January 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0041-1: important: Security update for chromium
by opensuse-security＠opensuse.org 10 Jan '21

10 Jan '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0041-1 Rating: important References: #1180645 Cross-References: CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 87.0.4280.141 (boo#1180645) - CVE-2021-21106: Use after free in autofill - CVE-2021-21107: Use after free in drag and drop - CVE-2021-21108: Use after free in media - CVE-2021-21109: Use after free in payments - CVE-2021-21110: Use after free in safe browsing - CVE-2021-21111: Insufficient policy enforcement in WebUI - CVE-2021-21112: Use after free in Blink - CVE-2021-21113: Heap buffer overflow in Skia - CVE-2020-16043: Insufficient data validation in networking - CVE-2021-21114: Use after free in audio - CVE-2020-15995: Out of bounds write in V8 - CVE-2021-21115: Use after free in safe browsing - CVE-2021-21116: Heap buffer overflow in audio - Use main URLs instead of redirects in master preferences Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-41=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-87.0.4280.141-lp151.2.165.1 chromedriver-debuginfo-87.0.4280.141-lp151.2.165.1 chromium-87.0.4280.141-lp151.2.165.1 chromium-debuginfo-87.0.4280.141-lp151.2.165.1 References: https://www.suse.com/security/cve/CVE-2020-15995.html https://www.suse.com/security/cve/CVE-2020-16043.html https://www.suse.com/security/cve/CVE-2021-21106.html https://www.suse.com/security/cve/CVE-2021-21107.html https://www.suse.com/security/cve/CVE-2021-21108.html https://www.suse.com/security/cve/CVE-2021-21109.html https://www.suse.com/security/cve/CVE-2021-21110.html https://www.suse.com/security/cve/CVE-2021-21111.html https://www.suse.com/security/cve/CVE-2021-21112.html https://www.suse.com/security/cve/CVE-2021-21113.html https://www.suse.com/security/cve/CVE-2021-21114.html https://www.suse.com/security/cve/CVE-2021-21115.html https://www.suse.com/security/cve/CVE-2021-21116.html https://bugzilla.suse.com/1180645

1 0

openSUSE-SU-2021:0040-1: important: Security update for chromium
by opensuse-security＠opensuse.org 10 Jan '21

10 Jan '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0040-1 Rating: important References: #1180645 Cross-References: CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 87.0.4280.141 (boo#1180645) - CVE-2021-21106: Use after free in autofill - CVE-2021-21107: Use after free in drag and drop - CVE-2021-21108: Use after free in media - CVE-2021-21109: Use after free in payments - CVE-2021-21110: Use after free in safe browsing - CVE-2021-21111: Insufficient policy enforcement in WebUI - CVE-2021-21112: Use after free in Blink - CVE-2021-21113: Heap buffer overflow in Skia - CVE-2020-16043: Insufficient data validation in networking - CVE-2021-21114: Use after free in audio - CVE-2020-15995: Out of bounds write in V8 - CVE-2021-21115: Use after free in safe browsing - CVE-2021-21116: Heap buffer overflow in audio - Use main URLs instead of redirects in master preferences Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-40=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-87.0.4280.141-lp152.2.60.1 chromedriver-debuginfo-87.0.4280.141-lp152.2.60.1 chromium-87.0.4280.141-lp152.2.60.1 chromium-debuginfo-87.0.4280.141-lp152.2.60.1 References: https://www.suse.com/security/cve/CVE-2020-15995.html https://www.suse.com/security/cve/CVE-2020-16043.html https://www.suse.com/security/cve/CVE-2021-21106.html https://www.suse.com/security/cve/CVE-2021-21107.html https://www.suse.com/security/cve/CVE-2021-21108.html https://www.suse.com/security/cve/CVE-2021-21109.html https://www.suse.com/security/cve/CVE-2021-21110.html https://www.suse.com/security/cve/CVE-2021-21111.html https://www.suse.com/security/cve/CVE-2021-21112.html https://www.suse.com/security/cve/CVE-2021-21113.html https://www.suse.com/security/cve/CVE-2021-21114.html https://www.suse.com/security/cve/CVE-2021-21115.html https://www.suse.com/security/cve/CVE-2021-21116.html https://bugzilla.suse.com/1180645

1 0

openSUSE-RU-2021:0039-1: moderate: Recommended update for taglib
by maintenance＠opensuse.org 10 Jan '21

10 Jan '21

openSUSE Recommended Update: Recommended update for taglib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0039-1 Rating: moderate References: #1179817 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for taglib fixes the following issues: - Fixed a possible file corruption of ogg files (bsc#1179817, gh#taglib/taglib#864): This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-39=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libtag-devel-1.11.1-lp152.7.3.1 libtag1-1.11.1-lp152.7.3.1 libtag1-debuginfo-1.11.1-lp152.7.3.1 libtag_c0-1.11.1-lp152.7.3.1 libtag_c0-debuginfo-1.11.1-lp152.7.3.1 taglib-1.11.1-lp152.7.3.1 taglib-debuginfo-1.11.1-lp152.7.3.1 taglib-debugsource-1.11.1-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): libtag1-32bit-1.11.1-lp152.7.3.1 libtag1-32bit-debuginfo-1.11.1-lp152.7.3.1 libtag_c0-32bit-1.11.1-lp152.7.3.1 libtag_c0-32bit-debuginfo-1.11.1-lp152.7.3.1 References: https://bugzilla.suse.com/1179817

