October 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:3292-1: important: Security update for go1.16
by opensuse-security＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3292-1 Rating: important References: #1182345 #1190589 Cross-References: CVE-2021-39293 CVSS scores: CVE-2021-39293 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.16 fixes the following issues: - Update to go 1.16.8 - CVE-2021-39293: Fixed a buffer overflow issue in preallocation check that can cause OOM panic. (bas#) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3292=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.8-1.26.1 go1.16-doc-1.16.8-1.26.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.8-1.26.1 References: https://www.suse.com/security/cve/CVE-2021-39293.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1190589

1 0

openSUSE-SU-2021:3300-1: Security update for git
by opensuse-security＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3300-1 Rating: low References: #1189992 Cross-References: CVE-2021-40330 CVSS scores: CVE-2021-40330 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: - CVE-2021-40330: Fixed unexpected cross-protocol requests via newline character in git_connect_git repository path (bsc#1189992). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3300=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): git-svn-debuginfo-2.26.2-33.1 References: https://www.suse.com/security/cve/CVE-2021-40330.html https://bugzilla.suse.com/1189992

1 0

openSUSE-RU-2021:3306-1: moderate: Recommended update for numactl
by maintenance＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Recommended Update: Recommended update for numactl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3306-1 Rating: moderate References: SLE-17217 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for numactl fixes the following issues: - Fix System call numbers on s390x. - Debug verify for --preferred option. - Description for the usage of numactl. - Varios memleacks on source files: sysfs.c, shm.c and numactl.c - Description for numa_node_size64 and definition for numa_node_size in manpage. - link with -latomic when needed. - Clear race conditions on numa_police_memory(). - numademo: Use first two nodes instead of node 0 and 1 - Enhance _service settings - Enable automake Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3306=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libnuma-devel-2.0.14.20.g4ee5e0c-10.1 libnuma1-2.0.14.20.g4ee5e0c-10.1 libnuma1-debuginfo-2.0.14.20.g4ee5e0c-10.1 numactl-2.0.14.20.g4ee5e0c-10.1 numactl-debuginfo-2.0.14.20.g4ee5e0c-10.1 numactl-debugsource-2.0.14.20.g4ee5e0c-10.1 - openSUSE Leap 15.3 (x86_64): libnuma1-32bit-2.0.14.20.g4ee5e0c-10.1 libnuma1-32bit-debuginfo-2.0.14.20.g4ee5e0c-10.1 References:

1 0

openSUSE-SU-2021:3294-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3294-1 Rating: important References: #1188917 Cross-References: CVE-2021-22930 CVSS scores: CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nodejs8 was updated to fix the following security issues: - CVE-2021-22930: http2: fixes use after free on close in stream canceling (bsc#1188917) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3294=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs8-8.17.0-10.15.11 nodejs8-debuginfo-8.17.0-10.15.11 nodejs8-debugsource-8.17.0-10.15.11 nodejs8-devel-8.17.0-10.15.11 npm8-8.17.0-10.15.11 - openSUSE Leap 15.3 (noarch): nodejs8-docs-8.17.0-10.15.11 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://bugzilla.suse.com/1188917

1 0

openSUSE-RU-2021:3314-1: moderate: Recommended update for xerces-c
by maintenance＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Recommended Update: Recommended update for xerces-c ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3314-1 Rating: moderate References: #1190105 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xerces-c fixes the following issues: - release libxerces-c-3_1 for SLE-15.3 (bsc#1190105) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3314=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libxerces-c-3_1-3.1.4-10.5.1 libxerces-c-3_1-debuginfo-3.1.4-10.5.1 - openSUSE Leap 15.3 (x86_64): libxerces-c-3_1-32bit-3.1.4-10.5.1 libxerces-c-3_1-32bit-debuginfo-3.1.4-10.5.1 References: https://bugzilla.suse.com/1190105

1 0

openSUSE-RU-2021:3309-1: Recommended update for google-roboto-mono-fonts
by maintenance＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Recommended Update: Recommended update for google-roboto-mono-fonts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3309-1 Rating: low References: SLE-17946 SLE-17947 SLE-21182 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains three features can now be installed. Description: This update for google-roboto-mono-fonts fixes the following issue: - Add google-roboto-mono-fonts. (jsc#SLE-21182, jsc#SLE-17946, jsc#SLE-17947) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3309=1 Package List: - openSUSE Leap 15.3 (noarch): google-roboto-mono-fonts-20160111-1.3.2 References:

1 0

openSUSE-RU-2021:3307-1: moderate: Recommended update for virt-what
by maintenance＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Recommended Update: Recommended update for virt-what ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3307-1 Rating: moderate References: #1161850 #1176132 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for virt-what fixes the following issues: - Nutanix Acropolis Hypervisor detection - podman detection - Add "which" to requires Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3307=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): virt-what-1.21-3.3.1 virt-what-debuginfo-1.21-3.3.1 virt-what-debugsource-1.21-3.3.1 References: https://bugzilla.suse.com/1161850 https://bugzilla.suse.com/1176132

1 0

openSUSE-SU-2021:3298-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 06 Oct '21

06 Oct '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3298-1 Rating: moderate References: #1190373 #1190374 Cross-References: CVE-2021-22946 CVE-2021-22947 CVSS scores: CVE-2021-22946 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-22947 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374). - CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3298=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-4.27.1 curl-debuginfo-7.66.0-4.27.1 curl-debugsource-7.66.0-4.27.1 libcurl-devel-7.66.0-4.27.1 libcurl4-7.66.0-4.27.1 libcurl4-debuginfo-7.66.0-4.27.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-4.27.1 libcurl4-32bit-7.66.0-4.27.1 libcurl4-32bit-debuginfo-7.66.0-4.27.1 References: https://www.suse.com/security/cve/CVE-2021-22946.html https://www.suse.com/security/cve/CVE-2021-22947.html https://bugzilla.suse.com/1190373 https://bugzilla.suse.com/1190374

1 0

openSUSE-RU-2021:1337-1: moderate: Recommended update for gedit-plugins
by maintenance＠opensuse.org 05 Oct '21

05 Oct '21

openSUSE Recommended Update: Recommended update for gedit-plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1337-1 Rating: moderate References: #1174749 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gedit-plugins fixes the following issues: - VTE changed its API which makes change directory of terminal failed, this patch updates arguments to match VTE's API (boo#1174749) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1337=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): gedit-plugin-bookmarks-3.28.1-bp153.2.3.1 gedit-plugin-bracketcompletion-3.28.1-bp153.2.3.1 gedit-plugin-charmap-3.28.1-bp153.2.3.1 gedit-plugin-codecomment-3.28.1-bp153.2.3.1 gedit-plugin-colorpicker-3.28.1-bp153.2.3.1 gedit-plugin-colorschemer-3.28.1-bp153.2.3.1 gedit-plugin-commander-3.28.1-bp153.2.3.1 gedit-plugin-dashboard-3.28.1-bp153.2.3.1 gedit-plugin-drawspaces-3.28.1-bp153.2.3.1 gedit-plugin-findinfiles-3.28.1-bp153.2.3.1 gedit-plugin-git-3.28.1-bp153.2.3.1 gedit-plugin-joinlines-3.28.1-bp153.2.3.1 gedit-plugin-multiedit-3.28.1-bp153.2.3.1 gedit-plugin-smartspaces-3.28.1-bp153.2.3.1 gedit-plugin-synctex-3.28.1-bp153.2.3.1 gedit-plugin-terminal-3.28.1-bp153.2.3.1 gedit-plugin-textsize-3.28.1-bp153.2.3.1 gedit-plugin-translate-3.28.1-bp153.2.3.1 gedit-plugin-wordcompletion-3.28.1-bp153.2.3.1 gedit-plugin-zeitgeist-3.28.1-bp153.2.3.1 gedit-plugins-3.28.1-bp153.2.3.1 gedit-plugins-data-3.28.1-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): gedit-plugins-lang-3.28.1-bp153.2.3.1 References: https://bugzilla.suse.com/1174749

1 0

openSUSE-RU-2021:1332-1: important: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 04 Oct '21

04 Oct '21

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1332-1 Rating: important References: #1190858 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ca-certificates-mozilla fixes the following issues: - remove one of the Letsencrypt CAs DST_Root_CA_X3.pem, as it expires September 30th 2021 and openssl certificate chain handling does not handle this correctly in openssl 1.0.2 and older. (bsc#1190858) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1332=1 Package List: - openSUSE Leap 15.2 (noarch): ca-certificates-mozilla-2.44-lp152.2.10.1 References: https://bugzilla.suse.com/1190858

1 0