openSUSE Security Update: Security update for minetest ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0001-1 Rating: important References: #1181400 #1193141 #1202423 Cross-References: CVE-2022-35978 CVSS scores: CVE-2022-35978 (NVD) : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for minetest fixes the following issues: Update to version 5.6.0 * Fix CVE-2022-35978 ( boo#1202423 ): Mod scripts can escape sandbox in single player mode * `name` in game.conf is deprecated for the game title, use `title` instead * Add depth sorting for node faces * Various bug fixes * Full changes: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0 - Introduced mbranch-protection=none CXX flag to resolve boo#1193141 (aarch64). Update to version 5.5.0 & 5.5.1: * Full log for version 5.5.0: https://dev.minetest.net/Changelog#5.4.0_.E2.86.92_5.5.0 * This release switches from Irrlicht to our own fork called IrrlichtMt. * Full log for version 5.5.1: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.5.1 * This is a maintenance release based on 5.5.0, it contains bugfixes but no new features. - Added hardening to systemd service(s) (boo#1181400). - Update to version 5.4.1: * This is a maintenance release based on 5.4.0, it contains bugfixes but no new features. - Update to version 5.4.0 * Full log: https://dev.minetest.net/Changelog#5.3.0_.E2.86.92_5.4.0 * Removed support for bumpmapping, generated normal maps and parallax occlusion * By default, the crosshair will now change to an "X" when pointing to objects * Prevent players accessing inventories of other players * Prevent interacting with items out of the hotbar * Prevent players from being able to modify ItemStack meta - Update to version 5.3.0. (see https://dev.minetest.net/Changelog#5.2.0_.E2.86.92_5.3.0) * Formspec improvements, including a scrolling GUI element * Performance improvements to the Server and API * Many bug fixes and small features - Now requires desktop-file-utils version >= 0.25. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-1=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2023-1=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): minetest-5.6.0-bp154.2.3.5 minetest-debuginfo-5.6.0-bp154.2.3.5 minetest-debugsource-5.6.0-bp154.2.3.5 minetestserver-5.6.0-bp154.2.3.5 minetestserver-debuginfo-5.6.0-bp154.2.3.5 - openSUSE Backports SLE-15-SP4 (noarch): minetest-data-5.6.0-bp154.2.3.5 minetest-lang-5.6.0-bp154.2.3.5 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): minetest-5.6.0-bp153.2.3.1 minetestserver-5.6.0-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): minetest-data-5.6.0-bp153.2.3.1 minetest-lang-5.6.0-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-35978.html https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1193141 https://bugzilla.suse.com/1202423