libpod Pod APIs have been modified to properly report errors with individual containers. Cases where the operation as a whole succeeded but individual containers failed now report an HTTP 409 error (#8865). - The Compat API for Containers now supports the Rename and Copy APIs. - Fixed a bug where the Compat Prune APIs (for volumes, containers, and images) did not return the amount of space reclaimed in their responses. - Fixed a bug where the Compat and Libpod Exec APIs for Containers would drop errors that occurred prior to the exec session successfully starting (e.g. a "no such file" error if an invalid executable was passed) (#8281) - Fixed a bug where the Volumes field in the Compat Create API for Containers was being ignored (#8649). - Fixed a bug where the NetworkMode field in the Compat Create API for Containers was not handling some values, e.g. container:, correctly. - Fixed a bug where the Compat Create API for Containers did not set container name properly. - Fixed a bug where containers created using the Compat Create API unconditionally used Kubernetes file logging (the default specified in containers.conf is now used). - Fixed a bug where the Compat Inspect API for Containers could include container states not recognized by Docker. - Fixed a bug where Podman did not properly clean up after calls to the Events API when the journald backend was in use, resulting in a leak of file descriptors (#8864). - Fixed a bug where the Libpod Pull endpoint for Images could fail with an index out of range error under certain circumstances (#8870). - Fixed a bug where the Libpod Exists endpoint for Images could panic. - Fixed a bug where the Compat List API for Containers did not support all filters (#8860). - Fixed a bug where the Compat List API for Containers did not properly populate the Status field. - Fixed a bug where the Compat and Libpod Resize APIs for Containers ignored the height and width parameters (#7102). - Fixed a bug where the Compat Search API for Images returned an incorrectly-formatted JSON response (#8758). - Fixed a bug where the Compat Load API for Images did not properly clean up temporary files. - Fixed a bug where the Compat Create API for Networks could panic when an empty IPAM configuration was specified. - Fixed a bug where the Compat Inspect and List APIs for Networks did not include Scope. - Fixed a bug where the Compat Wait endpoint for Containers did not support the same wait conditions that Docker did. * Misc - Updated Buildah to v1.19.2 - Updated the containers/storage library to v1.24.5 - Updated the containers/image library to v5.10.2 - Updated the containers/common library to v0.33.4 - Update to v2.2.1 * Changes - Due to a conflict with a previously-removed field, we were forced to modify the way image volumes (mounting images into containers using --mount type=image) were handled in the database. As a result, containers created in Podman 2.2.0 with image volume will not have them in v2.2.1, and these containers will need to be re-created. * Bugfixes - Fixed a bug where rootless Podman would, on systems without the XDG_RUNTIME_DIR environment variable defined, use an incorrect path for the PID file of the Podman pause process, causing Podman to fail to start (#8539). - Fixed a bug where containers created using Podman v1.7 and earlier were unusable in Podman due to JSON decode errors (#8613). - Fixed a bug where Podman could retrieve invalid cgroup paths, instead of erroring, for containers that were not running. - Fixed a bug where the podman system reset command would print a warning about a duplicate shutdown handler being registered. - Fixed a bug where rootless Podman would attempt to mount sysfs in circumstances where it was not allowed; some OCI runtimes (notably crun) would fall back to alternatives and not fail, but others (notably runc) would fail to run containers. - Fixed a bug where the podman run and podman create commands would fail to create containers from untagged images (#8558). - Fixed a bug where remote Podman would prompt for a password even when the server did not support password authentication (#8498). - Fixed a bug where the podman exec command did not move the Conmon process for the exec session into the correct cgroup. - Fixed a bug where shell completion for the ancestor option to podman ps --filter did not work correctly. - Fixed a bug where detached containers would not properly clean themselves up (or remove themselves if --rm was set) if the Podman command that created them was invoked with --log-level=debug. * API - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the Binds and Mounts parameters in HostConfig. - Fixed a bug where the Compat Create endpoint for Containers ignored the Name query parameter. - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the "default" value for NetworkMode (this value is used extensively by docker-compose) (#8544). - Fixed a bug where the Compat Build endpoint for Images would sometimes incorrectly use the target query parameter as the image's tag. * Misc - Podman v2.2.0 vendored a non-released, custom version of the github.com/spf13/cobra package; this has been reverted to the latest upstream release to aid in packaging. - Updated the containers/image library to v5.9.0 - Update to v2.2.0 * Features - Experimental support for shortname aliasing has been added. This is not enabled by default, but can be turned on by setting the environment variable CONTAINERS_SHORT_NAME_ALIASING to on. Documentation is available here and here. - Initial support has been added for the podman network connect and podman network disconnect commands, which allow existing containers to modify what networks they are connected to. At present, these commands can only be used on running containers that did not specify --network=none when they were created. - The podman run command now supports the --network-alias option to set network aliases (additional names the container can be accessed at from other containers via DNS if the dnsname CNI plugin is in use). Aliases can also be added and removed using the new podman network connect and podman network disconnect commands. Please note that this requires a new release (v1.1.0) of the dnsname plugin, and will only work on newly-created CNI networks. - The podman generate kube command now features support for exporting container's memory and CPU limits (#7855). - The podman play kube command now features support for setting CPU and Memory limits for containers (#7742). - The podman play kube command now supports persistent volumes claims using Podman named volumes. - The podman play kube command now supports Kubernetes configmaps via the --configmap option (#7567). - The podman play kube command now supports a --log-driver option to set the log driver for created containers. - The podman play kube command now supports a --start option, enabled by default, to start the pod after creating it. This allows for podman play kube to be more easily used in systemd unitfiles. - The podman network create command now supports the --ipv6 option to enable dual-stack IPv6 networking for created networks (#7302). - The podman inspect command can now inspect pods, networks, and volumes, in addition to containers and images (#6757). - The --mount option for podman run and podman create now supports a new type, image, to mount the contents of an image into the container at a given location. - The Bash and ZSH completions have been completely reworked and have received significant enhancements! Additionally, support for Fish completions and completions for the podman-remote executable have been added. - The --log-opt option for podman create and podman run now supports the max-size option to set the maximum size for a container's logs (#7434). - The --network option to the podman pod create command now allows pods to be configured to use slirp4netns networking, even when run as root (#6097). - The podman pod stop, podman pod pause, podman pod unpause, and podman pod kill commands now work on multiple containers in parallel and should be significantly faster. - The podman search command now supports a --list-tags option to list all available tags for a single image in a single repository. - The podman search command can now output JSON using the --format=json option. - The podman diff and podman mount commands now work with all containers in the storage library, including those not created by Podman. This allows them to be used with Buildah and CRI-O containers. - The podman container exists command now features a --external option to check if a container exists not just in Podman, but also in the storage library. This will allow Podman to identify Buildah and CRI-O containers. - The --tls-verify and --authfile options have been enabled for use with remote Podman. - The /etc/hosts file now includes the container's name and hostname (both pointing to localhost) when the container is run with --net=none (#8095). - The podman events command now supports filtering events based on the labels of the container they occurred on using the --filter label=key=value option. - The podman volume ls command now supports filtering volumes based on their labels using the --filter label=key=value option. - The --volume and --mount options to podman run and podman create now support two new mount propagation options, unbindable and runbindable. - The name and id filters for podman pod ps now match based on a regular expression, instead of requiring an exact match. - The podman pod ps command now supports a new filter status, that matches pods in a certain state. * Changes - The podman network rm --force command will now also remove pods that are using the network (#7791). - The podman volume rm, podman network rm, and podman pod rm commands now return exit code 1 if the object specified for removal does not exist, and exit code 2 if the object is in use and the --force option was not given. - If /dev/fuse