December 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1637-1: moderate: Recommended update for llvm9
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for llvm9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1637-1 Rating: moderate References: #1173202 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for llvm9 fixes the following issues: - Fix miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1637=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): clang9-9.0.1-lp152.2.3.80 clang9-checker-9.0.1-lp152.2.3.80 clang9-debuginfo-9.0.1-lp152.2.3.80 clang9-devel-9.0.1-lp152.2.3.80 libLLVM9-9.0.1-lp152.2.3.80 libLLVM9-debuginfo-9.0.1-lp152.2.3.80 libLTO9-9.0.1-lp152.2.3.80 libLTO9-debuginfo-9.0.1-lp152.2.3.80 libclang9-9.0.1-lp152.2.3.80 libclang9-debuginfo-9.0.1-lp152.2.3.80 libomp9-devel-9.0.1-lp152.2.3.80 libomp9-devel-debuginfo-9.0.1-lp152.2.3.80 lld9-9.0.1-lp152.2.3.80 lld9-debuginfo-9.0.1-lp152.2.3.80 llvm9-9.0.1-lp152.2.3.80 llvm9-LTO-devel-9.0.1-lp152.2.3.80 llvm9-debuginfo-9.0.1-lp152.2.3.80 llvm9-debugsource-9.0.1-lp152.2.3.80 llvm9-devel-9.0.1-lp152.2.3.80 llvm9-devel-debuginfo-9.0.1-lp152.2.3.80 llvm9-gold-9.0.1-lp152.2.3.80 llvm9-gold-debuginfo-9.0.1-lp152.2.3.80 llvm9-polly-9.0.1-lp152.2.3.80 llvm9-polly-debuginfo-9.0.1-lp152.2.3.80 llvm9-polly-devel-9.0.1-lp152.2.3.80 - openSUSE Leap 15.2 (noarch): clang9-doc-9.0.1-lp152.2.3.80 llvm9-doc-9.0.1-lp152.2.3.80 llvm9-opt-viewer-9.0.1-lp152.2.3.80 llvm9-vim-plugins-9.0.1-lp152.2.3.80 python3-clang-9.0.1-lp152.2.3.80 - openSUSE Leap 15.2 (x86_64): clang9-devel-32bit-9.0.1-lp152.2.3.80 libLLVM9-32bit-9.0.1-lp152.2.3.80 libLLVM9-32bit-debuginfo-9.0.1-lp152.2.3.80 libLTO9-32bit-9.0.1-lp152.2.3.80 libLTO9-32bit-debuginfo-9.0.1-lp152.2.3.80 libc++-devel-9.0.1-lp152.2.3.80 libc++1-9.0.1-lp152.2.3.80 libc++1-debuginfo-9.0.1-lp152.2.3.80 libc++abi-devel-9.0.1-lp152.2.3.80 libc++abi1-9.0.1-lp152.2.3.80 libc++abi1-debuginfo-9.0.1-lp152.2.3.80 libclang9-32bit-9.0.1-lp152.2.3.80 libclang9-32bit-debuginfo-9.0.1-lp152.2.3.80 liblldb9-9.0.1-lp152.2.3.80 liblldb9-debuginfo-9.0.1-lp152.2.3.80 lldb9-9.0.1-lp152.2.3.80 lldb9-debuginfo-9.0.1-lp152.2.3.80 lldb9-devel-9.0.1-lp152.2.3.80 llvm9-LTO-devel-32bit-9.0.1-lp152.2.3.80 llvm9-devel-32bit-9.0.1-lp152.2.3.80 llvm9-devel-32bit-debuginfo-9.0.1-lp152.2.3.80 python3-lldb9-9.0.1-lp152.2.3.80 References: https://bugzilla.suse.com/1173202

1 0

openSUSE-RU-2021:1636-1: moderate: Recommended update for seamonkey
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Recommended Update: Recommended update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1636-1 Rating: moderate References: #1194114 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Seamonkey was updated to 2.53.10.2: * Obtain Windows code-signing certificate for SeaMonkey binary and update signing bug 1438084. * Support SHA-2 hashes in CertIDs in OCSP responses - port of bug 1746221. * Fix rust 1.57 Windows linking for SeaMonkey 2.53 bug 1746785. * SeaMonkey 2.53.10.2 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * Additional important security fixes up to Current Firefox 91.4.1 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. * SeaMonkey 2.53.10.2 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1636=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 x86_64): seamonkey-2.53.10.2-bp153.15.1 seamonkey-dom-inspector-2.53.10.2-bp153.15.1 seamonkey-irc-2.53.10.2-bp153.15.1 References: https://bugzilla.suse.com/1194114

