March 2022 - openSUSE Security Announce

openSUSE-SU-2022:0815-1: moderate: Security update for flac
by opensuse-security＠opensuse.org 14 Mar '22

14 Mar '22

openSUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0815-1 Rating: moderate References: #1196660 Cross-References: CVE-2021-0561 CVSS scores: CVE-2021-0561 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0561 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flac fixes the following issues: - CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-815=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-815=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): flac-1.3.2-3.9.1 flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.4 (x86_64): flac-devel-32bit-1.3.2-3.9.1 libFLAC++6-32bit-1.3.2-3.9.1 libFLAC++6-32bit-debuginfo-1.3.2-3.9.1 libFLAC8-32bit-1.3.2-3.9.1 libFLAC8-32bit-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.4 (noarch): flac-doc-1.3.2-3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): flac-1.3.2-3.9.1 flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.3 (x86_64): flac-devel-32bit-1.3.2-3.9.1 libFLAC++6-32bit-1.3.2-3.9.1 libFLAC++6-32bit-debuginfo-1.3.2-3.9.1 libFLAC8-32bit-1.3.2-3.9.1 libFLAC8-32bit-debuginfo-1.3.2-3.9.1 - openSUSE Leap 15.3 (noarch): flac-doc-1.3.2-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0561.html https://bugzilla.suse.com/1196660

1 0

openSUSE-SU-2022:0079-1: moderate: Security update for minidlna
by opensuse-security＠opensuse.org 11 Mar '22

11 Mar '22

openSUSE Security Update: Security update for minidlna ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0079-1 Rating: moderate References: #1181400 #1196814 Cross-References: CVE-2022-26505 CVSS scores: CVE-2022-26505 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for minidlna fixes the following issues: minidlna was updated to version 1.3.1 (boo#1196814) - Fixed a potential crash in SSDP request parsing. - Fixed a configure script failure on some platforms. - Protect against DNS rebinding attacks. (CVE-2022-26505) - Fix an socket leakage issue on some platforms. - Minor bug fixes. - add "su minidlna minidlna" to the logrotate config - Added hardening to systemd service(s) (boo#1181400). - Use sysusers macros to create minidlna user - Don't hardrequire logrotate, we don't write log files anymore Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-79=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): minidlna-1.3.1-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-26505.html https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1196814

1 0

openSUSE-SU-2022:0802-1: important: Security update for python-libxml2-python
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for python-libxml2-python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0802-1 Rating: important References: #1196490 Cross-References: CVE-2022-23308 CVSS scores: CVE-2022-23308 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-23308 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-libxml2-python fixes the following issues: - CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-802=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-802=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-libxml2-python-debugsource-2.9.7-3.40.1 python2-libxml2-python-2.9.7-3.40.1 python2-libxml2-python-debuginfo-2.9.7-3.40.1 python3-libxml2-python-2.9.7-3.40.1 python3-libxml2-python-debuginfo-2.9.7-3.40.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-libxml2-python-debugsource-2.9.7-3.40.1 python2-libxml2-python-2.9.7-3.40.1 python2-libxml2-python-debuginfo-2.9.7-3.40.1 python3-libxml2-python-2.9.7-3.40.1 python3-libxml2-python-debuginfo-2.9.7-3.40.1 References: https://www.suse.com/security/cve/CVE-2022-23308.html https://bugzilla.suse.com/1196490