is passed into Podman containers as a device, Podman will open it before starting the container to ensure that the kernel module is loaded on the host and the device is usable in the container. - Global Podman options that were not supported with remote operation have been removed from podman-remote (e.g. --cgroup-manager, --storage-driver). - Many errors have been changed to remove repetition and be more clear as to what has gone wrong. - The --storage option to podman rm is now enabled by default, with slightly changed semantics. If the given container does not exist in Podman but does exist in the storage library, it will be removed even without the --storage option. If the container exists in Podman it will be removed normally. The --storage option for podman rm is now deprecated and will be removed in a future release. - The --storage option to podman ps has been renamed to --external. An alias has been added so the old form of the option will continue to work. - Podman now delays the SIGTERM and SIGINT signals during container creation to ensure that Podman is not stopped midway through creating a container resulting in potential resource leakage (#7941). - The podman save command now strips signatures from images it is exporting, as the formats we export to do not support signatures (#7659). - A new Degraded state has been added to pods. Pods that have some, but not all, of their containers running are now considered to be Degraded instead of Running. - Podman will now print a warning when conflicting network options related to port forwarding (e.g. --publish and --net=host) are specified when creating a container. - The --restart on-failure and --rm options for containers no longer conflict. When both are specified, the container will be restarted if it exits with a non-zero error code, and removed if it exits cleanly (#7906). - Remote Podman will no longer use settings from the client's containers.conf; defaults will instead be provided by the server's containers.conf (#7657). - The podman network rm command now has a new alias, podman network remove (#8402). * Bugfixes - Fixed a bug where podman load on the remote client did not error when attempting to load a directory, which is not yet supported for remote use. - Fixed a bug where rootless Podman could hang when the newuidmap binary was not installed (#7776). - Fixed a bug where the --pull option to podman run, podman create, and podman build did not match Docker's behavior. - Fixed a bug where sysctl settings from the containers.conf configuration file were applied, even if the container did not join the namespace associated with a sysctl. - Fixed a bug where Podman would not return the text of errors encounted when trying to run a healthcheck for a container. - Fixed a bug where Podman was accidentally setting the containers environment variable in addition to the expected container environment variable. - Fixed a bug where rootless Podman using CNI networking did not properly clean up DNS entries for removed containers (#7789). - Fixed a bug where the podman untag --all command was not supported with remote Podman. - Fixed a bug where the podman system service command could time out even if active attach connections were present (#7826). - Fixed a bug where the podman system service command would sometimes never time out despite no active connections being present. - Fixed a bug where Podman's handling of capabilities, specifically inheritable, did not match Docker's. - Fixed a bug where podman run would fail if the image specified was a manifest list and had already been pulled (#7798). - Fixed a bug where Podman did not take search registries into account when looking up images locally (#6381). - Fixed a bug where the podman manifest inspect command would fail for images that had already been pulled (#7726). - Fixed a bug where rootless Podman would not add supplemental GIDs to containers when when a user, but not a group, was set via the --user option to podman create and podman run and sufficient GIDs were available to add the groups (#7782). - Fixed a bug where remote Podman commands did not properly handle cases where the user gave a name that could also be a short ID for a pod or container (#7837). - Fixed a bug where podman image prune could leave images ready to be pruned after podman image prune was run (#7872). - Fixed a bug where the podman logs command with the journald log driver would not read all available logs (#7476). - Fixed a bug where the --rm and --restart options to podman create and podman run did not conflict when a restart policy that is not on-failure was chosen (#7878). - Fixed a bug where the --format "table {{ .Field }}" option to numerous Podman commands ceased to function on Podman v2.0 and up. - Fixed a bug where pods did not properly share an SELinux label between their containers, resulting in containers being unable to see the processes of other containers when the pod shared a PID namespace (#7886). - Fixed a bug where the --namespace option to podman ps did not work with the remote client (#7903). - Fixed a bug where rootless Podman incorrectly calculated the number of UIDs available in the container if multiple different ranges of UIDs were specified. - Fixed a bug where the /etc/hosts file would not be correctly populated for containers in a user namespace (#7490). - Fixed a bug where the podman network create and podman network remove commands could race when run in parallel, with unpredictable results (#7807). - Fixed a bug where the -p option to podman run, podman create, and podman pod create would, when given only a single number (e.g. -p 80), assign the same port for both host and container, instead of generating a random host port (#7947). - Fixed a bug where Podman containers did not properly store the cgroup manager they were created with, causing them to stop functioning after the cgroup manager was changed in containers.conf or with the --cgroup-manager option (#7830). - Fixed a bug where the podman inspect command did not include information on the CNI networks a container was connected to if it was not running. - Fixed a bug where the podman attach command would not print a newline after detaching from the container (#7751). - Fixed a bug where the HOME environment variable was not set properly in containers when the --userns=keep-id option was set (#8004). - Fixed a bug where the podman container restore command could panic when the container in question was in a pod (#8026). - Fixed a bug where the output of the podman image trust show --raw command was not properly formatted. - Fixed a bug where the podman runlabel command could panic if a label to run was not given (#8038). - Fixed a bug where the podman run and podman start --attach commands would exit with an error when the user detached manually using the detach keys on remote Podman (#7979). - Fixed a bug where rootless CNI networking did not use the dnsname CNI plugin if it was not available on the host, despite it always being available in the container used for rootless networking (#8040). - Fixed a bug where Podman did not properly handle cases where an OCI runtime is specified by its full path, and could revert to using another OCI runtime with the same binary path that existed in the system $PATH on subsequent invocations. - Fixed a bug where the --net=host option to podman create and podman run would cause the /etc/hosts file to be incorrectly populated (#8054). - Fixed a bug where the podman inspect command did not include container network information when the container shared its network namespace (IE, joined a pod or another container's network namespace via --net=container:...) (#8073). - Fixed a bug where the podman ps command did not include information on all ports a container was publishing. - Fixed a bug where the podman build command incorrectly forwarded STDIN into build containers from RUN instructions. - Fixed a bug where the podman wait command's --interval option did not work when units were not specified for the duration (#8088). - Fixed a bug where the --detach-keys and --detach options could be passed to podman create despite having no effect (and not making sense in that context). - Fixed a bug where Podman could not start containers if running on a system without a /etc/resolv.conf file (which occurs on some WSL2 images) (#8089). - Fixed a bug where the --extract option to podman cp was nonfunctional. - Fixed a bug where the --cidfile option to podman run would, when the container was not run with --detach, only create the file after the container exited (#8091). - Fixed a bug where the podman images and podman images -a commands could panic and not list any images when certain improperly-formatted images were present in storage (#8148). - Fixed a bug where the podman events command could, when the journald events backend was in use, become nonfunctional when a badly-formatted event or a log message that container certain string was present in the journal (#8125). - Fixed a bug where remote Podman would, when using SSH transport, not authenticate to the server using hostkeys when connecting on a port other than 22 (#8139). - Fixed a bug where the podman attach command would not exit when containers stopped (#8154). - Fixed a bug where Podman did not properly clean paths before verifying them, resulting in Podman refusing to start if the root or temporary directories were specified with extra trailing / characters (#8160). - Fixed a bug where remote Podman did not support hashed hostnames in the known_hosts file on the host for establishing connections (#8159). - Fixed a bug where the podman image exists command would return non-zero (false) when multiple potential matches for the given name existed. - Fixed a bug where the podman manifest inspect command on images that are not manifest lists would error instead of inspecting the image (#8023). - Fixed a bug where the podman system service