December 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1640-1: moderate: Security update for c-toxcore
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for c-toxcore ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1640-1 Rating: moderate References: #1193667 Cross-References: CVE-2021-44847 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: c-toxcore was updated fo fix a securiy issue: - CVE-2021-44847: Fixed a buffer overflow in handle_request in DHT.c which could lead to remote DoS and potential code execution (boo#1193667) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1640=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1640=1 Package List: - openSUSE Leap 15.2 (x86_64): c-toxcore-0.2.13-lp152.3.3.1 c-toxcore-daemon-0.2.13-lp152.3.3.1 c-toxcore-daemon-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-debuginfo-0.2.13-lp152.3.3.1 c-toxcore-devel-0.2.13-lp152.3.3.1 libtoxcore2-0.2.13-lp152.3.3.1 libtoxcore2-debuginfo-0.2.13-lp152.3.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): c-toxcore-0.2.13-bp153.2.3.1 c-toxcore-daemon-0.2.13-bp153.2.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-debuginfo-0.2.13-bp153.2.3.1 c-toxcore-devel-0.2.13-bp153.2.3.1 libtoxcore2-0.2.13-bp153.2.3.1 libtoxcore2-debuginfo-0.2.13-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp152.4.3.1 c-toxcore-daemon-0.2.13-bp152.4.3.1 c-toxcore-daemon-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-debuginfo-0.2.13-bp152.4.3.1 c-toxcore-devel-0.2.13-bp152.4.3.1 libtoxcore2-0.2.13-bp152.4.3.1 libtoxcore2-debuginfo-0.2.13-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): c-toxcore-0.2.13-bp151.3.3.1 c-toxcore-daemon-0.2.13-bp151.3.3.1 c-toxcore-devel-0.2.13-bp151.3.3.1 libtoxcore2-0.2.13-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-44847.html https://bugzilla.suse.com/1193667

1 0

openSUSE-SU-2021:1645-1: moderate: Security update for getdata
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for getdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1645-1 Rating: moderate References: #1186251 Cross-References: CVE-2021-20204 CVSS scores: CVE-2021-20204 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20204 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: getdata was updated to 0.11.0, fixing bugs and a security issue: - CVE-2021-20204: Fixed a use after free in _GD_Supports() in encoding.c (boo#1186251) for all relevant changes see: https://github.com/ketiltrout/getdata/releases/tag/v0.11.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1645=1 Package List: - openSUSE Leap 15.2 (x86_64): getdata-0.11.0-lp152.4.3.1 getdata-debuginfo-0.11.0-lp152.4.3.1 getdata-debugsource-0.11.0-lp152.4.3.1 getdata-devel-0.11.0-lp152.4.3.1 getdata-doc-0.11.0-lp152.4.3.1 libf95getdata7-0.11.0-lp152.4.3.1 libf95getdata7-debuginfo-0.11.0-lp152.4.3.1 libfgetdata6-0.11.0-lp152.4.3.1 libfgetdata6-debuginfo-0.11.0-lp152.4.3.1 libgetdata++7-0.11.0-lp152.4.3.1 libgetdata++7-debuginfo-0.11.0-lp152.4.3.1 libgetdata8-0.11.0-lp152.4.3.1 libgetdata8-debuginfo-0.11.0-lp152.4.3.1 perl-getdata-0.11.0-lp152.4.3.1 perl-getdata-debuginfo-0.11.0-lp152.4.3.1 python-getdata-0.11.0-lp152.4.3.1 python-getdata-debuginfo-0.11.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20204.html https://bugzilla.suse.com/1186251

1 0

openSUSE-RU-2021:1644-1: moderate: Recommended update for kopete
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for kopete ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1644-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: kopete was updated to fix a possible crash on exit (kde#436513). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1644=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1644=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1644=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1644=1 Package List: - openSUSE Leap 15.2 (noarch): kopete-lang-20.04.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): kopete-20.04.2-lp152.2.3.1 kopete-debuginfo-20.04.2-lp152.2.3.1 kopete-debugsource-20.04.2-lp152.2.3.1 kopete-devel-20.04.2-lp152.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): kopete-20.04.2-bp153.2.5.1 kopete-debuginfo-20.04.2-bp153.2.5.1 kopete-debugsource-20.04.2-bp153.2.5.1 kopete-devel-20.04.2-bp153.2.5.1 - openSUSE Backports SLE-15-SP3 (noarch): kopete-lang-20.04.2-bp153.2.5.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kopete-20.04.2-bp152.2.3.1 kopete-debuginfo-20.04.2-bp152.2.3.1 kopete-debugsource-20.04.2-bp152.2.3.1 kopete-devel-20.04.2-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): kopete-lang-20.04.2-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): kopete-lang-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (x86_64): kopete-18.12.3-bp151.3.3.1 kopete-devel-18.12.3-bp151.3.3.1 References:

1 0

openSUSE-RU-2021:1641-1: Recommended update for lxd
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1641-1 Rating: low References: #1193649 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: lxd was updated to fix the following issues: - Update to LXD 4.21. The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-21-has-been-released/12860 boo#1193649 + Cluster member groups * Reworked cloud-init support + Trust certificate self-renewal + Restricted disk passthrough in projects + Restricted idmap uid/gid in projects + List all lxc commands with --sub-commands + List instances across all projects with --all-projects + New database-leader cluster role * Consistent units for byte sizes. * Routed networking in virtual machines + Support for ipv4.routes and ipv6.routes on routed type NICs + Option to skip records for NAT-ed addresses in network zones + Allow blocking an IP address family with security filtering options + New ceph.rbd.du storage config option to disable potentially slow rbd du * Optimized moving of instances and volumes between projects * Support for copying/moving custom volumes between cluster members Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1641=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): lxd-4.21-bp153.3.12.1 - openSUSE Backports SLE-15-SP3 (noarch): lxd-bash-completion-4.21-bp153.3.12.1 References: https://bugzilla.suse.com/1193649

