March 2022 - openSUSE Security - openSUSE Mailing Lists

Re: Chrome and derivatives update -- CVE-2022-1096
by Marcus Meissner 28 Mar '22

28 Mar '22

On Mon, Mar 28, 2022 at 04:52:45PM +0200, Ben Greiner wrote: > Hi, > > Two days ago, google released a critical security fix for a vulnerability > presumably already exploited in the wild. > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1096 > https://www.forbes.com/sites/daveywinder/2022/03/26/google-confirms-emergen… > https://www.heise.de/news/Webbrowser-Notfallupdate-fuer-Google-Chrome-66384… > (German) > > Packages e.g. for chromium have been fixed in Factory and SLE Backports, but > the current snapshot of Tumbleweed still does not have it. > > https://bugzilla.opensuse.org/show_bug.cgi?id=1197552 > > Shouldn't there be some fasttrack through OpenQA in order to prevent such > delays? I also submitted it to openSUSE:Factory:Update now, which is our bypass project. Ciao, Marcus

1 0

Security Update for Polkit - openSUSE 15.2
by Jan-Reupke＠web.de 16 Mar '22

16 Mar '22

Hi, will there be a Security Update for polkit (pkexec) CVE-2021-4034 for openSUSE 15.2? Latest Version i found on software.opensuse.org is polkit-0.116-lp152.2.3.1x86_64.rpm. Is the fix already included? thanks and best regards Jan Reupke

2 1

CVE-2022-25636 - privilege escalation through netfilter bug
by Mathias Homann 16 Mar '22

16 Mar '22

Hi, just came across CVE-2022-25636 in this article: https://www.zdnet.com/ article/nasty-linux-netfilter-firewall-security-hole-found/ Is there an update for Leap 15.3 and SLES in the works? Tumbleweed should be ok since the bug is "only" in kernels up to 5.6.10 and TW currently runs on 5.16.14. Cheers MH -- Mathias Homann Mathias.Homann(a)openSUSE.org Jabber (XMPP): lemmy(a)tuxonline.tech Matrix: @mathias:eregion.de IRC: [Lemmy] on freenode and ircnet (bouncer active) keybase: https://keybase.io/lemmy gpg key fingerprint: 8029 2240 F4DD 7776 E7D2 C042 6B8E 029E 13F2 C102

2 2

CVE-2022-0847
by Frank Steiner 08 Mar '22

08 Mar '22

Hi, given that (according to https://dirtypipe.cm4all.com/) distributors were informed about the CVE-2022-0847 patch on Feb 28th, shouldn't that have been enough time to release kernel patches *before* public disclosure? Isn't that why distributors get informed in advance? https://www.suse.com/de-de/security/cve/CVE-2022-0847.html states all active SLE products (expect the beta in 15 SP4 etc.) as "in progress". Considering the severity of this bug, it is not very impressive to have no kernel updates a week after getting notified about the bug and the patch :-( Maybe you can consider opening sth. like an "early updates" channel for SLE where you publish patched packages when they start their QA process (which I guess it what delays the releases), so that people can decide to work with untested but patched packages for severe bugs until they are officially released after QA? We are e.g. installing FF and TB packages from the mozilla repo when they are published and work with them for a few days until they are released in SLE, too. Being able to do so with all SLE packages for important patches would be a nice option. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

2 1

Re: Your confirmation is needed to join the security@lists.opensuse.org mailing list.
by Marcus Meissner 04 Mar '22

04 Mar '22

Hi Andreas, I am not seeing you subscribed to either security(a)lists.opensuse.org or security-announce(a)lists.opensuse.org at this time. The below email is a request for a confirmation to subscribe, but you are not subscribed at this time. Ciao, Marcus On Fri, Mar 04, 2022 at 08:38:30AM +0000, Winkler, Andreas wrote: > Hello, > > I urgently need to be removed from ALL MAILING LISTS at opensuse.org - there is no way to do this from those countless emails I receive, no link to unsubscribe in your emails !! This is unacceptable. > > Please remove me from ALL MAILING LISTS immediately, especially from opensuse-security(a)opensuse.org with this email address (andreas.winkler(a)hpe.com) ! > > Thank you > > Andreas Winkler > > > -----Original Message----- > From: security-confirm+e7e7e9f4d01e1ebb4ade3e1514875b214b5987d6(a)lists.opensuse.org [mailto:security-confirm+e7e7e9f4d01e1ebb4ade3e1514875b214b5987d6@lists.opensuse.org] > Sent: Freitag, 4. März 2022 09:31 > To: Winkler, Andreas <andreas.winkler(a)hpe.com> > Subject: Your confirmation is needed to join the security(a)lists.opensuse.org mailing list. > > Email Address Registration Confirmation > > Hello, this is the GNU Mailman server at lists.opensuse.org. > > We have received a registration request for the email address > > andreas.winkler(a)hpe.com > > Before you can start using GNU Mailman at this site, you must first confirm that this is your email address. You can do this by replying to this message. > > Or you should include the following line -- and only the following line -- in a message to security-request(a)lists.opensuse.org: > > confirm e7e7e9f4d01e1ebb4ade3e1514875b214b5987d6 > > Note that simply sending a `reply' to this message should work from most mail readers. > > If you do not wish to register this email address, simply disregard this message. If you think you are being maliciously subscribed to the list, or have any other questions, you may contact > > security-owner(a)lists.opensuse.org

3 2

Re: openSUSE-SU-2022:0058-1: important: Security update for MozillaThunderbird
by Carlos E. R. 03 Mar '22

03 Mar '22

On 2022-03-01 21:23, opensuse-security(a)opensuse.org wrote: > openSUSE Security Update: Security update for MozillaThunderbird > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2022:0058-1 > Rating: important > References: #1144018 #1181400 #1194020 #1194215 #1194681 > > Cross-References: CVE-2020-15803 CVE-2021-27927 CVE-2021-4126 > CVE-2021-44538 CVE-2022-23134 > CVSS scores: > CVE-2020-15803 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N > CVE-2020-15803 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N > CVE-2021-4126 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N > CVE-2021-44538 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H > CVE-2022-23134 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N > CVE-2022-23134 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N > > Affected Products: > openSUSE Backports SLE-15-SP3 > openSUSE Leap 15.3 > ______________________________________________________________________________ > > An update that fixes 5 vulnerabilities is now available. > > Description: > > This update for MozillaThunderbird fixes the following issues: > > - Mozilla Thunderbird 91.4.1 I don't understand. Leap 15.3 is using 91.6.1 already. Delayed mail perhaps? -- Cheers / Saludos, Carlos E. R. (from 15.3 x86_64 at Telcontar)

1 0