1 0

openSUSE-SU-2022:0803-1: important: Security update for python-lxml
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for python-lxml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0803-1 Rating: important References: #1118088 #1179534 #1184177 #1193752 Cross-References: CVE-2018-19787 CVE-2020-27783 CVE-2021-28957 CVE-2021-43818 CVSS scores: CVE-2018-19787 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-19787 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2020-27783 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-27783 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-28957 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-28957 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43818 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-43818 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-lxml fixes the following issues: - CVE-2018-19787: Fixed XSS vulnerability via unescaped URL (bsc#1118088). - CVE-2021-28957: Fixed XSS vulnerability ia HTML5 attributes unescaped (bsc#1184177). - CVE-2021-43818: Fixed XSS vulnerability via script content in SVG images using data URIs (bnc#1193752). - CVE-2020-27783: Fixed mutation XSS with improper parser use (bnc#1179534). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-803=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-803=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-3.7.1 python-lxml-debugsource-4.7.1-3.7.1 python2-lxml-4.7.1-3.7.1 python2-lxml-debuginfo-4.7.1-3.7.1 python2-lxml-devel-4.7.1-3.7.1 python3-lxml-4.7.1-3.7.1 python3-lxml-debuginfo-4.7.1-3.7.1 python3-lxml-devel-4.7.1-3.7.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-lxml-debuginfo-4.7.1-3.7.1 python-lxml-debugsource-4.7.1-3.7.1 python2-lxml-4.7.1-3.7.1 python2-lxml-debuginfo-4.7.1-3.7.1 python2-lxml-devel-4.7.1-3.7.1 python3-lxml-4.7.1-3.7.1 python3-lxml-debuginfo-4.7.1-3.7.1 python3-lxml-devel-4.7.1-3.7.1 References: https://www.suse.com/security/cve/CVE-2018-19787.html https://www.suse.com/security/cve/CVE-2020-27783.html https://www.suse.com/security/cve/CVE-2021-28957.html https://www.suse.com/security/cve/CVE-2021-43818.html https://bugzilla.suse.com/1118088 https://bugzilla.suse.com/1179534 https://bugzilla.suse.com/1184177 https://bugzilla.suse.com/1193752

1 0

openSUSE-SU-2022:0804-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 10 Mar '22

10 Mar '22

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0804-1 Rating: important References: #1196809 Cross-References: CVE-2022-26485 CVE-2022-26486 CVSS scores: CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 91.6.2 (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-804=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-804=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.6.2-8.59.1 MozillaThunderbird-debuginfo-91.6.2-8.59.1 MozillaThunderbird-debugsource-91.6.2-8.59.1 MozillaThunderbird-translations-common-91.6.2-8.59.1 MozillaThunderbird-translations-other-91.6.2-8.59.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.6.2-8.59.1 MozillaThunderbird-debuginfo-91.6.2-8.59.1 MozillaThunderbird-debugsource-91.6.2-8.59.1 MozillaThunderbird-translations-common-91.6.2-8.59.1 MozillaThunderbird-translations-other-91.6.2-8.59.1 References: https://www.suse.com/security/cve/CVE-2022-26485.html https://www.suse.com/security/cve/CVE-2022-26486.html https://bugzilla.suse.com/1196809

1 0

openSUSE-SU-2022:0783-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0783-1 Rating: important References: #1196809 Cross-References: CVE-2022-26485 CVE-2022-26486 CVSS scores: CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.1 ESR (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-783=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-783=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.1-152.19.1 MozillaFirefox-branding-upstream-91.6.1-152.19.1 MozillaFirefox-debuginfo-91.6.1-152.19.1 MozillaFirefox-debugsource-91.6.1-152.19.1 MozillaFirefox-devel-91.6.1-152.19.1 MozillaFirefox-translations-common-91.6.1-152.19.1 MozillaFirefox-translations-other-91.6.1-152.19.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.6.1-152.19.1 MozillaFirefox-branding-upstream-91.6.1-152.19.1 MozillaFirefox-debuginfo-91.6.1-152.19.1 MozillaFirefox-debugsource-91.6.1-152.19.1 MozillaFirefox-devel-91.6.1-152.19.1 MozillaFirefox-translations-common-91.6.1-152.19.1 MozillaFirefox-translations-other-91.6.1-152.19.1 References: https://www.suse.com/security/cve/CVE-2022-26485.html https://www.suse.com/security/cve/CVE-2022-26486.html https://bugzilla.suse.com/1196809