1 0

openSUSE-SU-2021:1642-1: moderate: Security update for postrsd
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for postrsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1642-1 Rating: moderate References: #1180251 Cross-References: CVE-2020-35573 CVSS scores: CVE-2020-35573 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: postrsd was updated to release 1.11 [boo#1180251]: * Drop group privileges as well as user privileges * Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. [CVE-2020-35573] - Update to release 1.6 * Fix endianness issue with SHA-1 implementation * Add dual stack support * Make SRS separator configurable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1642=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): postsrsd-1.11-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-35573.html https://bugzilla.suse.com/1180251

1 0

openSUSE-SU-2021:4208-1: moderate: Security update for log4j
by opensuse-security＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4208-1 Rating: moderate References: #1194127 Cross-References: CVE-2021-44832 CVSS scores: CVE-2021-44832 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for log4j fixes the following issues: - CVE-2021-44832: Fixes a remote code execution via JDBC Appender (bsc#1194127) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4208=1 Package List: - openSUSE Leap 15.3 (noarch): log4j-2.17.0-4.16.1 log4j-javadoc-2.17.0-4.16.1 log4j-jcl-2.17.0-4.16.1 log4j-slf4j-2.17.0-4.16.1 References: https://www.suse.com/security/cve/CVE-2021-44832.html https://bugzilla.suse.com/1194127

1 0

openSUSE-RU-2021:1639-1: moderate: Recommended update for f2fs-tools
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for f2fs-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1639-1 Rating: moderate References: #1191235 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for f2fs-tools fixes the following issues: - Update to snapshot 1.14.0+g67 (972d7107) to fix a btrfs bug [boo#1191235] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1639=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): f2fs-tools-1.14.0.g67-bp153.2.3.1 f2fs-tools-devel-1.14.0.g67-bp153.2.3.1 libf2fs8-1.14.0.g67-bp153.2.3.1 libf2fs_format7-1.14.0.g67-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): f2fs-tools-compat-1.14.0.g67-bp153.2.3.1 References: https://bugzilla.suse.com/1191235

1 0

openSUSE-RU-2021:1638-1: moderate: Recommended update for f2fs-tools
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for f2fs-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1638-1 Rating: moderate References: #1191235 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for f2fs-tools fixes the following issues: - Update to snapshot 1.14.0+g67 (972d7107) to fix a btrfs bug (boo#1191235) - Remove /usr/sbin/sg_write_buffer. This file is already provided by sg3_utils as /usr/bin/sg_write_buffer. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1638=1 Package List: - openSUSE Leap 15.2 (x86_64): f2fs-tools-1.14.0.g67-lp152.4.6.1 f2fs-tools-debuginfo-1.14.0.g67-lp152.4.6.1 f2fs-tools-debugsource-1.14.0.g67-lp152.4.6.1 f2fs-tools-devel-1.14.0.g67-lp152.4.6.1 libf2fs8-1.14.0.g67-lp152.4.6.1 libf2fs8-debuginfo-1.14.0.g67-lp152.4.6.1 libf2fs_format7-1.14.0.g67-lp152.4.6.1 libf2fs_format7-debuginfo-1.14.0.g67-lp152.4.6.1 - openSUSE Leap 15.2 (noarch): f2fs-tools-compat-1.14.0.g67-lp152.4.6.1 References: https://bugzilla.suse.com/1191235

1 0

openSUSE-RU-2021:4204-1: moderate: Recommended update for pptp
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for pptp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:4204-1 Rating: moderate References: #1131960 #1191717 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for pptp fixes the following issues: - Fix issue when connecting to Microtic routers (bsc#1191717) - Remove UID related output from routing because not needed and prompts error (bsc#1131960) - Prevent pptpsetup creating world-readable peers file - Allow setting up passwords with quotes and trailing spaces - Fix tunnel file generation to make sure it can be used by a non-root user - Fix a memory leak in pqueue - Fix read and writes beyond allocated memory - Fix Use-After-Free in call close request handler - Allow missing window value to be specified in command line instead of being hardcoded - Randomise call-id to allow connecting with simultaneous pptp sessions - Fix file descriptor in call to ttyname. Resulting error was a common message: "pptp: GRE-to-PPP gateway on (null)" Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4204=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): pptp-1.10.0-3.3.1 pptp-debuginfo-1.10.0-3.3.1 pptp-debugsource-1.10.0-3.3.1 References: https://bugzilla.suse.com/1131960 https://bugzilla.suse.com/1191717

1 0

openSUSE-RU-2021:4205-1: important: Recommended update for yast2-storage-ng
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for yast2-storage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:4205-1 Rating: important References: #1170216 #1193450 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-storage-ng fixes the following issues: - AutoYaST: fixes for reusing encrypted devices, RAIDs and bcache devices. (bsc#1193450) - Fix duplicate PV error detection with disabled multipath. (bsc#1170216) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4205=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): yast2-storage-ng-4.3.59-3.18.1 References: https://bugzilla.suse.com/1170216 https://bugzilla.suse.com/1193450

1 0