November 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1436-1: important: Security update for mailman
by opensuse-security＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1436-1 Rating: important References: #1047218 #1191959 #1191960 Cross-References: CVE-2021-42096 CVE-2021-42097 CVSS scores: CVE-2021-42096 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-42097 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for mailman fixes the following issues: Update to 2.1.35 to fix 2 security issues: - A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-42096 (boo#1191959, LP:#1947639) - A CSRF attack via the user options page could allow takeover of a users account. This is fixed. CVE-2021-42097 (boo#1191960, LP:#1947640) - make package build reproducible (boo#1047218) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1436=1 Package List: - openSUSE Leap 15.2 (x86_64): mailman-2.1.35-lp152.7.6.1 mailman-debuginfo-2.1.35-lp152.7.6.1 mailman-debugsource-2.1.35-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2021-42096.html https://www.suse.com/security/cve/CVE-2021-42097.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1191959 https://bugzilla.suse.com/1191960

1 0

openSUSE-RU-2021:1437-1: moderate: Recommended update for trytond
by maintenance＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Recommended Update: Recommended update for trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1437-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond fixes the following issues: - Added to force update of XML files Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1437=1 Package List: - openSUSE Leap 15.2 (noarch): trytond-5.0.36-lp152.2.28.1 References:

1 0

openSUSE-RU-2021:1435-1: moderate: Recommended update for MozillaFirefox
by maintenance＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Recommended Update: Recommended update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1435-1 Rating: moderate References: #1190141 #1191815 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: - Allow accessing /proc/sys/crypto/fips_enabled from within the newly introduced socket process sandbox. (bsc#1191815, bsc#1190141) - Add a way to let users overwrite MOZ_ENABLE_WAYLAND This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1435=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-91.2.0-lp152.2.70.1 MozillaFirefox-branding-upstream-91.2.0-lp152.2.70.1 MozillaFirefox-debuginfo-91.2.0-lp152.2.70.1 MozillaFirefox-debugsource-91.2.0-lp152.2.70.1 MozillaFirefox-devel-91.2.0-lp152.2.70.1 MozillaFirefox-translations-common-91.2.0-lp152.2.70.1 MozillaFirefox-translations-other-91.2.0-lp152.2.70.1 References: https://bugzilla.suse.com/1190141 https://bugzilla.suse.com/1191815

1 0

openSUSE-RU-2021:3590-1: moderate: Recommended update for libyui
by maintenance＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Recommended Update: Recommended update for libyui ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3590-1 Rating: moderate References: #1191130 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libyui fixes the following issues: - Fixed crash in NCurses online update when retracted packages are present (bsc#1191130) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3590=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libyui-bindings-debuginfo-4.1.5-3.6.1 libyui-bindings-debugsource-4.1.5-3.6.1 libyui-debugsource-4.1.5-3.6.1 libyui-devel-4.1.5-3.6.1 libyui-ncurses-debugsource-4.1.5-3.6.1 libyui-ncurses-devel-4.1.5-3.6.1 libyui-ncurses-pkg-debugsource-4.1.5-3.6.1 libyui-ncurses-pkg-devel-4.1.5-3.6.1 libyui-ncurses-pkg15-4.1.5-3.6.1 libyui-ncurses-pkg15-debuginfo-4.1.5-3.6.1 libyui-ncurses-rest-api-debugsource-4.1.5-3.6.1 libyui-ncurses-rest-api-devel-4.1.5-3.6.1 libyui-ncurses-rest-api15-4.1.5-3.6.1 libyui-ncurses-rest-api15-debuginfo-4.1.5-3.6.1 libyui-ncurses-tools-4.1.5-3.6.1 libyui-ncurses15-4.1.5-3.6.1 libyui-ncurses15-debuginfo-4.1.5-3.6.1 libyui-qt-debugsource-4.1.5-3.6.1 libyui-qt-devel-4.1.5-3.6.1 libyui-qt-graph-debugsource-4.1.5-3.6.1 libyui-qt-graph-devel-4.1.5-3.6.1 libyui-qt-graph15-4.1.5-3.6.1 libyui-qt-graph15-debuginfo-4.1.5-3.6.1 libyui-qt-pkg-debugsource-4.1.5-3.6.1 libyui-qt-pkg-devel-4.1.5-3.6.1 libyui-qt-pkg15-4.1.5-3.6.1 libyui-qt-pkg15-debuginfo-4.1.5-3.6.1 libyui-qt-rest-api-debugsource-4.1.5-3.6.1 libyui-qt-rest-api-devel-4.1.5-3.6.1 libyui-qt-rest-api15-4.1.5-3.6.1 libyui-qt-rest-api15-debuginfo-4.1.5-3.6.1 libyui-qt15-4.1.5-3.6.1 libyui-qt15-debuginfo-4.1.5-3.6.1 libyui-rest-api-debugsource-4.1.5-3.6.1 libyui-rest-api-devel-4.1.5-3.6.1 libyui-rest-api15-4.1.5-3.6.1 libyui-rest-api15-debuginfo-4.1.5-3.6.1 libyui15-4.1.5-3.6.1 libyui15-debuginfo-4.1.5-3.6.1 perl-yui-4.1.5-3.6.1 perl-yui-debuginfo-4.1.5-3.6.1 python3-yui-4.1.5-3.6.1 python3-yui-debuginfo-4.1.5-3.6.1 ruby-yui-4.1.5-3.6.1 ruby-yui-debuginfo-4.1.5-3.6.1 References: https://bugzilla.suse.com/1191130