command would fail if the directory the Unix socket was to be created inside did not exist (#8184). - Fixed a bug where pods that shared the IPC namespace (which is done by default) did not share a /dev/shm filesystem between all containers in the pod (#8181). - Fixed a bug where filters passed to podman volume list were not inclusive (#6765). - Fixed a bug where the podman volume create command would fail when the volume's data directory already existed (as might occur when a volume was not completely removed) (#8253). - Fixed a bug where the podman run and podman create commands would deadlock when trying to create a container that mounted the same named volume at multiple locations (e.g. podman run -v testvol:/test1 -v testvol:/test2) (#8221). - Fixed a bug where the parsing of the --net option to podman build was incorrect (#8322). - Fixed a bug where the podman build command would print the ID of the built image twice when using remote Podman (#8332). - Fixed a bug where the podman stats command did not show memory limits for containers (#8265). - Fixed a bug where the podman pod inspect command printed the static MAC address of the pod in a non-human-readable format (#8386). - Fixed a bug where the --tls-verify option of the podman play kube command had its logic inverted (false would enforce the use of TLS, true would disable it). - Fixed a bug where the podman network rm command would error when trying to remove macvlan networks and rootless CNI networks (#8491). - Fixed a bug where Podman was not setting sane defaults for missing XDG_ environment variables. - Fixed a bug where remote Podman would check if volume paths to be mounted in the container existed on the host, not the server (#8473). - Fixed a bug where the podman manifest create and podman manifest add commands on local images would drop any images in the manifest not pulled by the host. - Fixed a bug where networks made by podman network create did not include the tuning plugin, and as such did not support setting custom MAC addresses (#8385). - Fixed a bug where container healthchecks did not use $PATH when searching for the Podman executable to run the healthcheck. - Fixed a bug where the --ip-range option to podman network create did not properly handle non-classful subnets when calculating the last usable IP for DHCP assignment (#8448). - Fixed a bug where the podman container ps alias for podman ps was missing (#8445). * API - The Compat Create endpoint for Container has received a major refactor to share more code with the Libpod Create endpoint, and should be significantly more stable. - A Compat endpoint for exporting multiple images at once, GET /images/get, has been added (#7950). - The Compat Network Connect and Network Disconnect endpoints have been added. - Endpoints that deal with image registries now support a X-Registry-Config header to specify registry authentication configuration. - The Compat Create endpoint for images now properly supports specifying images by digest. - The Libpod Build endpoint for images now supports an httpproxy query parameter which, if set to true, will forward the server's HTTP proxy settings into the build container for RUN instructions. - The Libpod Untag endpoint for images will now remove all tags for the given image if no repository and tag are specified for removal. - Fixed a bug where the Ping endpoint misspelled a header name (Libpod-Buildha-Version instead of Libpod-Buildah-Version). - Fixed a bug where the Ping endpoint sent an extra newline at the end of its response where Docker did not. - Fixed a bug where the Compat Logs endpoint for containers did not send a newline character after each log line. - Fixed a bug where the Compat Logs endpoint for containers would mangle line endings to change newline characters to add a preceding carriage return (#7942). - Fixed a bug where the Compat Inspect endpoint for Containers did not properly list the container's stop signal (#7917). - Fixed a bug where the Compat Inspect endpoint for Containers formatted the container's create time incorrectly (#7860). - Fixed a bug where the Compat Inspect endpoint for Containers did not include the container's Path, Args, and Restart Count. - Fixed a bug where the Compat Inspect endpoint for Containers prefixed added and dropped capabilities with CAP_ (Docker does not do so). - Fixed a bug where the Compat Info endpoint for the Engine did not include configured registries. - Fixed a bug where the server could panic if a client closed a connection midway through an image pull (#7896). - Fixed a bug where the Compat Create endpoint for volumes returned an error when a volume with the same name already existed, instead of succeeding with a 201 code (#7740). - Fixed a bug where a client disconnecting from the Libpod or Compat events endpoints could result in the server using 100% CPU (#7946). - Fixed a bug where the "no such image" error message sent by the Compat Inspect endpoint for Images returned a 404 status code with an error that was improperly formatted for Docker compatibility. - Fixed a bug where the Compat Create endpoint for networks did not properly set a default for the driver parameter if it was not provided by the client. - Fixed a bug where the Compat Inspect endpoint for images did not populate the RootFS field of the response. - Fixed a bug where the Compat Inspect endpoint for images would omit the ParentId field if the image had no parent, and the Created field if the image did not have a creation time. - Fixed a bug where the Compat Remove endpoint for Networks did not support the Force query parameter. - add dependency to timezone package or podman fails to build a - Correct invalid use of %{_libexecdir} to ensure files should be in /usr/lib SELinux support [jsc#SMO-15] libseccomp was updated to release 2.5.3: * Update the syscall table for Linux v5.15 * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2 * Document that seccomp_rule_add() may return -EACCES Update to release 2.5.2 * Update the syscall table for Linux v5.14-rc7 * Add a function, get_notify_fd(), to the Python bindings to get the nofication file descriptor. * Consolidate multiplexed syscall handling for all architectures into one location. * Add multiplexed syscall support to PPC and MIPS * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within the kernel. libseccomp's fd notification logic was modified to support the kernel's previous and new usage of SECCOMP_IOCTL_NOTIF_ID_VALID. update to 2.5.1: * Fix a bug where seccomp_load() could only be called once * Change the notification fd handling to only request a notification fd if * the filter has a _NOTIFY action * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage * Clarify the maintainers' GPG keys Update to release 2.5.0 * Add support for the seccomp user notifications, see the seccomp_notify_alloc(3), seccomp_notify_receive(3), seccomp_notify_respond(3) manpages for more information * Add support for new filter optimization approaches, including a balanced tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for more information * Add support for the 64-bit RISC-V architecture * Performance improvements when adding new rules to a filter thanks to the use of internal shadow transactions and improved syscall lookup tables * Properly document the libseccomp API return values and include them in the stable API promise * Improvements to the s390 and s390x multiplexed syscall handling * Multiple fixes and improvements to the libseccomp manpages * Moved from manually maintained syscall tables to an automatically generated syscall table in CSV format * Update the syscall tables to Linux v5.8.0-rc5 * Python bindings and build now default to Python 3.x * Improvements to the tests have boosted code coverage to over 93% Update to release 2.4.3 * Add list of authorized release signatures to README.md * Fix multiplexing issue with s390/s390x shm* syscalls * Remove the static flag from libseccomp tools compilation * Add define for __SNR_ppoll * Fix potential memory leak identified by clang in the scmp_bpf_sim tool Update to release 2.4.2 * Add support for io-uring related system calls conmon was updated to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault Update to version 2.0.27: * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support Update to version 2.0.21: * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building libcontainers-common was updated to include: - common 0.44.0 - image 5.16.0 - podman 3.3.1 - storage 1.36.0 (changes too long to list) CVEs fixed: CVE-2020-14370,CVE-2020-15157,CVE-2021-20199,CVE-2021-20291,CVE-2021-3602 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-23018=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): conmon-2.0.30-150300.8.3.1 conmon-debuginfo-2.0.30-150300.8.3.1 libseccomp-debugsource-2.5.3-150300.10.5.1 libseccomp-devel-2.5.3-150300.10.5.1 libseccomp-tools-2.5.3-150300.10.5.1 libseccomp-tools-debuginfo-2.5.3-150300.10.5.1 libseccomp2-2.5.3-150300.10.5.1 libseccomp2-debuginfo-2.5.3-150300.10.5.1 podman-3.4.4-150300.9.3.2 - openSUSE Leap 15.3 (x86_64): libseccomp2-32bit-2.5.3-150300.10.5.1 libseccomp2-32bit-debuginfo-2.5.3-150300.10.5.1 - openSUSE Leap 15.3 (noarch): libcontainers-common-20210626-150300.8.3.1 podman-cni-config-3.4.4-150300.9.3.2 References: https://www.suse.com/security/cve/CVE-2020-14370.html https://www.suse.com/security/cve/CVE-2020-15157.html https://www.suse.com/security/cve/CVE-2021-20199.html https://www.suse.com/security/cve/CVE-2021-20291.html https://www.suse.com/security/cve/CVE-2021-3602.html https://www.suse.com/security/cve/CVE-2021-4024.html https://www.suse.com/security/cve/CVE-2021-41190.html https://bugzilla.suse.com/1176804 https://bugzilla.suse.com/1177598 https://bugzilla.suse.com/1181640 https://bugzilla.suse.com/1182998 https://bugzilla.suse.com/1188520 https://bugzilla.suse.com/1188914 https://bugzilla.suse.com/1193166 https://bugzilla.suse.com/1193273

