January 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0122-1: important: Security update for vlc
by opensuse-security＠opensuse.org 20 Jan '21

20 Jan '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0122-1 Rating: important References: #1133290 #1172727 #1180755 Cross-References: CVE-2020-13428 CVE-2020-26664 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: - CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727) - CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-122=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libvlc5-3.0.11.1-bp152.2.9.1 libvlccore9-3.0.11.1-bp152.2.9.1 vlc-3.0.11.1-bp152.2.9.1 vlc-codec-gstreamer-3.0.11.1-bp152.2.9.1 vlc-devel-3.0.11.1-bp152.2.9.1 vlc-jack-3.0.11.1-bp152.2.9.1 vlc-noX-3.0.11.1-bp152.2.9.1 vlc-opencv-3.0.11.1-bp152.2.9.1 vlc-qt-3.0.11.1-bp152.2.9.1 vlc-vdpau-3.0.11.1-bp152.2.9.1 - openSUSE Backports SLE-15-SP2 (noarch): vlc-lang-3.0.11.1-bp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-13428.html https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1172727 https://bugzilla.suse.com/1180755

1 0

openSUSE-SU-2021:0123-1: moderate: Security update for viewvc
by opensuse-security＠opensuse.org 20 Jan '21

20 Jan '21

openSUSE Security Update: Security update for viewvc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0123-1 Rating: moderate References: #1167974 Cross-References: CVE-2020-5283 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for viewvc fixes the following issues: - update to 1.1.28 (boo#1167974, CVE-2020-5283): * security fix: escape subdir lastmod file name (#211) * fix standalone.py first request failure (#195) * suppress stack traces (with option to show) (#140) * distinguish text/binary/image files by icons (#166, #175) * colorize alternating file content lines (#167) * link to the instance root from the ViewVC logo (#168) * display directory and root counts, too (#169) * fix double fault error in standalone.py (#157) * support timezone offsets with minutes piece (#176) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-123=1 Package List: - openSUSE Leap 15.2 (noarch): viewvc-1.1.28-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-5283.html https://bugzilla.suse.com/1167974

1 0

openSUSE-SU-2021:0121-1: important: Security update for vlc
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0121-1 Rating: important References: #1133290 #1172727 #1180755 Cross-References: CVE-2020-13428 CVE-2020-26664 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for vlc fixes the following issues: Update to 3.0.11.1: - CVE-2020-13428: Fixed heap-based buffer overflow in the hxxx_AnnexB_to_xVC () (boo#1172727) - CVE-2020-26664: Fixed heap-based buffer overflow in EbmlTypeDispatcher:send () (boo#1180755) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-121=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.11.1-bp151.5.12.1 libvlccore9-3.0.11.1-bp151.5.12.1 vlc-3.0.11.1-bp151.5.12.1 vlc-codec-gstreamer-3.0.11.1-bp151.5.12.1 vlc-devel-3.0.11.1-bp151.5.12.1 vlc-jack-3.0.11.1-bp151.5.12.1 vlc-noX-3.0.11.1-bp151.5.12.1 vlc-opencv-3.0.11.1-bp151.5.12.1 vlc-qt-3.0.11.1-bp151.5.12.1 vlc-vdpau-3.0.11.1-bp151.5.12.1 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.11.1-bp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2020-13428.html https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1172727 https://bugzilla.suse.com/1180755

