January 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0175-1: moderate: Recommended update for dwarves
by maintenance＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Recommended Update: Recommended update for dwarves ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0175-1 Rating: moderate References: #1176095 #1177921 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dwarves fixes the following issues: - Drop the version requirement of libdw-devel + DW_AT_alignment is defined in 1.19 so dwarves now is compatible with older libdw. Update to release 1.19 * Support for split BTF. * Support cross-compiled ELF binaries with different endianness. * Support for showing typedefs for anonymous types, like structs, unions and enums. move to 1.18.g19 (863e6f0f) * btf_encoder: Ignore zero-sized ELF symbols update to 1.18_15g040fd7f (boo#1177921): * btf_encoder: Support cross-compiled ELF binaries with different endianness * strings: use BTF's string APIs for strings management * strings: Rename strings.h to avoid clashing with /usr/include/strings.h * dwarf_loader: increase the size of lookup hash map * btf_encoder: revamp how per-CPU variables are encoded * btf_encoder: Discard CUs after BTF encoding * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type * btf_encoder: Use libbpf APIs to encode BTF type info * btf_loader: Use libbpf to load BTF * dwarves: Expose and maintain active debug info loader operations * btf_encoder: detect BTF encoding errors and exit * libbpf: Update to latest libbpf version * dwarf_loader: Conditionally define DW_AT_alignment * pahole: Implement --packed * man-pages: Fix 'coimbine' typo Update to release 1.18 * pahole now should be segfault free when handling gdb test suit DWARF files, including ADA, FORTRAN, rust and dwp compressed files (the latter is refused). * Bail out on partial units for now, avoiding segfaults. - Backport fixes for segfault when processing dwz-ed kernel [boo#1176095,https://github.com/acmel/dwarves/issues/10] Update to release 1.17 * Support raw BTF as available in /sys/kernel/btf/vmlinux. * Make --find_pointers_to consider unions. * Make --contains and --find_pointers_to honour --unions. * Add support for finding pointers to void. * Make --contains and --find_pointers_to to work with base types. Update to release 1.16 * btf_loader: Add support for BTF_KIND_FUNC Update to new upstream release 1.15 * Avoid null dereference with NULL configs * Fixup printing "const" early with "const void" * Fix recursively printing named structs in --expand_types version 1.13 * Use of the recently introduced BTF deduplication algorithm * Introduce a 'btfdiff' utility * Add a BTF loader, i.e. 'pahole -F btf' allows pretty printing of structs and unions in the same fashion as with DWARF info * Better union support * Infer __attribute__((__packed__)) when structs have no alignment holes * Support DWARF5's DW_AT_alignment * Add a '--compile' option to 'pfunct' Update to new upstream release 1.12 * Added a BTF (BPF Type Format) encoder * Initial support for DW_TAG_partial_unit * Print cacheline boundaries in multiple union members * Show offsets at union members Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2021-175=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): dwarves-1.19-bp150.3.3.1 libdwarves-devel-1.19-bp150.3.3.1 libdwarves1-1.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libdwarves-devel-64bit-1.19-bp150.3.3.1 libdwarves1-64bit-1.19-bp150.3.3.1 References: https://bugzilla.suse.com/1176095 https://bugzilla.suse.com/1177921