1 0

openSUSE-SU-2022:0705-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0705-1 Rating: important References: #1195064 #1195735 #1196133 Cross-References: CVE-2021-30934 CVE-2021-30936 CVE-2021-30951 CVE-2021-30952 CVE-2021-30953 CVE-2021-30954 CVE-2021-30984 CVE-2021-45481 CVE-2021-45482 CVE-2021-45483 CVE-2022-22589 CVE-2022-22590 CVE-2022-22592 CVE-2022-22620 CVSS scores: CVE-2021-30934 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30934 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30936 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30936 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30951 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30951 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30952 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30952 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30953 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30953 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30954 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30954 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30984 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30984 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45481 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45482 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45483 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-22589 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVE-2022-22590 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-22592 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2022-22620 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.34.6 (bsc#1196133): - CVE-2022-22620: Processing maliciously crafted web content may have lead to arbitrary code execution. Update to version 2.34.5 (bsc#1195735): - CVE-2022-22589: A validation issue was addressed with improved input sanitization. - CVE-2022-22590: A use after free issue was addressed with improved memory management. - CVE-2022-22592: A logic issue was addressed with improved state management. Update to version 2.34.4 (bsc#1195064): - CVE-2021-30934: A buffer overflow issue was addressed with improved memory handling. - CVE-2021-30936: A use after free issue was addressed with improved memory management. - CVE-2021-30951: A use after free issue was addressed with improved memory management. - CVE-2021-30952: An integer overflow was addressed with improved input validation. - CVE-2021-30953: An out-of-bounds read was addressed with improved bounds checking. - CVE-2021-30954: A type confusion issue was addressed with improved memory handling. - CVE-2021-30984: A race condition was addressed with improved state handling. - CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with improved input validation. The following CVEs were addressed in a previous update: - CVE-2021-45481: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create. - CVE-2021-45482: A use-after-free in WebCore::ContainerNode::firstChild. - CVE-2021-45483: A use-after-free in WebCore::Frame::page. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-705=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-705=1 Package List: - openSUSE Leap 15.4 (noarch): libwebkit2gtk3-lang-2.34.6-29.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.34.6-29.1 libjavascriptcoregtk-4_0-18-debuginfo-2.34.6-29.1 libwebkit2gtk-4_0-37-2.34.6-29.1 libwebkit2gtk-4_0-37-debuginfo-2.34.6-29.1 typelib-1_0-JavaScriptCore-4_0-2.34.6-29.1 typelib-1_0-WebKit2-4_0-2.34.6-29.1 typelib-1_0-WebKit2WebExtension-4_0-2.34.6-29.1 webkit-jsc-4-2.34.6-29.1 webkit-jsc-4-debuginfo-2.34.6-29.1 webkit2gtk-4_0-injected-bundles-2.34.6-29.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.34.6-29.1 webkit2gtk3-debugsource-2.34.6-29.1 webkit2gtk3-devel-2.34.6-29.1 webkit2gtk3-minibrowser-2.34.6-29.1 webkit2gtk3-minibrowser-debuginfo-2.34.6-29.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.34.6-29.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.34.6-29.1 libwebkit2gtk-4_0-37-32bit-2.34.6-29.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.34.6-29.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.34.6-29.1 References: https://www.suse.com/security/cve/CVE-2021-30934.html https://www.suse.com/security/cve/CVE-2021-30936.html https://www.suse.com/security/cve/CVE-2021-30951.html https://www.suse.com/security/cve/CVE-2021-30952.html https://www.suse.com/security/cve/CVE-2021-30953.html https://www.suse.com/security/cve/CVE-2021-30954.html https://www.suse.com/security/cve/CVE-2021-30984.html https://www.suse.com/security/cve/CVE-2021-45481.html https://www.suse.com/security/cve/CVE-2021-45482.html https://www.suse.com/security/cve/CVE-2021-45483.html https://www.suse.com/security/cve/CVE-2022-22589.html https://www.suse.com/security/cve/CVE-2022-22590.html https://www.suse.com/security/cve/CVE-2022-22592.html https://www.suse.com/security/cve/CVE-2022-22620.html https://bugzilla.suse.com/1195064 https://bugzilla.suse.com/1195735 https://bugzilla.suse.com/1196133

1 0

openSUSE-SU-2022:0704-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0704-1 Rating: important References: #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-704=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-704=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - openSUSE Leap 15.4 (noarch): nodejs8-docs-8.17.0-10.19.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - openSUSE Leap 15.3 (noarch): nodejs8-docs-8.17.0-10.19.2 References: https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696

1 0

openSUSE-SU-2022:0699-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0699-1 Rating: moderate References: #1038980 Cross-References: CVE-2017-8923 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-699=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://bugzilla.suse.com/1038980

1 0

openSUSE-SU-22022:20000-2: important: Security update for nodejs8
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-22022:20000-2 Rating: important References: #1038980 #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2017-8923 CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 openSUSE-SLE-15.3-2022-704=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 - openSUSE Leap 15.3 (noarch): nodejs8-docs-8.17.0-10.19.2 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1038980 https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696

1 0

openSUSE-SU-2022:40696-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:40696-1 Rating: important References: #1195230 #1195682 Cross-References: CVE-2022-22753 CVE-2022-22754 CVE-2022-22756 CVE-2022-22759 CVE-2022-22760 CVE-2022-22761 CVE-2022-22763 CVE-2022-22764 Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 (bsc#1195682) - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during update - CVE-2022-22756: Drag and dropping an image could have resulted in the dropped object being an executable - CVE-2022-22759: Sandboxed iframes could have executed script if the parent appended elements - CVE-2022-22760: Cross-Origin responses could be distinguished between script and non-script content-types - CVE-2022-22761: frame-ancestors Content Security Policy directive was not enforced for framed extension pages - CVE-2022-22763: Script Execution during invalid object state - CVE-2022-22764: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6 Firefox Extended Support Release 91.5.1 ESR (bsc#1195230) - Fixed an issue that allowed unexpected data to be submitted in some of our search telemetry Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-696=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.0-152.15.1 MozillaFirefox-branding-upstream-91.6.0-152.15.1 MozillaFirefox-debuginfo-91.6.0-152.15.1 MozillaFirefox-debugsource-91.6.0-152.15.1 MozillaFirefox-devel-91.6.0-152.15.1 MozillaFirefox-translations-common-91.6.0-152.15.1 MozillaFirefox-translations-other-91.6.0-152.15.1 References: https://www.suse.com/security/cve/CVE-2022-22753.html https://www.suse.com/security/cve/CVE-2022-22754.html https://www.suse.com/security/cve/CVE-2022-22756.html https://www.suse.com/security/cve/CVE-2022-22759.html https://www.suse.com/security/cve/CVE-2022-22760.html https://www.suse.com/security/cve/CVE-2022-22761.html https://www.suse.com/security/cve/CVE-2022-22763.html https://www.suse.com/security/cve/CVE-2022-22764.html https://bugzilla.suse.com/1195230 https://bugzilla.suse.com/1195682