1 0

openSUSE-FU-2021:4198-1: moderate: Feature update for ssh-import-id
by maintenance＠opensuse.org 30 Dec '21

30 Dec '21

openSUSE Feature Update: Feature update for ssh-import-id ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:4198-1 Rating: moderate References: #1154502 SLE-20868 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one feature fix and contains one feature can now be installed. Description: This feature update for ssh-import-id provides the following feature: - Support importing public ssh keys from GitHub (jsc#SLE-20868, bsc#1154502) Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4198=1 Package List: - openSUSE Leap 15.3 (noarch): ssh-import-id-5.11-5.5.1 References: https://bugzilla.suse.com/1154502

1 0

openSUSE-SU-2021:1635-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1635-1 Rating: important References: #1182863 #1189547 #1190244 #1190269 #1191332 #1192250 #1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38493 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 CVE-2021-38502 CVE-2021-38503 CVE-2021-38504 CVE-2021-38505 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 CVE-2021-38510 CVE-2021-40529 CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 CVSS scores: CVE-2021-29991 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-32810 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-32810 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-38492 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38493 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38497 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38498 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-38501 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-38507 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-38509 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43536 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43537 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43538 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-43539 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43541 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-43542 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-43543 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-43545 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 (bsc#1193485) - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both - CVE-2021-43539: GC rooting failure when calling wasm instance methods - CVE-2021-43541: External protocol handler parameters were unescaped - CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler - CVE-2021-43543: Bypass of CSP sandbox directive when embedding - CVE-2021-43545: Denial of Service when using the Location API in a loop - CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed - CVE-2021-43528: JavaScript unexpectedly enabled for the composition area - Update to version 91.3.2 - CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244) - Update to version 91.3 MFSA 2021-50 (bsc#1192250) - CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets - CVE-2021-38504: Fixed use-after-free in file picker dialog - CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data - CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning - CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports - CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing - CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain - CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS - Fixed plain text reformatting regression (bsc#1182863) - Update to version 91.2 MFSA 2021-47 (bsc#1191332) - CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT - CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion - CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux - CVE-2021-32810: Data race in crossbeam-deque - CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1 - CVE-2021-38496: Use-after-free in MessageTask - CVE-2021-38497: Validation message could have been overlaid on another origin - CVE-2021-38498: Use-after-free of nsLanguageAtomService object - CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2 - CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections - Update to version 91.1.0 MFSA 2021-41 (bsc#1190269) - CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer - CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1 - Update to version 91.0.1 MFSA 2021-37 (bsc#1189547) - CVE-2021-29991: Header Splitting possible with HTTP/3 Responses This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1635=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-91.4.0-lp152.2.52.1 MozillaThunderbird-debuginfo-91.4.0-lp152.2.52.1 MozillaThunderbird-debugsource-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-common-91.4.0-lp152.2.52.1 MozillaThunderbird-translations-other-91.4.0-lp152.2.52.1 References: https://www.suse.com/security/cve/CVE-2021-29981.html https://www.suse.com/security/cve/CVE-2021-29982.html https://www.suse.com/security/cve/CVE-2021-29987.html https://www.suse.com/security/cve/CVE-2021-29991.html https://www.suse.com/security/cve/CVE-2021-32810.html https://www.suse.com/security/cve/CVE-2021-38492.html https://www.suse.com/security/cve/CVE-2021-38493.html https://www.suse.com/security/cve/CVE-2021-38495.html https://www.suse.com/security/cve/CVE-2021-38496.html https://www.suse.com/security/cve/CVE-2021-38497.html https://www.suse.com/security/cve/CVE-2021-38498.html https://www.suse.com/security/cve/CVE-2021-38500.html https://www.suse.com/security/cve/CVE-2021-38501.html https://www.suse.com/security/cve/CVE-2021-38502.html https://www.suse.com/security/cve/CVE-2021-38503.html https://www.suse.com/security/cve/CVE-2021-38504.html https://www.suse.com/security/cve/CVE-2021-38505.html https://www.suse.com/security/cve/CVE-2021-38506.html https://www.suse.com/security/cve/CVE-2021-38507.html https://www.suse.com/security/cve/CVE-2021-38508.html https://www.suse.com/security/cve/CVE-2021-38509.html https://www.suse.com/security/cve/CVE-2021-38510.html https://www.suse.com/security/cve/CVE-2021-40529.html https://www.suse.com/security/cve/CVE-2021-43528.html https://www.suse.com/security/cve/CVE-2021-43536.html https://www.suse.com/security/cve/CVE-2021-43537.html https://www.suse.com/security/cve/CVE-2021-43538.html https://www.suse.com/security/cve/CVE-2021-43539.html https://www.suse.com/security/cve/CVE-2021-43541.html https://www.suse.com/security/cve/CVE-2021-43542.html https://www.suse.com/security/cve/CVE-2021-43543.html https://www.suse.com/security/cve/CVE-2021-43545.html https://www.suse.com/security/cve/CVE-2021-43546.html https://bugzilla.suse.com/1182863 https://bugzilla.suse.com/1189547 https://bugzilla.suse.com/1190244 https://bugzilla.suse.com/1190269 https://bugzilla.suse.com/1191332 https://bugzilla.suse.com/1192250 https://bugzilla.suse.com/1193485