1 0

openSUSE-RU-2021:0174-1: moderate: Recommended update for ffmpeg-4
by maintenance＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Recommended Update: Recommended update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0174-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for ffmpeg-4 fixes the following issues: - fixed a call to dlopen, as there is no libfdk-aac.so.1 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-174=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ffmpeg-4-debugsource-4.2.1-lp152.2.3.1 ffmpeg-4-libavcodec-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libavdevice-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libavfilter-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libavformat-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libavresample-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libavutil-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libpostproc-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libswresample-devel-4.2.1-lp152.2.3.1 ffmpeg-4-libswscale-devel-4.2.1-lp152.2.3.1 ffmpeg-4-private-devel-4.2.1-lp152.2.3.1 libavcodec58-4.2.1-lp152.2.3.1 libavcodec58-debuginfo-4.2.1-lp152.2.3.1 libavdevice58-4.2.1-lp152.2.3.1 libavdevice58-debuginfo-4.2.1-lp152.2.3.1 libavfilter7-4.2.1-lp152.2.3.1 libavfilter7-debuginfo-4.2.1-lp152.2.3.1 libavformat58-4.2.1-lp152.2.3.1 libavformat58-debuginfo-4.2.1-lp152.2.3.1 libavresample4-4.2.1-lp152.2.3.1 libavresample4-debuginfo-4.2.1-lp152.2.3.1 libavutil56-4.2.1-lp152.2.3.1 libavutil56-debuginfo-4.2.1-lp152.2.3.1 libpostproc55-4.2.1-lp152.2.3.1 libpostproc55-debuginfo-4.2.1-lp152.2.3.1 libswresample3-4.2.1-lp152.2.3.1 libswresample3-debuginfo-4.2.1-lp152.2.3.1 libswscale5-4.2.1-lp152.2.3.1 libswscale5-debuginfo-4.2.1-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libavcodec58-32bit-4.2.1-lp152.2.3.1 libavcodec58-32bit-debuginfo-4.2.1-lp152.2.3.1 libavdevice58-32bit-4.2.1-lp152.2.3.1 libavdevice58-32bit-debuginfo-4.2.1-lp152.2.3.1 libavfilter7-32bit-4.2.1-lp152.2.3.1 libavfilter7-32bit-debuginfo-4.2.1-lp152.2.3.1 libavformat58-32bit-4.2.1-lp152.2.3.1 libavformat58-32bit-debuginfo-4.2.1-lp152.2.3.1 libavresample4-32bit-4.2.1-lp152.2.3.1 libavresample4-32bit-debuginfo-4.2.1-lp152.2.3.1 libavutil56-32bit-4.2.1-lp152.2.3.1 libavutil56-32bit-debuginfo-4.2.1-lp152.2.3.1 libpostproc55-32bit-4.2.1-lp152.2.3.1 libpostproc55-32bit-debuginfo-4.2.1-lp152.2.3.1 libswresample3-32bit-4.2.1-lp152.2.3.1 libswresample3-32bit-debuginfo-4.2.1-lp152.2.3.1 libswscale5-32bit-4.2.1-lp152.2.3.1 libswscale5-32bit-debuginfo-4.2.1-lp152.2.3.1 References:

1 0

openSUSE-RU-2021:0172-1: moderate: Recommended update for susepaste
by maintenance＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Recommended Update: Recommended update for susepaste ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0172-1 Rating: moderate References: #1166669 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for susepaste fixes the following issues: - Fixed parsing of location header returned by susepaste.org (boo#1166669). updated to version 0.6 - error out when pasting unreadable file - fix one bashism - allow to specify protocol Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-172=1 Package List: - openSUSE Leap 15.2 (noarch): susepaste-0.6-lp152.4.3.1 susepaste-screenshot-0.6-lp152.4.3.1 References: https://bugzilla.suse.com/1166669