1 0

openSUSE-SU-22022:20000-2: moderate: Security update for php7
by opensuse-security＠opensuse.org 04 Mar '22

04 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-22022:20000-2 Rating: moderate References: #1038980 Cross-References: CVE-2017-8923 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://bugzilla.suse.com/1038980

1 0

openSUSE-SU-2022:0072-1: moderate: Security update for bitcoin
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for bitcoin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0072-1 Rating: moderate References: Cross-References: CVE-2021-3195 CVSS scores: CVE-2021-3195 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bitcoin fixes the following issues: Update to version 0.21.2 * P2P protocol and network code * use NetPermissions::HasFlag() in CConnman::Bind() * Rate limit the processing of rumoured addresses * Wallet * Do not iterate a directory if having an error while accessing it * RPC * Reset scantxoutset progress before inferring descriptors * Build System * depends: update Qt 5.9 source url * Update Windows code signing certificate * Use custom MacOS code signing tool * Fix build with Boost 1.77.0 * Tests and QA * Build with --enable-werror by default, and document exceptions * Fix intermittent feature_taproot issue * Fix macOS brew install command * add missing ECCVerifyHandle to base_encode_decode * Run fuzzer task for the master branch only * GUI * Do not use QClipboard::Selection on Windows and macOS. * Remove user input from URI error message * Draw "eye" sign at the beginning of watch-only addresses * Miscellaneous * Fix crash when parsing command line with -noincludeconf=0 * util: Properly handle -noincludeconf on command line (take 2) Update to version 0.21.1 * Consensus: * Speedy trial support for versionbits * Speedy trial activation parameters for Taproot * P2P protocol and network code * allow CSubNet of non-IP networks * Avoid UBSan warning in ProcessMessage * Wallet * Introduce DeferredSignatureChecker and have SignatureExtractorClass subclass it * Avoid requesting fee rates multiple times during coin selection * RPC and other APIs: * Disallow sendtoaddress and sendmany when private keys disabled CVE-2021-3195 Update to version 0.21.0: * For full details see release-notes-0.21.0.md Update to version 0.20.1 * Mining * Fix GBT: Restore "!segwit" and "csv" to "rules" key * P2P protocol and network code * Replace automatic bans with discouragement filter * Wallet * Handle concurrent wallet loading * Minimal fix to restore conflicted transaction notifications * RPC and other APIs * Increment input value sum only once per UTXO in decodepsbt * psbt: Increment input value sum only once per UTXO in decodepsbt * psbt: Include and allow both non_witness_utxo and witness_utxo for segwit inputs * GUI * Add missing QPainterPath include * update Qt base translations for macOS release * Misc * util: Don't reference errno when pthread fails * Fix locking on WSL using flock instead of fcntl Update to version 0.20.0: * See https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-no tes-0.20.0.md - Do not run bitcoind in daemon mode. Running it not as a background process makes it working properly with journald (instead of writing logs in /var/log). Update to version 0.19.1: * Wallet * Fix origfee return for bumpfee with feerate arg * Fix unique_ptr usage in boost::signals2 * Fix issue with conflicted mempool tx in listsinceblock * Bug: IsUsedDestination shouldn't use key id as script id for ScriptHash * IsUsedDestination should count any known single-key address * Reset reused transactions cache * RPC and other APIs * cli: Fix fatal leveldb error when specifying -blockfilterindex=basic twice * require second argument only for scantxoutset start action * zmq: Fix due to invalid argument and multiple notifiers * psbt: handle unspendable psbts * psbt: check that various indexes and amounts are within bounds * GUI * Fix missing qRegisterMetaType for size_t * disable File->CreateWallet during startup * Fix comparison function signature * Fix unintialized WalletView::progressDialog * Tests and QA * Appveyor improvement - text file for vcpkg package list * fix "bitcoind already running" warnings on macOS * add missing #include to fix compiler errors * Platform support * Update msvc build for Visual Studio 2019 v16.4 * Updates to appveyor config for VS2019 and Qt5.9.8 + msvc project fixes * bug-fix macos: give free bytes to F_PREALLOCATE * Miscellaneous * init: Stop indexes on shutdown after ChainStateFlushed callback * util: Add missing headers to util/fees.cpp * Unbreak build with Boost 1.72.0 * scripts: Fix symbol-check & security-check argument passing * Log to net category for exceptions in ProcessMessages * Update univalue subtree Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-72=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): bitcoin-qt5-0.21.2-bp153.2.3.1 bitcoin-test-0.21.2-bp153.2.3.1 bitcoin-utils-0.21.2-bp153.2.3.1 bitcoind-0.21.2-bp153.2.3.1 libbitcoinconsensus-devel-0.21.2-bp153.2.3.1 libbitcoinconsensus0-0.21.2-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-3195.html

1 0

openSUSE-SU-42022-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-42022-1 Rating: moderate References: #1038980 #1191962 #1191963 #1192153 #1192154 #1192696 #1195230 #1195682 Cross-References: CVE-2017-8923 CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVE-2022-22753 CVE-2022-22754 CVE-2022-22756 CVE-2022-22759 CVE-2022-22760 CVE-2022-22761 CVE-2022-22763 CVE-2022-22764 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 (bsc#1195682) - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during update - CVE-2022-22756: Drag and dropping an image could have resulted in the dropped object being an executable - CVE-2022-22759: Sandboxed iframes could have executed script if the parent appended elements - CVE-2022-22760: Cross-Origin responses could be distinguished between script and non-script content-types - CVE-2022-22761: frame-ancestors Content Security Policy directive was not enforced for framed extension pages - CVE-2022-22763: Script Execution during invalid object state - CVE-2022-22764: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6 Firefox Extended Support Release 91.5.1 ESR (bsc#1195230) - Fixed an issue that allowed unexpected data to be submitted in some of our search telemetry Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-696=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 openSUSE-SLE-15.3-2022-704=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.0-152.15.1 MozillaFirefox-branding-upstream-91.6.0-152.15.1 MozillaFirefox-debuginfo-91.6.0-152.15.1 MozillaFirefox-debugsource-91.6.0-152.15.1 MozillaFirefox-devel-91.6.0-152.15.1 MozillaFirefox-translations-common-91.6.0-152.15.1 MozillaFirefox-translations-other-91.6.0-152.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 - openSUSE Leap 15.3 (noarch): nodejs8-docs-8.17.0-10.19.2 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://www.suse.com/security/cve/CVE-2022-22753.html https://www.suse.com/security/cve/CVE-2022-22754.html https://www.suse.com/security/cve/CVE-2022-22756.html https://www.suse.com/security/cve/CVE-2022-22759.html https://www.suse.com/security/cve/CVE-2022-22760.html https://www.suse.com/security/cve/CVE-2022-22761.html https://www.suse.com/security/cve/CVE-2022-22763.html https://www.suse.com/security/cve/CVE-2022-22764.html https://bugzilla.suse.com/1038980 https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696 https://bugzilla.suse.com/1195230 https://bugzilla.suse.com/1195682