1 0

openSUSE-SU-2022:0769-1: important: Security update for libcaca
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for libcaca ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0769-1 Rating: important References: #1184751 #1184752 Cross-References: CVE-2021-30498 CVE-2021-30499 CVSS scores: CVE-2021-30498 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30498 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30499 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30499 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libcaca fixes the following issues: - CVE-2021-30498, CVE-2021-30499: If an image has a size of 0x0, when exporting, no data is written and space is allocated for the header only, not taking into account that sprintf appends a NUL byte (bsc#1184751, bsc#1184752). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-769=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-769=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-11.3.1 caca-utils-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca-debugsource-0.99.beta19.git20171003-11.3.1 libcaca-devel-0.99.beta19.git20171003-11.3.1 libcaca-ruby-0.99.beta19.git20171003-11.3.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-0.99.beta19.git20171003-11.3.1 libcaca0-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.4 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.4 (noarch): python3-caca-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-11.3.1 caca-utils-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca-debugsource-0.99.beta19.git20171003-11.3.1 libcaca-devel-0.99.beta19.git20171003-11.3.1 libcaca-ruby-0.99.beta19.git20171003-11.3.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-0.99.beta19.git20171003-11.3.1 libcaca0-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-11.3.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-11.3.1 - openSUSE Leap 15.3 (noarch): python3-caca-0.99.beta19.git20171003-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-30498.html https://www.suse.com/security/cve/CVE-2021-30499.html https://bugzilla.suse.com/1184751 https://bugzilla.suse.com/1184752

1 0

openSUSE-SU-2022:0774-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0774-1 Rating: moderate References: #1195825 Cross-References: CVE-2018-16301 CVSS scores: CVE-2018-16301 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tcpdump fixes the following issues: - CVE-2018-16301: Fixed segfault when handling large files (bsc#1195825). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-774=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): tcpdump-4.9.2-3.18.1 tcpdump-debuginfo-4.9.2-3.18.1 tcpdump-debugsource-4.9.2-3.18.1 References: https://www.suse.com/security/cve/CVE-2018-16301.html https://bugzilla.suse.com/1195825

1 0

openSUSE-SU-2022:0770-1: moderate: Security update for buildah
by opensuse-security＠opensuse.org 09 Mar '22

09 Mar '22

openSUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0770-1 Rating: moderate References: #1187812 #1192999 SLE-23503 Cross-References: CVE-2019-10214 CVE-2020-10696 CVE-2021-20206 CVSS scores: CVE-2019-10214 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-10214 (SUSE): 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-20206 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20206 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities, contains one feature is now available. Description: This update for buildah fixes the following issues: buildah was updated to version 1.23.1: Update to version 1.22.3: * Update dependencies * Post-branch commit * Accept repositories on login/logout Update to version 1.22.0: * c/image, c/storage, c/common vendor before Podman 3.3 release * Proposed patch for 3399 (shadowutils) * Fix handling of --restore shadow-utils * runtime-flag (debug) test: handle old & new runc * Allow dst and destination for target in secret mounts * Multi-arch: Always push updated version-tagged img * imagebuildah.stageExecutor.prepare(): remove pseudonym check * refine dangling filter * Chown with environment variables not set should fail * Just restore protections of shadow-utils * Remove specific kernel version number requirement from install.md * Multi-arch image workflow: Make steps generic * chroot: fix environment value leakage to intermediate processes * Update nix pin with `make nixpkgs` * buildah source - create and manage source images * Update cirrus-cron notification GH workflow * Reuse code from containers/common/pkg/parse * Cirrus: Freshen VM images * Fix excludes exception begining with / or ./ * Fix syntax for --manifest example * vendor containers/common@main * Cirrus: Drop dependence on fedora-minimal * Adjust conformance-test error-message regex * Workaround appearance of differing debug messages * Cirrus: Install docker from package cache * Switch rusagelogfile to use options.Out * Turn stdio back to blocking when command finishes * Add support for default network creation * Cirrus: Updates for master->main rename * Change references from master to main * Add `--env` and `--workingdir` flags to run command * [CI:DOCS] buildah bud: spelling --ignore-file requires parameter * [CI:DOCS] push/pull: clarify supported transports * Remove unused function arguments * Create mountOptions for mount command flags * Extract version command implementation to function * Add --json flags to `mount` and `version` commands * copier.Put(): set xattrs after ownership * buildah add/copy: spelling * buildah copy and buildah add should support .containerignore * Remove unused util.StartsWithValidTransport * Fix documentation of the --format option of buildah push * Don't use alltransports.ParseImageName with known transports * man pages: clarify `rmi` removes dangling parents * [CI:DOCS] Fix links to c/image master branch * imagebuildah: use the specified logger for logging preprocessing warnings * Fix copy into workdir for a single file * Fix docs links due to branch rename * Update nix pin with `make nixpkgs` * fix(docs): typo * Move to v1.22.0-dev * Fix handling of auth.json file while in a user namespace * Add rusage-logfile flag to optionally send rusage to a file * imagebuildah: redo step logging * Add volumes to make running buildah within a container easier * Add and use a "copy" helper instead of podman load/save * Bump github.com/containers/common from 0.38.4 to 0.39.0 * containerImageRef/containerImageSource: don't buffer uncompressed layers * containerImageRef(): squashed images have no parent images * Sync. workflow across skopeo, buildah, and podman * Bump github.com/containers/storage from 1.31.1 to 1.31.2 * Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95 * Bump to v1.21.1-dev [NO TESTS NEEDED] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-770=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): buildah-1.23.1-150300.8.3.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2021-20206.html https://bugzilla.suse.com/1187812 https://bugzilla.suse.com/1192999