1 0

openSUSE-RU-2021:0037-1: moderate: Recommended update for plasma5-desktop
by maintenance＠opensuse.org 09 Jan '21

09 Jan '21

openSUSE Recommended Update: Recommended update for plasma5-desktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0037-1 Rating: moderate References: #1164739 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-desktop fixes the following issues: - Fixed keyboard repeat settings not being applied immediately (boo#1164739, kde#418175): This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-37=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le x86_64): plasma5-desktop-5.18.5-bp152.3.6.1 plasma5-desktop-emojier-5.18.5-bp152.3.6.1 - openSUSE Backports SLE-15-SP2 (noarch): plasma5-desktop-lang-5.18.5-bp152.3.6.1 References: https://bugzilla.suse.com/1164739

1 0

openSUSE-RU-2021:0038-1: moderate: Recommended update for python-uncompyle6, python-xdis
by maintenance＠opensuse.org 09 Jan '21

09 Jan '21

openSUSE Recommended Update: Recommended update for python-uncompyle6, python-xdis ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0038-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-uncompyle6, python-xdis fixes the following issues: python-uncompyle6 was updated to 3.7.4: * Fragment parsing was borked. This means deparsing in trepan2/trepan3k was broken * 3.7+: narrow precedence for call tatement * del_stmt -> delete to better match Python AST * 3.8+ Add another forelsestmt (found only in a loop) * 3.8+ Add precedence on walrus operator * More files blackened * bump min xdis version * __doc__ = DocDescr() from test_descr.py was getting confused as a docstring. * detect 2.7 exchandler range better update to 3.7.2 * Use newer xdis * Docstrings (again) which were broken again on earlier Python * Fix 2.6 and 2.7 decompilation bug in handling "list if" comprehensions * Handle 3.7+ "else" branch removal adAs seen in `_cmp()` of `python3.8/distutils/version.py` with optimization `-O2` * 3.6+ "with" and "with .. as" grammar improvements * ast-check for "for" loop was missing some grammar rules update to 3.7.0 * The main impetus for this release is to pull in the recent changes from xdis. We simplify imports using xdis 4.6.0. * There were some bugfixes to Python 3.4-3.8. See the ChangeLog for details python-xdis was updated to to 5.0.4: * Add python versions 3.6.12, 3.7.9 * extended arg disassembly handling for {LOAD,STORE}_ATTR * Add versions 3.8.5, 3.7.8, and 3.6.11 * Clarify changes to 3.8 `ROT_FOUR` * Update 3.9 magics and opcodes * Add Python 3.8.4 as a 3.8 release * pydisasm.py Python 3.3 tolerance * Make pydoc's version reporting show xdis's version - Update to 5.0.1 * Routines for extracting line and offset information from code objects was added. * Disassembly format and options have simplified and improved. * Before, we had separate flags and command-line options for whether to show just the header, and whether to include bytecode ops in the output. Now there is just a single parameter called `asm_format`, and choice option `--format` (short option `-F`). * Small fixes and improvements - Update to 4.6.1: * A portable version of types.CodeType was rewritten. * Python 3.8-ish `replace()` method has been added to the portable code types * Portable code type classes `Code13`, `Code15` have been added to more precisely distinguish Python 1.3 and 1.5 code types. The other portable code classes are `Code2`, `Code3`, and `Code38`. * the to_native() conversts a portable code type into a native code type * the `decode_lineno_tab()` method on portable code types from Python 1.5 on decompresses the Python encode line number table into a dictionary mapping offset to line number. * The module `xdis.code` has been remamed to `xdis.codetype`. * `load_module()` and `load_module_from_file_object()` now return a couple more parameters. * --asm option fixes * Show sip hash in 3.7+ when that is used * Handle PEP 552 bytecode-file variations more properly * Detect more intermediate Python versions in `load_code_from_file_object()` * 3.8+ posonlyargcount in assembly... rename Kw-only field to Keyword-only * Add 3.5 canonic bytecode version Marshal `dumps()` * convert from byte() to str() in dumps() when needed in 3.x * to_native() convert to bytes from string when needed in 3.x. * clean up loading code by using float version values rather than magic values * `stack_effects()` checked against Python 3.4+ is now in place. * Added `stack_effects()` function to `std.py` since this is part of the API * `cross_xdis.py` file/module now has `dis.py` functions split off from `bytecod e.py` * `Instructions` class is in its own module too. * Python 2.7.18 added into magics. * Fix bug in marshal for 3.8+ (include posonlyargcount) * Go over stack effects from 2.5 to 3.4 using and idea from Maynard * Expand stack-effect testing * 3.8.3 added as a valid 3.8 release * command program `pydisasm` disassembles more Python source files now * Add better arguemnt formatting on `CALL_FUNCTION` and `MAKE_FUNCTION` * bytecode.py now has `distb` * opcode modules now have variable `python_implemenation` which is either "CPyth on" or "PyPY" * Reformat a number of files using blacken, and lint using flymake * Update `__init__.py` exports based on what is used in projects `uncompyle6`, ` decompyle3`, `trepan3k`, `xasm` and `x-python` * Remove duplicate `findlinestarts()` code. Remove testing on the Python version and simplify this where possible. * get_opcode_module allows either a float and string datatype for the version, and coverts the bytecode datatype when needed * Fix a bugs in marshal and unmarshal * Go over magics numbers, yet again * Fix a bad bug in handling byte constants in 3.x. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-38=1 Package List: - openSUSE Leap 15.2 (noarch): python2-uncompyle6-3.7.4-lp152.3.3.1 python2-xdis-5.0.6-lp152.2.3.1 python3-uncompyle6-3.7.4-lp152.3.3.1 python3-xdis-5.0.6-lp152.2.3.1 References:

1 0

openSUSE-RU-2021:0036-1: moderate: Recommended update for kget
by maintenance＠opensuse.org 09 Jan '21

09 Jan '21

openSUSE Recommended Update: Recommended update for kget ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0036-1 Rating: moderate References: #1180352 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kget fixes the following issues: - Fixed kget not starting (boo#1180352): This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-36=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kget-20.04.2-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): kget-lang-20.04.2-bp152.2.3.1 References: https://bugzilla.suse.com/1180352

1 0

openSUSE-RU-2021:0035-1: moderate: Recommended update for lyx
by maintenance＠opensuse.org 08 Jan '21

08 Jan '21

openSUSE Recommended Update: Recommended update for lyx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0035-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lyx fixes the following issues: lyx was updated to 2.3.6.1: - The fix for https://www.lyx.org/trac/ticket/12056, which prevented inclusion of TeX files Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-35=1 Package List: - openSUSE Leap 15.2 (x86_64): lyx-2.3.6.1-lp152.2.9.1 lyx-debuginfo-2.3.6.1-lp152.2.9.1 lyx-debugsource-2.3.6.1-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): lyx-fonts-2.3.6.1-lp152.2.9.1 References:

1 0

openSUSE-RU-2021:0034-1: moderate: Recommended update for trytond
by maintenance＠opensuse.org 08 Jan '21

08 Jan '21

openSUSE Recommended Update: Recommended update for trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0034-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond fixes the following issues: - Version 5.0.31 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-34=1 Package List: - openSUSE Leap 15.2 (noarch): trytond-5.0.31-lp152.2.17.1 References:

1 0

openSUSE-RU-2021:0033-1: moderate: Recommended update for dmidecode
by maintenance＠opensuse.org 08 Jan '21

08 Jan '21

openSUSE Recommended Update: Recommended update for dmidecode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0033-1 Rating: moderate References: #1174257 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dmidecode fixes the following issue: - Two missing commas in the data arrays cause "OUT OF SPEC" messages during the index resolution. (bnc#1174257) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-33=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dmidecode-3.2-lp152.6.6.1 dmidecode-debuginfo-3.2-lp152.6.6.1 dmidecode-debugsource-3.2-lp152.6.6.1 References: https://bugzilla.suse.com/1174257

1 0

openSUSE-RU-2021:0028-1: moderate: Recommended update for enchant
by maintenance＠opensuse.org 08 Jan '21

08 Jan '21

openSUSE Recommended Update: Recommended update for enchant ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0028-1 Rating: moderate References: #1178489 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enchant fixes the following issue: - _Voikko_ and _Zemberek's_ APIs assume a NUL-terminated string. Provide one in Enchant. (bsc#1178489) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-28=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): enchant-2-backend-aspell-2.2.5-lp152.3.3.1 enchant-2-backend-aspell-debuginfo-2.2.5-lp152.3.3.1 enchant-2-backend-hunspell-2.2.5-lp152.3.3.1 enchant-2-backend-hunspell-debuginfo-2.2.5-lp152.3.3.1 enchant-2-backend-voikko-2.2.5-lp152.3.3.1 enchant-2-backend-voikko-debuginfo-2.2.5-lp152.3.3.1 enchant-data-2.2.5-lp152.3.3.1 enchant-debugsource-2.2.5-lp152.3.3.1 enchant-devel-2.2.5-lp152.3.3.1 enchant-tools-2.2.5-lp152.3.3.1 enchant-tools-debuginfo-2.2.5-lp152.3.3.1 libenchant-2-2-2.2.5-lp152.3.3.1 libenchant-2-2-debuginfo-2.2.5-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): enchant-2-backend-voikko-32bit-2.2.5-lp152.3.3.1 enchant-2-backend-voikko-32bit-debuginfo-2.2.5-lp152.3.3.1 libenchant-2-2-32bit-2.2.5-lp152.3.3.1 libenchant-2-2-32bit-debuginfo-2.2.5-lp152.3.3.1 References: https://bugzilla.suse.com/1178489

1 0