1 0

openSUSE-SU-42022-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-42022-1 Rating: moderate References: #1038980 #1195230 #1195682 Cross-References: CVE-2017-8923 CVE-2022-22753 CVE-2022-22754 CVE-2022-22756 CVE-2022-22759 CVE-2022-22760 CVE-2022-22761 CVE-2022-22763 CVE-2022-22764 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 (bsc#1195682) - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during update - CVE-2022-22756: Drag and dropping an image could have resulted in the dropped object being an executable - CVE-2022-22759: Sandboxed iframes could have executed script if the parent appended elements - CVE-2022-22760: Cross-Origin responses could be distinguished between script and non-script content-types - CVE-2022-22761: frame-ancestors Content Security Policy directive was not enforced for framed extension pages - CVE-2022-22763: Script Execution during invalid object state - CVE-2022-22764: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6 Firefox Extended Support Release 91.5.1 ESR (bsc#1195230) - Fixed an issue that allowed unexpected data to be submitted in some of our search telemetry Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-696=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.0-152.15.1 MozillaFirefox-branding-upstream-91.6.0-152.15.1 MozillaFirefox-debuginfo-91.6.0-152.15.1 MozillaFirefox-debugsource-91.6.0-152.15.1 MozillaFirefox-devel-91.6.0-152.15.1 MozillaFirefox-translations-common-91.6.0-152.15.1 MozillaFirefox-translations-other-91.6.0-152.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://www.suse.com/security/cve/CVE-2022-22753.html https://www.suse.com/security/cve/CVE-2022-22754.html https://www.suse.com/security/cve/CVE-2022-22756.html https://www.suse.com/security/cve/CVE-2022-22759.html https://www.suse.com/security/cve/CVE-2022-22760.html https://www.suse.com/security/cve/CVE-2022-22761.html https://www.suse.com/security/cve/CVE-2022-22763.html https://www.suse.com/security/cve/CVE-2022-22764.html https://bugzilla.suse.com/1038980 https://bugzilla.suse.com/1195230 https://bugzilla.suse.com/1195682

1 0

openSUSE-SU-42022-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-42022-1 Rating: moderate References: #1038980 Cross-References: CVE-2017-8923 CVSS scores: CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php7 fixes the following issues: - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-699=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-3.32.1 apache2-mod_php7-debuginfo-7.4.6-3.32.1 php7-7.4.6-3.32.1 php7-bcmath-7.4.6-3.32.1 php7-bcmath-debuginfo-7.4.6-3.32.1 php7-bz2-7.4.6-3.32.1 php7-bz2-debuginfo-7.4.6-3.32.1 php7-calendar-7.4.6-3.32.1 php7-calendar-debuginfo-7.4.6-3.32.1 php7-ctype-7.4.6-3.32.1 php7-ctype-debuginfo-7.4.6-3.32.1 php7-curl-7.4.6-3.32.1 php7-curl-debuginfo-7.4.6-3.32.1 php7-dba-7.4.6-3.32.1 php7-dba-debuginfo-7.4.6-3.32.1 php7-debuginfo-7.4.6-3.32.1 php7-debugsource-7.4.6-3.32.1 php7-devel-7.4.6-3.32.1 php7-dom-7.4.6-3.32.1 php7-dom-debuginfo-7.4.6-3.32.1 php7-embed-7.4.6-3.32.1 php7-embed-debuginfo-7.4.6-3.32.1 php7-enchant-7.4.6-3.32.1 php7-enchant-debuginfo-7.4.6-3.32.1 php7-exif-7.4.6-3.32.1 php7-exif-debuginfo-7.4.6-3.32.1 php7-fastcgi-7.4.6-3.32.1 php7-fastcgi-debuginfo-7.4.6-3.32.1 php7-fileinfo-7.4.6-3.32.1 php7-fileinfo-debuginfo-7.4.6-3.32.1 php7-firebird-7.4.6-3.32.1 php7-firebird-debuginfo-7.4.6-3.32.1 php7-fpm-7.4.6-3.32.1 php7-fpm-debuginfo-7.4.6-3.32.1 php7-ftp-7.4.6-3.32.1 php7-ftp-debuginfo-7.4.6-3.32.1 php7-gd-7.4.6-3.32.1 php7-gd-debuginfo-7.4.6-3.32.1 php7-gettext-7.4.6-3.32.1 php7-gettext-debuginfo-7.4.6-3.32.1 php7-gmp-7.4.6-3.32.1 php7-gmp-debuginfo-7.4.6-3.32.1 php7-iconv-7.4.6-3.32.1 php7-iconv-debuginfo-7.4.6-3.32.1 php7-intl-7.4.6-3.32.1 php7-intl-debuginfo-7.4.6-3.32.1 php7-json-7.4.6-3.32.1 php7-json-debuginfo-7.4.6-3.32.1 php7-ldap-7.4.6-3.32.1 php7-ldap-debuginfo-7.4.6-3.32.1 php7-mbstring-7.4.6-3.32.1 php7-mbstring-debuginfo-7.4.6-3.32.1 php7-mysql-7.4.6-3.32.1 php7-mysql-debuginfo-7.4.6-3.32.1 php7-odbc-7.4.6-3.32.1 php7-odbc-debuginfo-7.4.6-3.32.1 php7-opcache-7.4.6-3.32.1 php7-opcache-debuginfo-7.4.6-3.32.1 php7-openssl-7.4.6-3.32.1 php7-openssl-debuginfo-7.4.6-3.32.1 php7-pcntl-7.4.6-3.32.1 php7-pcntl-debuginfo-7.4.6-3.32.1 php7-pdo-7.4.6-3.32.1 php7-pdo-debuginfo-7.4.6-3.32.1 php7-pgsql-7.4.6-3.32.1 php7-pgsql-debuginfo-7.4.6-3.32.1 php7-phar-7.4.6-3.32.1 php7-phar-debuginfo-7.4.6-3.32.1 php7-posix-7.4.6-3.32.1 php7-posix-debuginfo-7.4.6-3.32.1 php7-readline-7.4.6-3.32.1 php7-readline-debuginfo-7.4.6-3.32.1 php7-shmop-7.4.6-3.32.1 php7-shmop-debuginfo-7.4.6-3.32.1 php7-snmp-7.4.6-3.32.1 php7-snmp-debuginfo-7.4.6-3.32.1 php7-soap-7.4.6-3.32.1 php7-soap-debuginfo-7.4.6-3.32.1 php7-sockets-7.4.6-3.32.1 php7-sockets-debuginfo-7.4.6-3.32.1 php7-sodium-7.4.6-3.32.1 php7-sodium-debuginfo-7.4.6-3.32.1 php7-sqlite-7.4.6-3.32.1 php7-sqlite-debuginfo-7.4.6-3.32.1 php7-sysvmsg-7.4.6-3.32.1 php7-sysvmsg-debuginfo-7.4.6-3.32.1 php7-sysvsem-7.4.6-3.32.1 php7-sysvsem-debuginfo-7.4.6-3.32.1 php7-sysvshm-7.4.6-3.32.1 php7-sysvshm-debuginfo-7.4.6-3.32.1 php7-test-7.4.6-3.32.1 php7-tidy-7.4.6-3.32.1 php7-tidy-debuginfo-7.4.6-3.32.1 php7-tokenizer-7.4.6-3.32.1 php7-tokenizer-debuginfo-7.4.6-3.32.1 php7-xmlreader-7.4.6-3.32.1 php7-xmlreader-debuginfo-7.4.6-3.32.1 php7-xmlrpc-7.4.6-3.32.1 php7-xmlrpc-debuginfo-7.4.6-3.32.1 php7-xmlwriter-7.4.6-3.32.1 php7-xmlwriter-debuginfo-7.4.6-3.32.1 php7-xsl-7.4.6-3.32.1 php7-xsl-debuginfo-7.4.6-3.32.1 php7-zip-7.4.6-3.32.1 php7-zip-debuginfo-7.4.6-3.32.1 php7-zlib-7.4.6-3.32.1 php7-zlib-debuginfo-7.4.6-3.32.1 References: https://www.suse.com/security/cve/CVE-2017-8923.html https://bugzilla.suse.com/1038980