1 0

openSUSE-RU-2021:0120-1: moderate: Recommended update for netcdf
by maintenance＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Recommended Update: Recommended update for netcdf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0120-1 Rating: moderate References: #1174291 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for netcdf fixes the following issues: - Make environment module name conform standards: NetCDF modules should be called 'netcdf' - regardless whether they are 'serial' or use MPI. (bsc#1174291) This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-120=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): libnetcdf-gnu-openmpi1-hpc-4.6.1-bp151.5.9.3 libnetcdf_4_6_1-gnu-openmpi1-hpc-4.6.1-bp151.5.9.3 netcdf_4_6_1-gnu-openmpi1-hpc-4.6.1-bp151.5.9.3 netcdf_4_6_1-gnu-openmpi1-hpc-devel-4.6.1-bp151.5.9.3 netcdf_4_6_1-gnu-openmpi1-hpc-devel-static-4.6.1-bp151.5.9.3 - openSUSE Backports SLE-15-SP1 (ppc64le): libnetcdf-gnu-hpc-4.6.1-bp151.5.9.2 libnetcdf-gnu-mpich-hpc-4.6.1-bp151.5.9.2 libnetcdf-gnu-mvapich2-hpc-4.6.1-bp151.5.9.2 libnetcdf-gnu-openmpi2-hpc-4.6.1-bp151.5.9.2 libnetcdf-gnu-openmpi3-hpc-4.6.1-bp151.5.9.2 libnetcdf_4_6_1-gnu-hpc-4.6.1-bp151.5.9.2 libnetcdf_4_6_1-gnu-mpich-hpc-4.6.1-bp151.5.9.2 libnetcdf_4_6_1-gnu-mvapich2-hpc-4.6.1-bp151.5.9.2 libnetcdf_4_6_1-gnu-openmpi2-hpc-4.6.1-bp151.5.9.2 libnetcdf_4_6_1-gnu-openmpi3-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-hpc-devel-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-hpc-devel-data-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-hpc-devel-static-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mpich-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mpich-hpc-devel-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mpich-hpc-devel-static-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mvapich2-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mvapich2-hpc-devel-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-mvapich2-hpc-devel-static-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi2-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi2-hpc-devel-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi2-hpc-devel-static-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi3-hpc-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi3-hpc-devel-4.6.1-bp151.5.9.2 netcdf_4_6_1-gnu-openmpi3-hpc-devel-static-4.6.1-bp151.5.9.2 - openSUSE Backports SLE-15-SP1 (noarch): netcdf-gnu-hpc-4.6.1-bp151.5.9.2 netcdf-gnu-hpc-devel-4.6.1-bp151.5.9.2 netcdf-gnu-mpich-hpc-4.6.1-bp151.5.9.2 netcdf-gnu-mpich-hpc-devel-4.6.1-bp151.5.9.2 netcdf-gnu-mvapich2-hpc-4.6.1-bp151.5.9.2 netcdf-gnu-mvapich2-hpc-devel-4.6.1-bp151.5.9.2 netcdf-gnu-openmpi1-hpc-4.6.1-bp151.5.9.3 netcdf-gnu-openmpi1-hpc-devel-4.6.1-bp151.5.9.3 netcdf-gnu-openmpi2-hpc-4.6.1-bp151.5.9.2 netcdf-gnu-openmpi2-hpc-devel-4.6.1-bp151.5.9.2 netcdf-gnu-openmpi3-hpc-4.6.1-bp151.5.9.2 netcdf-gnu-openmpi3-hpc-devel-4.6.1-bp151.5.9.2 References: https://bugzilla.suse.com/1174291

1 0

openSUSE-SU-2021:0117-1: moderate: Security update for python-jupyter_notebook
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for python-jupyter_notebook ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0117-1 Rating: moderate References: #1180458 Cross-References: CVE-2020-26215 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-jupyter_notebook fixes the following issue: - CVE-2020-26215: Fixed an open redirect vulnerability (boo#1180458). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-117=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python-jupyter_notebook-doc-5.7.7-bp151.3.3.1 python2-jupyter_notebook-5.7.7-bp151.3.3.1 python2-jupyter_notebook-lang-5.7.7-bp151.3.3.1 python2-jupyter_notebook-latex-5.7.7-bp151.3.3.1 python3-jupyter_notebook-5.7.7-bp151.3.3.1 python3-jupyter_notebook-lang-5.7.7-bp151.3.3.1 python3-jupyter_notebook-latex-5.7.7-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-26215.html https://bugzilla.suse.com/1180458

1 0

openSUSE-RU-2021:0118-1: moderate: Recommended update for rt-tests
by maintenance＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Recommended Update: Recommended update for rt-tests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0118-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: rt-tests was updated to fix the following issues: Update to upstream version 1.10 (SLE-12981): * rt-tests: queuelat: Remove get_cpuinfo_mhz.sh and old Makefile * rt-tests: determine_maximum_mpps.sh: Add a menu to get user settings. * rt-numa: Introduce NUMA helpers * cyclictest: Only report the first incident * Streamline usage and man page Changes from version 1.9: * signaltest: Only print from the first thread stats when quiet * rt-tests: cyclictest: Move ftrace helpers into rt-utils.[ch] * pi_stress: limit the number of inversion groups to the number of online cores * rt-tests: Install new man page get_cyclictest_snapshot.8 * rt-tests: Add a man page for get_cyclictest_snapshot * rt-tests: ptsematest.8: Update the ptsematest man page * rt-tests: improvements to the python style in get_cyclictest_snapshot * cyclictest: Fix setaffinity error on large NUMA machines Changes from version 1.8: * cyclictest: Make the affinity mask apply to the main thread too * Remove support for compiling without NUMA * cyclictest: Only run on runtime affinity and user supplied affinity * cyclictest: Only run on available cpus according to the affinity * cyclictest: Report all errors from pthread_setaffinity_np Changes from version 1.7: * Add get_cyclictest_snapshot to Makefile * Add the get_cyclictest_snapshot.py utility * determine_maximum_mpps.sh: Fix quoting and other shell issue * queuelat: get_cpuinfo_mhz.sh highest value * cyclicdeadline: Add a simple manpage for cyclicdeadline This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-118=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): rt-tests-1.10-bp151.2.6.1 References:

1 0

openSUSE-SU-2021:0119-1: moderate: Security update for viewvc
by opensuse-security＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Security Update: Security update for viewvc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0119-1 Rating: moderate References: #1167974 Cross-References: CVE-2020-5283 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for viewvc fixes the following issues: - update to 1.1.28 (boo#1167974, CVE-2020-5283): * security fix: escape subdir lastmod file name (#211) * fix standalone.py first request failure (#195) * suppress stack traces (with option to show) (#140) * distinguish text/binary/image files by icons (#166, #175) * colorize alternating file content lines (#167) * link to the instance root from the ViewVC logo (#168) * display directory and root counts, too (#169) * fix double fault error in standalone.py (#157) * support timezone offsets with minutes piece (#176) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-119=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): viewvc-1.1.28-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-5283.html https://bugzilla.suse.com/1167974

1 0

openSUSE-RU-2021:0116-1: moderate: Recommended update for mdadm
by maintenance＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Recommended Update: Recommended update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0116-1 Rating: moderate References: #1180220 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mdadm fixes the following issues: - Remove redundant spare movement logic to fix and issue with broken reshaping. (bsc#1180220)) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-116=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): mdadm-4.1-lp152.7.16.1 mdadm-debuginfo-4.1-lp152.7.16.1 mdadm-debugsource-4.1-lp152.7.16.1 References: https://bugzilla.suse.com/1180220

1 0

openSUSE-RU-2021:0115-1: moderate: Recommended update for lvm2
by maintenance＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0115-1 Rating: moderate References: #1179691 #1179738 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lvm2 fixes the following issues: - Fix for lvm2 to use udev as external device by default. (bsc#1179691) - Fixed an issue in configuration for an item that is commented out by default. (bsc#1179738) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-115=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): device-mapper-1.02.163-lp152.7.12.1 device-mapper-debuginfo-1.02.163-lp152.7.12.1 device-mapper-devel-1.02.163-lp152.7.12.1 libdevmapper-event1_03-1.02.163-lp152.7.12.1 libdevmapper-event1_03-debuginfo-1.02.163-lp152.7.12.1 libdevmapper1_03-1.02.163-lp152.7.12.1 libdevmapper1_03-debuginfo-1.02.163-lp152.7.12.1 liblvm2cmd2_03-2.03.05-lp152.7.12.1 liblvm2cmd2_03-debuginfo-2.03.05-lp152.7.12.1 lvm2-2.03.05-lp152.7.12.1 lvm2-debuginfo-2.03.05-lp152.7.12.1 lvm2-debugsource-2.03.05-lp152.7.12.1 lvm2-devel-2.03.05-lp152.7.12.1 lvm2-device-mapper-debugsource-2.03.05-lp152.7.12.1 lvm2-lockd-2.03.05-lp152.7.12.1 lvm2-lockd-debuginfo-2.03.05-lp152.7.12.1 lvm2-lvmlockd-debugsource-2.03.05-lp152.7.12.1 lvm2-testsuite-2.03.05-lp152.7.12.1 lvm2-testsuite-debuginfo-2.03.05-lp152.7.12.1 - openSUSE Leap 15.2 (x86_64): device-mapper-devel-32bit-1.02.163-lp152.7.12.1 libdevmapper-event1_03-32bit-1.02.163-lp152.7.12.1 libdevmapper-event1_03-32bit-debuginfo-1.02.163-lp152.7.12.1 libdevmapper1_03-32bit-1.02.163-lp152.7.12.1 libdevmapper1_03-32bit-debuginfo-1.02.163-lp152.7.12.1 References: https://bugzilla.suse.com/1179691 https://bugzilla.suse.com/1179738

1 0

openSUSE-RU-2021:0114-1: moderate: Recommended update for gnome-software
by maintenance＠opensuse.org 19 Jan '21

19 Jan '21

openSUSE Recommended Update: Recommended update for gnome-software ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0114-1 Rating: moderate References: #1161095 #1174849 #1178768 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gnome-software fixes the following issue: - plugin-loader: Handle offline update errors properly. (bsc#1161095) - Add missing devel headers referenced by gnome-software.h. (bsc#1174849) - added gnome-packagekit as recommended dependency (bsc#1178768) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-114=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-software-lang-3.34.2-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): gnome-software-3.34.2-lp152.3.3.1 gnome-software-debuginfo-3.34.2-lp152.3.3.1 gnome-software-debugsource-3.34.2-lp152.3.3.1 gnome-software-devel-3.34.2-lp152.3.3.1 References: https://bugzilla.suse.com/1161095 https://bugzilla.suse.com/1174849 https://bugzilla.suse.com/1178768

1 0