openSUSE Security Announce

Download

security-announce@lists.opensuse.org

May 2022

1 participants
77 discussions

SUSE-SU-2022:1484-1: important: Security update for git
by opensuse-security＠opensuse.org 02 May '22

02 May '22

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1484-1 Rating: important References: #1181400 #1198234 Cross-References: CVE-2022-24765 CVSS scores: CVE-2022-24765 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24765 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for git fixes the following issues: - Updated to version 2.35.3: - CVE-2022-24765: Fixed a potential command injection via git worktree (bsc#1198234). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1484=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1484=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-1484=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1484=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1484=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1484=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.12.1 git-arch-2.35.3-150300.10.12.1 git-core-2.35.3-150300.10.12.1 git-core-debuginfo-2.35.3-150300.10.12.1 git-credential-gnome-keyring-2.35.3-150300.10.12.1 git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.12.1 git-credential-libsecret-2.35.3-150300.10.12.1 git-credential-libsecret-debuginfo-2.35.3-150300.10.12.1 git-cvs-2.35.3-150300.10.12.1 git-daemon-2.35.3-150300.10.12.1 git-daemon-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 git-email-2.35.3-150300.10.12.1 git-gui-2.35.3-150300.10.12.1 git-p4-2.35.3-150300.10.12.1 git-svn-2.35.3-150300.10.12.1 git-web-2.35.3-150300.10.12.1 gitk-2.35.3-150300.10.12.1 perl-Git-2.35.3-150300.10.12.1 - openSUSE Leap 15.4 (noarch): git-doc-2.35.3-150300.10.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.12.1 git-arch-2.35.3-150300.10.12.1 git-core-2.35.3-150300.10.12.1 git-core-debuginfo-2.35.3-150300.10.12.1 git-credential-gnome-keyring-2.35.3-150300.10.12.1 git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.12.1 git-credential-libsecret-2.35.3-150300.10.12.1 git-credential-libsecret-debuginfo-2.35.3-150300.10.12.1 git-cvs-2.35.3-150300.10.12.1 git-daemon-2.35.3-150300.10.12.1 git-daemon-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 git-email-2.35.3-150300.10.12.1 git-gui-2.35.3-150300.10.12.1 git-p4-2.35.3-150300.10.12.1 git-svn-2.35.3-150300.10.12.1 git-web-2.35.3-150300.10.12.1 gitk-2.35.3-150300.10.12.1 perl-Git-2.35.3-150300.10.12.1 - openSUSE Leap 15.3 (noarch): git-doc-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.12.1 git-arch-2.35.3-150300.10.12.1 git-cvs-2.35.3-150300.10.12.1 git-daemon-2.35.3-150300.10.12.1 git-daemon-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 git-email-2.35.3-150300.10.12.1 git-gui-2.35.3-150300.10.12.1 git-svn-2.35.3-150300.10.12.1 git-web-2.35.3-150300.10.12.1 gitk-2.35.3-150300.10.12.1 perl-Git-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): git-doc-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.12.1 git-arch-2.35.3-150300.10.12.1 git-cvs-2.35.3-150300.10.12.1 git-daemon-2.35.3-150300.10.12.1 git-daemon-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 git-email-2.35.3-150300.10.12.1 git-gui-2.35.3-150300.10.12.1 git-svn-2.35.3-150300.10.12.1 git-web-2.35.3-150300.10.12.1 gitk-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): git-doc-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): git-core-2.35.3-150300.10.12.1 git-core-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): git-core-2.35.3-150300.10.12.1 git-core-debuginfo-2.35.3-150300.10.12.1 git-debuginfo-2.35.3-150300.10.12.1 git-debugsource-2.35.3-150300.10.12.1 perl-Git-2.35.3-150300.10.12.1 References: https://www.suse.com/security/cve/CVE-2022-24765.html https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1198234

1 0

openSUSE-SU-2022:0123-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 May '22

01 May '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0123-1 Rating: important References: Cross-References: CVE-2022-1364 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: Update to 86.0.4363.23: - CHR-8843 Update chromium on desktop-stable-100-4363 to 100.0.4896.127 - DNA-98236 Turn on #snap-text-selection on all streams - DNA-98507 DCHECK at address_bar_controller.cc(547) - DNA-98528 Suggestions for internal pages disappear when typing their full name - DNA-98538 Change name of "Opera Crypto Wallet" to "Crypto Wallet" - DNA-98540 Booking.com used instead of custom search engine - DNA-98587 Favicon of booking suggestion in the city category is unexpectedly changing - DNA-98605 City suggestions should show URL in address field when selected - DNA-98608 #address-bar-dropdown-categories expired - DNA-98616 Add recent searches to 'old' BABE - DNA-98668 Switch to tab button leads to wrong tab - DNA-98673 Improve suggestion removal handling in suggestion providers - DNA-98681 Remove unused suggestion consumers - DNA-98684 Have a dedicated SuggestionList for the new address bar dropdown - DNA-98685 Enable #native-crypto-wallet on developer - DNA-98688 "Disable this feature" mini-menu settings is non-intuitive - DNA-98690 Autocompleted text stayed in address field after removing suggestion - DNA-98738 Inline autocomplete suggestion for SD disappears after typing 3rd letter of SD name - DNA-98743 Blank dropdown after pressing space key - DNA-98783 Improve showing suggestions with long URLs or page titles - DNA-98785 "Switch to tab" button not shown for suggestions with www subdomain when typing domain text - DNA-98879 "Disable suggestions before typing" mini-menu option should change to "Enable suggestions before typing" when being selected - DNA-98917 Translations for O86 - DNA-98975 Turn on #snap-crop-tool on all channels - DNA-98980 Enable #native-crypto-wallet on all streams - DNA-99005 The sidebar item is not visible for already active crypto wallet users when #native-crypto-wallet flag is enabled. - DNA-99007 Crash at TemplateURLRef::ParseIfNecessary(SearchTermsData const&) const - DNA-99047 Promote O86 to stable - The update to chromium 100.0.4896.127 fixes following issues: CVE-2022-1364 - Complete Opera 86.0 changelog at: https://blogs.opera.com/desktop/changelog-for-86/ Update to 85.0.4341.60: - DNA-98666 Set baidu as default search engine in China - DNA-98707 Hint is not displayed for new crypto wallet sidebar icon - DNA-98775 RichHintsSearchEngineCondition.testSogouSearchEngine errors Update to 85.0.4341.47: - DNA-98249 Add feature flag #native-crypto-wallet - DNA-98250 Install extension on startup - DNA-98251 Make Crypto Wallet setting enable / disable extension - DNA-98252 Deactivate old desktop crypto wallet - DNA-98253 Always show ��Crypto Wallet�� in Sidebar Setup - DNA-98497 Crash when installing extension - DNA-98506 Enable opera_feature_crypto_wallet_encryption on desktop - DNA-98510 Blank icon in sidebar setup - DNA-98538 Change name of "Opera Crypto Wallet" to "Crypto Wallet" - DNA-98685 Enable #native-crypto-wallet on developer - DNA-98766 Crash at opera::AddressBarControllerImpl::OpenNativeDropdown() - DNA-98768 Crash at extensions::ContentFilterPrivateIsWhitelistedFunction::Run() - DNA-98770 Recent searches stay in address field after selecting entry from dropdown - DNA-98772 Screen sharing broken - DNA-98803 Autofilled part appended after selecting address bar using shortcut Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2022-123=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-86.0.4363.23-lp153.2.45.1 References: https://www.suse.com/security/cve/CVE-2022-1364.html

1 0