1 0

openSUSE-SU-2022:0070-1: important: Security update for nodejs-electron
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for nodejs-electron ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0070-1 Rating: important References: Cross-References: CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 CVE-2021-37981 CVE-2021-37984 CVE-2021-37987 CVE-2021-37989 CVE-2021-37992 CVE-2021-37996 CVE-2021-37998 CVE-2021-38001 CVE-2021-38002 CVE-2021-38003 CVSS scores: CVE-2021-30625 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30626 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30627 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30628 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30630 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-30632 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30633 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-37981 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-37984 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-37987 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-37989 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-37992 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-37996 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-37998 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38001 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38002 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-38003 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for nodejs-electron fixes the following issues: - Fix webpack-4 with OpenSSL 3.0 Update to version 16.0.9 * https://github.com/electron/electron/releases/tag/v16.0.9 Update to version 16.0.8 * https://github.com/electron/electron/releases/tag/v16.0.8 - Add devel package with node headers (e.g. for node-gyp) - Update to version 16.0.7 * https://github.com/electron/electron/releases/tag/v16.0.7 - Update to version 15.3.3 * https://github.com/electron/electron/releases/tag/v15.3.3 - Update to version 13.6.3 https://github.com/electron/electron/releases/tag/v13.6.3 - Update to version 13.6.2 https://github.com/electron/electron/releases/tag/v13.6.2 - Fix for CVE-2021-37998 - Fix for CVE-2021-38001 - Fix for CVE-2021-38002 - Fix for CVE-2021-38003 - Do not build with H264 - Update to version 13.6.1 https://github.com/electron/electron/releases/tag/v13.6.1 - Fix for CVE-2021-37981 - Fix for CVE-2021-37984 - Fix for CVE-2021-37987 - Fix for CVE-2021-37989 - Fix for CVE-2021-37992 - Fix for CVE-2021-37996 - Update to version 13.5.1 https://github.com/electron/electron/releases/tag/v13.5.1 - Update to version 13.5.0 https://github.com/electron/electron/releases/tag/v13.5.0 - Fix for CVE-2021-30627 - Fix for CVE-2021-30631 - Fix for CVE-2021-30632 - Fix for CVE-2021-30625 - Fix for CVE-2021-30626 - Fix for CVE-2021-30628 - Fix for CVE-2021-30630 - Fix for CVE-2021-30633 - Version 13.4.0 - Update to version 13.1.8 * https://github.com/electron/electron/releases/tag/v13.1.8 - Update to version 13.1.7 * https://github.com/electron/electron/releases/tag/v13.1.7 - Update to version 13.1.6 * https://github.com/electron/electron/releases/tag/v13.1.6 * https://github.com/electron/electron/releases/tag/v13.1.5 - Update to version 13.1.4 * https://github.com/electron/electron/releases/tag/v13.1.4 * https://github.com/electron/electron/releases/tag/v13.1.3 - Build with vaapi support - Install missing vk_swiftshader_icd.json - Update to version 13.1.2 * https://github.com/electron/electron/releases/tag/v13.1.2 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-70=1 Package List: - openSUSE Backports SLE-15-SP3 (x86_64): nodejs-electron-16.0.9-bp153.2.1 nodejs-electron-devel-16.0.9-bp153.2.1 References: https://www.suse.com/security/cve/CVE-2021-30625.html https://www.suse.com/security/cve/CVE-2021-30626.html https://www.suse.com/security/cve/CVE-2021-30627.html https://www.suse.com/security/cve/CVE-2021-30628.html https://www.suse.com/security/cve/CVE-2021-30630.html https://www.suse.com/security/cve/CVE-2021-30631.html https://www.suse.com/security/cve/CVE-2021-30632.html https://www.suse.com/security/cve/CVE-2021-30633.html https://www.suse.com/security/cve/CVE-2021-37981.html https://www.suse.com/security/cve/CVE-2021-37984.html https://www.suse.com/security/cve/CVE-2021-37987.html https://www.suse.com/security/cve/CVE-2021-37989.html https://www.suse.com/security/cve/CVE-2021-37992.html https://www.suse.com/security/cve/CVE-2021-37996.html https://www.suse.com/security/cve/CVE-2021-37998.html https://www.suse.com/security/cve/CVE-2021-38001.html https://www.suse.com/security/cve/CVE-2021-38002.html https://www.suse.com/security/cve/CVE-2021-38003.html

1 0

openSUSE-SU-2022:0068-1: important: Security update for shapelib
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for shapelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0068-1 Rating: important References: #1196236 Cross-References: CVE-2022-0699 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shapelib fixes the following issues: - CVE-2022-0699: Fixed a Double-free vulnerability in contrib/shpsort.c Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-68=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libshp-devel-1.5.0-bp153.2.3.1 libshp2-1.5.0-bp153.2.3.1 shapelib-1.5.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-0699.html https://bugzilla.suse.com/1196236

1 0

openSUSE-SU-2022:0067-1: important: Security update for libdxfrw, librecad
by opensuse-security＠opensuse.org 03 Mar '22