1 0

openSUSE-SU-2021:0173-1: important: Security update for chromium
by opensuse-security＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0173-1 Rating: important References: #1181137 Cross-References: CVE-2020-16044 CVE-2021-21117 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134 CVE-2021-21135 CVE-2021-21136 CVE-2021-21137 CVE-2021-21138 CVE-2021-21139 CVE-2021-21140 CVE-2021-21141 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: chromium was updated to 88.0.4324.96 boo#1181137 - CVE-2021-21117: Insufficient policy enforcement in Cryptohome - CVE-2021-21118: Insufficient data validation in V8 - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in WebSQL - CVE-2021-21121: Use after free in Omnibox - CVE-2021-21122: Use after free in Blink - CVE-2021-21123: Insufficient data validation in File System API - CVE-2021-21124: Potential user after free in Speech Recognizer - CVE-2021-21125: Insufficient policy enforcement in File System API - CVE-2020-16044: Use after free in WebRTC - CVE-2021-21126: Insufficient policy enforcement in extensions - CVE-2021-21127: Insufficient policy enforcement in extensions - CVE-2021-21128: Heap buffer overflow in Blink - CVE-2021-21129: Insufficient policy enforcement in File System API - CVE-2021-21130: Insufficient policy enforcement in File System API - CVE-2021-21131: Insufficient policy enforcement in File System API - CVE-2021-21132: Inappropriate implementation in DevTools - CVE-2021-21133: Insufficient policy enforcement in Downloads - CVE-2021-21134: Incorrect security UI in Page Info - CVE-2021-21135: Inappropriate implementation in Performance API - CVE-2021-21136: Insufficient policy enforcement in WebView - CVE-2021-21137: Inappropriate implementation in DevTools - CVE-2021-21138: Use after free in DevTools - CVE-2021-21139: Inappropriate implementation in iframe sandbox - CVE-2021-21140: Uninitialized Use in USB - CVE-2021-21141: Insufficient policy enforcement in File System API Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-173=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-88.0.4324.96-lp152.2.66.1 chromedriver-debuginfo-88.0.4324.96-lp152.2.66.1 chromium-88.0.4324.96-lp152.2.66.1 chromium-debuginfo-88.0.4324.96-lp152.2.66.1 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://www.suse.com/security/cve/CVE-2021-21117.html https://www.suse.com/security/cve/CVE-2021-21118.html https://www.suse.com/security/cve/CVE-2021-21119.html https://www.suse.com/security/cve/CVE-2021-21120.html https://www.suse.com/security/cve/CVE-2021-21121.html https://www.suse.com/security/cve/CVE-2021-21122.html https://www.suse.com/security/cve/CVE-2021-21123.html https://www.suse.com/security/cve/CVE-2021-21124.html https://www.suse.com/security/cve/CVE-2021-21125.html https://www.suse.com/security/cve/CVE-2021-21126.html https://www.suse.com/security/cve/CVE-2021-21127.html https://www.suse.com/security/cve/CVE-2021-21128.html https://www.suse.com/security/cve/CVE-2021-21129.html https://www.suse.com/security/cve/CVE-2021-21130.html https://www.suse.com/security/cve/CVE-2021-21131.html https://www.suse.com/security/cve/CVE-2021-21132.html https://www.suse.com/security/cve/CVE-2021-21133.html https://www.suse.com/security/cve/CVE-2021-21134.html https://www.suse.com/security/cve/CVE-2021-21135.html https://www.suse.com/security/cve/CVE-2021-21136.html https://www.suse.com/security/cve/CVE-2021-21137.html https://www.suse.com/security/cve/CVE-2021-21138.html https://www.suse.com/security/cve/CVE-2021-21139.html https://www.suse.com/security/cve/CVE-2021-21140.html https://www.suse.com/security/cve/CVE-2021-21141.html https://bugzilla.suse.com/1181137

1 0

openSUSE-RU-2021:0171-1: moderate: Recommended update for tcllib
by maintenance＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Recommended Update: Recommended update for tcllib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0171-1 Rating: moderate References: #1105803 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tcllib fixes the following issues: - Update to version 1.20: /usr/share/doc/packages/tcllib/README - Update to version 1.19 * Too many changes to list, please see included README files. * Fixes boo#1105803 - Update to version 1.16. For details see /usr/share/doc/packages/tcllib/README-1.16.txt - Update to version 1.15. For details see /usr/share/doc/packages/tcllib/README-1.13.txt - Update to version 1.14 * New module and packages: + oo::util: right now only easy referencing of instance methods for callbacks + lambda: easy anonymous procedures for Tcl 8.5+ + try: Tcl 8.5+ forward compatibility implementation of try/catch/finally (TIP 329) + valtype: validation types, snit validation types for various classes of numbers (ISBN, EAN, ...) and general check-digit algorithms (luhn(5), verhoeff, ...). * Bufixes, for details see /usr/share/doc/packages/tcllib/README-1.14.txt - examples/ftp/hpupdate.tcl is under GPL-2.0+ - New version: 1.13. - For details, see /usr/share/doc/packages/tcllib/README-1.13.txt - New version: 1.11.1, which adds the modules cache and map. - New version: 1.11 - Added packages and modules: * amazon-s3: access to amazon's S3 service * xsxp: XML processing helper * picoirc: minimal irc client * simulation: simulation tools * stringprep, unicode: preparation for internationalized strings * struct::disjointset: union-merge structure * huddle: generic serialization format * yaml: YAML processing - Modules that got new features and/or bug fixes: aes, asn, base64, bench, blowfish, cmdline, comm, crc, dns, doctools, fileutil, ftp, ftpd, grammar_fa, htmlparse, http, inifile, jpeg, ldap, log, math, md4, md5, md5crypt, mime, nmea, nns, pluginmgr, sasl, term. textutil, tie, tiff, transfer, uev, wip - Details can be found under /usr/share/doc/packages/tcllib . - New version: 1.10 - Added modules: * mapproj: Map projections * nns: nameservice * uevent: user events * wip: word interpreter - Modules that got new features and/or bug fixes: asn, base64, bench, blowfish, comm, des, dns, doctools, fileutil, ftp, ftpd, grammar, http, inifile, interp, ldap, log, math, mime, nmea, page, png, sasl, sha1, snit, struct, tar, uri. - Details can be found under /usr/share/doc/packages/tcllib . - New version: 1.9 - Added modules: base32: Base32 encoding bench: Benchmarking support interp: Interpreter utilities json: JavaScript Object Notation ldapx: OO wrapper around ldap math::bigfloat: Large FP numbers nmea: NMEA gps messages otp: RFC 2289 One-Time Passwd page: Generator for MEcpu code and graph-based compiler SASL::XGoogleToken: X-GOOGLE-TOKEN auth term: Low-level terminal control tiff: TIFF image manipulation transfer: Classes handling and organizing various types of data transfers across sockets. - Textutil functionality split into separate packages. - Updates and bugfixes to most other modules. - Fixed path and name of tclsh in the examples. - New version 1.3 - Many new modules. See /usr/share/doc/packages/tcllib/ChangeLog for details. - fixed the install script to also install the modules irc, doctools, and stats. - added creation of install dirs - new version: 1.2 - new modules: calendar, crc, doctools, irc, smtpd, and stooop. - A script-only standard library for Tcl/Tk Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2021-171=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): tcllib-1.20-2.1 References: https://bugzilla.suse.com/1105803