1 0

openSUSE-RU-2021:3591-1: moderate: Recommended update for man-pages
by maintenance＠opensuse.org 02 Nov '21

02 Nov '21

openSUSE Recommended Update: Recommended update for man-pages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3591-1 Rating: moderate References: #1185534 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for man-pages fixes the following issues: - Added missing manual entry for kernel_lockdown in section 7 (bsc#1185534) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3591=1 Package List: - openSUSE Leap 15.3 (noarch): man-pages-4.16-13.3.1 References: https://bugzilla.suse.com/1185534

1 0

openSUSE-RU-2021:3589-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 01 Nov '21

01 Nov '21

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3589-1 Rating: moderate References: #1191690 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apparmor fixes the following issues: - Fixed an issue when apparmor provides python2 and python3 libraries with the same name. (bsc#1191690) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3589=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_apparmor-2.13.6-3.3.1 apache2-mod_apparmor-debuginfo-2.13.6-3.3.1 apparmor-debugsource-2.13.6-3.3.1 apparmor-parser-2.13.6-3.3.1 apparmor-parser-debuginfo-2.13.6-3.3.1 libapparmor-debugsource-2.13.6-3.3.1 libapparmor-devel-2.13.6-3.3.1 libapparmor1-2.13.6-3.3.1 libapparmor1-debuginfo-2.13.6-3.3.1 pam_apparmor-2.13.6-3.3.1 pam_apparmor-debuginfo-2.13.6-3.3.1 perl-apparmor-2.13.6-3.3.1 perl-apparmor-debuginfo-2.13.6-3.3.1 python3-apparmor-2.13.6-3.3.1 python3-apparmor-debuginfo-2.13.6-3.3.1 ruby-apparmor-2.13.6-3.3.1 ruby-apparmor-debuginfo-2.13.6-3.3.1 - openSUSE Leap 15.3 (noarch): apparmor-abstractions-2.13.6-3.3.1 apparmor-docs-2.13.6-3.3.1 apparmor-parser-lang-2.13.6-3.3.1 apparmor-profiles-2.13.6-3.3.1 apparmor-utils-2.13.6-3.3.1 apparmor-utils-lang-2.13.6-3.3.1 - openSUSE Leap 15.3 (x86_64): libapparmor1-32bit-2.13.6-3.3.1 libapparmor1-32bit-debuginfo-2.13.6-3.3.1 pam_apparmor-32bit-2.13.6-3.3.1 pam_apparmor-32bit-debuginfo-2.13.6-3.3.1 References: https://bugzilla.suse.com/1191690

1 0

openSUSE-SU-2021:1434-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Nov '21