03 Mar '22

openSUSE Security Update: Security update for libdxfrw, librecad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0067-1 Rating: important References: #1192936 #1192937 #1192938 Cross-References: CVE-2021-21898 CVE-2021-21899 CVE-2021-21900 CVSS scores: CVE-2021-21898 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21899 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21900 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libdxfrw, librecad fixes the following issues: - Update to version 1.0.1+git.20220109: * fixed ambiguous error for DRW_Dimension::parseDwg() * fixed enless while()-loop for pre 2004 versions * dwgReader::readDwgObjects() stop reading after 1st error * dwgReader::readDwgEntities() stop reading after 1st error * replace ENTRY_PARSE macro with template method * remove unused DRW_Class::parseCode() method * protect vector<>.reserve() calls * Added NULL check for hatch code 93 * Fix bounds check in DRW_LWPolyline * fix, check maxClassNum for valid value * fixed wrong 2010+ check for 64-bit size * Set compiler warnings on by default, because makes harder for bugs to go undetected. modified: CMakeLists.txt * Fixed fall through and other warnings (#54) * fix "Vertex ID" printout - Update to version 1.0.1+git.20211110: * fixed heap use after free vulnerability CVE-2021-21900 (boo#1192938) * minor improvements to dwg2dxf, formatting and message output on success * fixed heap buffer overflow vulnerability CVE-2021-21899 (boo#1192937) * dwg2dxf - enable debug output of libdxfrw by command line switch * fixed out-of-bounds write vulnerability CVE-2021-21898 (boo#1192936) * fixed please note section formatting * updated README.md for LibreCAD_3 branch and sf.net successor * fixed LibreCAD 2 issue #1371, read failed with binary DXF * Use ununordered_map instead of map * manual merge changes from LibreCAD2 * and much more - Update to version 1.0.1+git.20200429: * Fix includes install dir * Export target as libdxfrw::libdxfrw to keep consistency with Conan packages * Add archive destination in install * Install DXFRW::dxfrw target * Remove duplicate target properties * Remove version from pkg-config file * Let CMake handle C++11 compiler definition * Change minimal required CMake version to 3.0 * cmake: add doc target * README.md: fix typo * cmake: generate and install pkgconfig * cmake: add one for dwg2dxf * cmake: set library VERSIONs * cmake: use GNUInstallDirs - Update to version 0.6.3+git.20190501: * Add build status and update example link * Add Travis-CI script * [#10] Fix compilation on GCC * Fix bugs with .dwg import of TEXT and MTEXT entities * This was unnecessary * Link libdxfrw against libstdc++ * Return an error when the file ends prematurely * Add version getter * Fix polyline 2d/3d write * Initialize return buffers in GetRawChar8 et al. - update to 2.2.0-rc3 * major release * DWG imports are more reliable now * and a lot more of bugfixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-67=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libdxfrw-devel-1.0.1+git.20220109-bp153.2.3.1 libdxfrw-tools-1.0.1+git.20220109-bp153.2.3.1 libdxfrw1-1.0.1+git.20220109-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): librecad-2.2.0~rc3-bp153.2.3.1 librecad-debuginfo-2.2.0~rc3-bp153.2.3.1 librecad-debugsource-2.2.0~rc3-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): librecad-parts-2.2.0~rc3-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21898.html https://www.suse.com/security/cve/CVE-2021-21899.html https://www.suse.com/security/cve/CVE-2021-21900.html https://bugzilla.suse.com/1192936 https://bugzilla.suse.com/1192937 https://bugzilla.suse.com/1192938

1 0

openSUSE-SU-2022:0675-1: moderate: Security update for ldns
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for ldns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0675-1 Rating: moderate References: #1195057 #1195058 Cross-References: CVE-2020-19860 CVE-2020-19861 CVSS scores: CVE-2020-19860 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2020-19860 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2020-19861 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ldns fixes the following issues: - CVE-2020-19860: Fixed heap-based out of bounds read when verifying a zone file (bsc#1195057). - CVE-2020-19861: Fixed heap-based out of bounds read in ldns_nsec3_salt_data() (bsc#1195058). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-675=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-675=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ldns-1.7.0-4.6.1 ldns-debuginfo-1.7.0-4.6.1 ldns-debugsource-1.7.0-4.6.1 ldns-devel-1.7.0-4.6.1 libldns2-1.7.0-4.6.1 libldns2-debuginfo-1.7.0-4.6.1 perl-DNS-LDNS-1.7.0-4.6.1 perl-DNS-LDNS-debuginfo-1.7.0-4.6.1 python3-ldns-1.7.0-4.6.1 python3-ldns-debuginfo-1.7.0-4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ldns-1.7.0-4.6.1 ldns-debuginfo-1.7.0-4.6.1 ldns-debugsource-1.7.0-4.6.1 ldns-devel-1.7.0-4.6.1 libldns2-1.7.0-4.6.1 libldns2-debuginfo-1.7.0-4.6.1 perl-DNS-LDNS-1.7.0-4.6.1 perl-DNS-LDNS-debuginfo-1.7.0-4.6.1 python3-ldns-1.7.0-4.6.1 python3-ldns-debuginfo-1.7.0-4.6.1 References: https://www.suse.com/security/cve/CVE-2020-19860.html https://www.suse.com/security/cve/CVE-2020-19861.html https://bugzilla.suse.com/1195057 https://bugzilla.suse.com/1195058

1 0

openSUSE-SU-2022:0679-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0679-1 Rating: moderate References: #1038980 #1081790 #1192050 #1193041 Cross-References: CVE-2015-9253 CVE-2017-8923 CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2015-9253 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2015-9253 (SUSE): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-8923 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-8923 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-21707 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-21707 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050). - CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041). - CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980). - CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-679=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): php7-wddx-7.2.5-4.89.4 php7-wddx-debuginfo-7.2.5-4.89.4 References: https://www.suse.com/security/cve/CVE-2015-9253.html https://www.suse.com/security/cve/CVE-2017-8923.html https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2021-21707.html https://bugzilla.suse.com/1038980 https://bugzilla.suse.com/1081790 https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1193041

1 0

openSUSE-SU-2022:0065-1: important: Security update for envoy-proxy
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for envoy-proxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0065-1 Rating: important References: #1167073 #1173559 #1180121 Cross-References: CVE-2020-12603 CVE-2020-12604 CVE-2020-12605 CVE-2020-35471 CVE-2020-8663 CVSS scores: CVE-2020-12603 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-12604 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-12605 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-35471 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-35471 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for envoy-proxy fixes the following issues: Update to 1.14.6: - CVE-2020-35471: Fixed a denial of service via dropped and truncated UDP datagrams (boo#1180121). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-65=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le x86_64): envoy-proxy-1.14.6-bp153.3.4.1 envoy-proxy-source-1.14.6-bp153.3.4.1 References: https://www.suse.com/security/cve/CVE-2020-12603.html https://www.suse.com/security/cve/CVE-2020-12604.html https://www.suse.com/security/cve/CVE-2020-12605.html https://www.suse.com/security/cve/CVE-2020-35471.html https://www.suse.com/security/cve/CVE-2020-8663.html https://bugzilla.suse.com/1167073 https://bugzilla.suse.com/1173559 https://bugzilla.suse.com/1180121

1 0

openSUSE-SU-2022:0658-1: moderate: Security update for mysql-connector-java
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for mysql-connector-java ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0658-1 Rating: moderate References: #1195557 PM-3307 Cross-References: CVE-2021-2471 CVSS scores: CVE-2021-2471 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H CVE-2021-2471 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for mysql-connector-java fixes the following issues: - CVE-2021-2471: Fixed unauthorized access to critical data or complete access to all MySQL Connectors (bsc#1195557). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-658=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-658=1 Package List: - openSUSE Leap 15.4 (noarch): mysql-connector-java-5.1.47-3.6.1 - openSUSE Leap 15.3 (noarch): mysql-connector-java-5.1.47-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-2471.html https://bugzilla.suse.com/1195557

1 0

openSUSE-SU-2022:0657-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 02 Mar '22

02 Mar '22

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0657-1 Rating: important References: #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-657=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-657=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.10-4.29.3 nodejs12-debuginfo-12.22.10-4.29.3 nodejs12-debugsource-12.22.10-4.29.3 nodejs12-devel-12.22.10-4.29.3 npm12-12.22.10-4.29.3 - openSUSE Leap 15.4 (noarch): nodejs12-docs-12.22.10-4.29.3 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.10-4.29.3 nodejs12-debuginfo-12.22.10-4.29.3 nodejs12-debugsource-12.22.10-4.29.3 nodejs12-devel-12.22.10-4.29.3 npm12-12.22.10-4.29.3 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.10-4.29.3 References: https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696

1 0