1 0

openSUSE-SU-2021:0169-1: important: Security update for sudo
by opensuse-security＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0169-1 Rating: important References: #1180684 #1180685 #1180687 #1181090 Cross-References: CVE-2021-23239 CVE-2021-23240 CVE-2021-3156 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for sudo fixes the following issues: - A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156] - It was possible for a user to test for the existence of a directory due to a Race Condition in `sudoedit` [bsc#1180684,CVE-2021-23239] - A Possible Symlink Attack vector existed in `sudoedit` if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240] - It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-169=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): sudo-1.8.22-lp151.5.12.1 sudo-debuginfo-1.8.22-lp151.5.12.1 sudo-debugsource-1.8.22-lp151.5.12.1 sudo-devel-1.8.22-lp151.5.12.1 sudo-test-1.8.22-lp151.5.12.1 References: https://www.suse.com/security/cve/CVE-2021-23239.html https://www.suse.com/security/cve/CVE-2021-23240.html https://www.suse.com/security/cve/CVE-2021-3156.html https://bugzilla.suse.com/1180684 https://bugzilla.suse.com/1180685 https://bugzilla.suse.com/1180687 https://bugzilla.suse.com/1181090

1 0

openSUSE-SU-2021:0170-1: important: Security update for sudo
by opensuse-security＠opensuse.org 27 Jan '21

27 Jan '21

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0170-1 Rating: important References: #1180684 #1180685 #1180687 #1181090 Cross-References: CVE-2021-23239 CVE-2021-23240 CVE-2021-3156 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for sudo fixes the following issues: - A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156] - It was possible for a user to test for the existence of a directory due to a Race Condition in `sudoedit` [bsc#1180684,CVE-2021-23239] - A Possible Symlink Attack vector existed in `sudoedit` if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240] - It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687] This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-170=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): sudo-1.8.22-lp152.8.6.1 sudo-debuginfo-1.8.22-lp152.8.6.1 sudo-debugsource-1.8.22-lp152.8.6.1 sudo-devel-1.8.22-lp152.8.6.1 sudo-test-1.8.22-lp152.8.6.1 References: https://www.suse.com/security/cve/CVE-2021-23239.html https://www.suse.com/security/cve/CVE-2021-23240.html https://www.suse.com/security/cve/CVE-2021-3156.html https://bugzilla.suse.com/1180684 https://bugzilla.suse.com/1180685 https://bugzilla.suse.com/1180687 https://bugzilla.suse.com/1181090

1 0

openSUSE-RU-2021:0167-1: Recommended update for bpftrace
by maintenance＠opensuse.org 26 Jan '21

26 Jan '21

openSUSE Recommended Update: Recommended update for bpftrace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0167-1 Rating: low References: #1181287 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update rebuilds bpftrace against the last released binutils version. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-167=1 Package List: - openSUSE Leap 15.2 (noarch): bpftrace-tools-0.11.4-lp152.2.5.1 - openSUSE Leap 15.2 (x86_64): bpftrace-0.11.4-lp152.2.5.1 References: https://bugzilla.suse.com/1181287