01 Nov '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1434-1 Rating: important References: Cross-References: CVE-2021-37974 CVE-2021-37975 CVE-2021-37976 CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 80.0.4170.63 - CHR-8612 Update chromium on desktop-stable-94-4170 to 94.0.4606.81 - DNA-95434 Crash at opera::ThemesService::UpdateCurrentTheme() - The update to chromium 94.0.4606.81 fixes following issues: CVE-2021-37977, CVE-2021-37978, CVE-2021-37979, CVE-2021-37980 Opera was updated to version 80.0.4170.40 - CHR-8598 Update chromium on desktop-stable-94-4170 to 94.0.4606.71 - DNA-95221 Emoji button stuck in address bar - DNA-95325 Make y.at navigations to be reported with page_views events - DNA-95327 Add ��Emojis�� context menu option in address bar field - DNA-95339 Add YAT emoji url suggestion to search�� dialog - DNA-95416 Remove emoji button from address bar - DNA-95439 Enable #yat-emoji-addresses on developer stream - DNA-95441 [Mac big sur] Emoji are not shown in address bar url - DNA-95514 Crash at resource_coordinator::TabLifecycleUnitSource ::TabLifecycleUnit::OnLifecycleUnitStateChanged(mojom:: LifecycleUnitState, mojom::LifecycleUnitStateChangeReason) - DNA-95746 Enable #reader-mode everywhere - DNA-95865 Numbers are recognized as emojis - DNA-95866 Change Yat text in selection popup - DNA-95867 Show that buttons are clickable in selection popup - The update to chromium 94.0.4606.71 fixes following issues: CVE-2021-37974, CVE-2021-37975, CVE-2021-37976 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1434=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-80.0.4170.63-lp153.2.27.1 References: https://www.suse.com/security/cve/CVE-2021-37974.html https://www.suse.com/security/cve/CVE-2021-37975.html https://www.suse.com/security/cve/CVE-2021-37976.html https://www.suse.com/security/cve/CVE-2021-37977.html https://www.suse.com/security/cve/CVE-2021-37978.html https://www.suse.com/security/cve/CVE-2021-37979.html https://www.suse.com/security/cve/CVE-2021-37980.html

1 0

openSUSE-SU-2021:1433-1: important: Security update for opera
by opensuse-security＠opensuse.org 01 Nov '21

01 Nov '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1433-1 Rating: important References: Cross-References: CVE-2021-37974 CVE-2021-37975 CVE-2021-37976 CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: Opera was updated to version 80.0.4170.63 - CHR-8612 Update chromium on desktop-stable-94-4170 to 94.0.4606.81 - DNA-95434 Crash at opera::ThemesService::UpdateCurrentTheme() - The update to chromium 94.0.4606.81 fixes following issues: CVE-2021-37977, CVE-2021-37978, CVE-2021-37979, CVE-2021-37980 Opera was updated to version 80.0.4170.40 - CHR-8598 Update chromium on desktop-stable-94-4170 to 94.0.4606.71 - DNA-95221 Emoji button stuck in address bar - DNA-95325 Make y.at navigations to be reported with page_views events - DNA-95327 Add ��Emojis�� context menu option in address bar field - DNA-95339 Add YAT emoji url suggestion to search�� dialog - DNA-95416 Remove emoji button from address bar - DNA-95439 Enable #yat-emoji-addresses on developer stream - DNA-95441 [Mac big sur] Emoji are not shown in address bar url - DNA-95514 Crash at resource_coordinator::TabLifecycleUnitSource ::TabLifecycleUnit::OnLifecycleUnitStateChanged(mojom:: LifecycleUnitState, mojom::LifecycleUnitStateChangeReason) - DNA-95746 Enable #reader-mode everywhere - DNA-95865 Numbers are recognized as emojis - DNA-95866 Change Yat text in selection popup - DNA-95867 Show that buttons are clickable in selection popup - The update to chromium 94.0.4606.71 fixes following issues: CVE-2021-37974, CVE-2021-37975, CVE-2021-37976 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1433=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-80.0.4170.63-lp152.2.73.1 References: https://www.suse.com/security/cve/CVE-2021-37974.html https://www.suse.com/security/cve/CVE-2021-37975.html https://www.suse.com/security/cve/CVE-2021-37976.html https://www.suse.com/security/cve/CVE-2021-37977.html https://www.suse.com/security/cve/CVE-2021-37978.html https://www.suse.com/security/cve/CVE-2021-37979.html https://www.suse.com/security/cve/CVE-2021-37980.html

1 0