1 0

openSUSE-SU-2022:0768-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 Mar '22

08 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0768-1 Rating: important References: #1185973 #1191580 #1194516 #1195536 #1195543 #1195612 #1195840 #1195897 #1195908 #1195949 #1195987 #1196079 #1196155 #1196584 #1196612 Cross-References: CVE-2021-44879 CVE-2022-0001 CVE-2022-0002 CVE-2022-0487 CVE-2022-0492 CVE-2022-0617 CVE-2022-0644 CVE-2022-24448 CVE-2022-24959 CVSS scores: CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0492 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has 6 fixes is now available. Description: The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. The following security bugs were fixed: - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). The following non-security bugs were fixed: - crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840). - lib/iov_iter: initialize "flags" in new pipe_buffer (bsc#1196584). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-768=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-768=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-4.12.14-197.108.1 kernel-vanilla-base-4.12.14-197.108.1 kernel-vanilla-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-debuginfo-4.12.14-197.108.1 kernel-vanilla-debugsource-4.12.14-197.108.1 kernel-vanilla-devel-4.12.14-197.108.1 kernel-vanilla-devel-debuginfo-4.12.14-197.108.1 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 - openSUSE Leap 15.4 (ppc64le x86_64): kernel-debug-base-4.12.14-197.108.1 kernel-debug-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.4 (x86_64): kernel-kvmsmall-base-4.12.14-197.108.1 kernel-kvmsmall-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.4 (s390x): kernel-default-man-4.12.14-197.108.1 kernel-zfcpdump-man-4.12.14-197.108.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-4.12.14-197.108.1 kernel-vanilla-base-4.12.14-197.108.1 kernel-vanilla-base-debuginfo-4.12.14-197.108.1 kernel-vanilla-debuginfo-4.12.14-197.108.1 kernel-vanilla-debugsource-4.12.14-197.108.1 kernel-vanilla-devel-4.12.14-197.108.1 kernel-vanilla-devel-debuginfo-4.12.14-197.108.1 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-197.108.1 kernel-debug-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-197.108.1 kernel-kvmsmall-base-debuginfo-4.12.14-197.108.1 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-197.108.1 kernel-zfcpdump-man-4.12.14-197.108.1 References: https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0492.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24959.html https://bugzilla.suse.com/1185973 https://bugzilla.suse.com/1191580 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1195536 https://bugzilla.suse.com/1195543 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195840 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195908 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196584 https://bugzilla.suse.com/1196612

1 0