1 0

openSUSE-RU-2021:0168-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 26 Jan '21

26 Jan '21

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0168-1 Rating: moderate References: #1177460 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for timezone fixes the following issues: - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-168=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): timezone-2020f-lp151.2.19.1 timezone-debuginfo-2020f-lp151.2.19.1 timezone-debugsource-2020f-lp151.2.19.1 - openSUSE Leap 15.1 (noarch): timezone-java-2020f-lp151.2.19.1 References: https://bugzilla.suse.com/1177460

1 0

openSUSE-SU-2021:0166-1: important: Security update for chromium
by opensuse-security＠opensuse.org 26 Jan '21

26 Jan '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0166-1 Rating: important References: #1181137 Cross-References: CVE-2020-16044 CVE-2021-21117 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134 CVE-2021-21135 CVE-2021-21136 CVE-2021-21137 CVE-2021-21138 CVE-2021-21139 CVE-2021-21140 CVE-2021-21141 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 88.0.4324.96 boo#1181137 - CVE-2021-21117: Insufficient policy enforcement in Cryptohome - CVE-2021-21118: Insufficient data validation in V8 - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in WebSQL - CVE-2021-21121: Use after free in Omnibox - CVE-2021-21122: Use after free in Blink - CVE-2021-21123: Insufficient data validation in File System API - CVE-2021-21124: Potential user after free in Speech Recognizer - CVE-2021-21125: Insufficient policy enforcement in File System API - CVE-2020-16044: Use after free in WebRTC - CVE-2021-21126: Insufficient policy enforcement in extensions - CVE-2021-21127: Insufficient policy enforcement in extensions - CVE-2021-21128: Heap buffer overflow in Blink - CVE-2021-21129: Insufficient policy enforcement in File System API - CVE-2021-21130: Insufficient policy enforcement in File System API - CVE-2021-21131: Insufficient policy enforcement in File System API - CVE-2021-21132: Inappropriate implementation in DevTools - CVE-2021-21133: Insufficient policy enforcement in Downloads - CVE-2021-21134: Incorrect security UI in Page Info - CVE-2021-21135: Inappropriate implementation in Performance API - CVE-2021-21136: Insufficient policy enforcement in WebView - CVE-2021-21137: Inappropriate implementation in DevTools - CVE-2021-21138: Use after free in DevTools - CVE-2021-21139: Inappropriate implementation in iframe sandbox - CVE-2021-21140: Uninitialized Use in USB - CVE-2021-21141: Insufficient policy enforcement in File System API Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-166=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-88.0.4324.96-lp151.2.171.1 chromedriver-debuginfo-88.0.4324.96-lp151.2.171.1 chromium-88.0.4324.96-lp151.2.171.1 chromium-debuginfo-88.0.4324.96-lp151.2.171.1 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://www.suse.com/security/cve/CVE-2021-21117.html https://www.suse.com/security/cve/CVE-2021-21118.html https://www.suse.com/security/cve/CVE-2021-21119.html https://www.suse.com/security/cve/CVE-2021-21120.html https://www.suse.com/security/cve/CVE-2021-21121.html https://www.suse.com/security/cve/CVE-2021-21122.html https://www.suse.com/security/cve/CVE-2021-21123.html https://www.suse.com/security/cve/CVE-2021-21124.html https://www.suse.com/security/cve/CVE-2021-21125.html https://www.suse.com/security/cve/CVE-2021-21126.html https://www.suse.com/security/cve/CVE-2021-21127.html https://www.suse.com/security/cve/CVE-2021-21128.html https://www.suse.com/security/cve/CVE-2021-21129.html https://www.suse.com/security/cve/CVE-2021-21130.html https://www.suse.com/security/cve/CVE-2021-21131.html https://www.suse.com/security/cve/CVE-2021-21132.html https://www.suse.com/security/cve/CVE-2021-21133.html https://www.suse.com/security/cve/CVE-2021-21134.html https://www.suse.com/security/cve/CVE-2021-21135.html https://www.suse.com/security/cve/CVE-2021-21136.html https://www.suse.com/security/cve/CVE-2021-21137.html https://www.suse.com/security/cve/CVE-2021-21138.html https://www.suse.com/security/cve/CVE-2021-21139.html https://www.suse.com/security/cve/CVE-2021-21140.html https://www.suse.com/security/cve/CVE-2021-21141.html https://bugzilla.suse.com/1181137

1 0