1 0

openSUSE-RU-2021:4195-1: important: Recommended update for autoyast2 and yast2
by maintenance＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Recommended Update: Recommended update for autoyast2 and yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:4195-1 Rating: important References: #1188211 #1192185 #1192437 #1193784 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for autoyast2 and yast2 fixes the following issues: autoyast2: - During autoupgrade, merge the selected product workflow in order to execute 2nd stage modules (bsc#1192437) - Process the `add-on` section only during 1st stage and not again during the 2nd stage (bsc#1192185) - Stop autoyast installation when registration failed on online medium (bsc#1188211) yast2: - Do not reinitialize the packaging system during offline upgrade (bsc#1193784, bsc#1192437) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4195=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): yast2-4.3.66-3.14.1 yast2-logs-4.3.66-3.14.1 - openSUSE Leap 15.3 (noarch): autoyast2-4.3.94-3.32.1 autoyast2-installation-4.3.94-3.32.1 References: https://bugzilla.suse.com/1188211 https://bugzilla.suse.com/1192185 https://bugzilla.suse.com/1192437 https://bugzilla.suse.com/1193784

1 0

openSUSE-RU-2021:4194-1: important: Recommended update for openssl-ibmca
by maintenance＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Recommended Update: Recommended update for openssl-ibmca ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:4194-1 Rating: important References: #1004463 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openssl-ibmca fixes the following issues: - Use the ".include" directive to update the openssl.cnf file and make checking of line count in sample file unnecessary (bsc#1004463) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4194=1 Package List: - openSUSE Leap 15.3 (s390x): openssl-ibmca-2.1.1-3.3.1 openssl-ibmca-debuginfo-2.1.1-3.3.1 openssl-ibmca-debugsource-2.1.1-3.3.1 References: https://bugzilla.suse.com/1004463

1 0

openSUSE-RU-2021:1634-1: moderate: Recommended update for konqueror
by maintenance＠opensuse.org 29 Dec '21

29 Dec '21

openSUSE Recommended Update: Recommended update for konqueror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1634-1 Rating: moderate References: #1173711 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for konqueror fixes the following issues: - Always display the introduction page using webenginepart, as that's the only html rendering part that supports it (boo#1173711) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1634=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1634=1 Package List: - openSUSE Leap 15.2 (noarch): konqueror-lang-20.04.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): konqueror-20.04.2-lp152.2.3.1 konqueror-debuginfo-20.04.2-lp152.2.3.1 konqueror-debugsource-20.04.2-lp152.2.3.1 konqueror-devel-20.04.2-lp152.2.3.1 konqueror-plugins-20.04.2-lp152.2.3.1 konqueror-plugins-debuginfo-20.04.2-lp152.2.3.1 webenginepart-20.04.2-lp152.2.3.1 webenginepart-debuginfo-20.04.2-lp152.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 x86_64): konqueror-20.04.2-bp153.2.5.1 konqueror-devel-20.04.2-bp153.2.5.1 konqueror-plugins-20.04.2-bp153.2.5.1 webenginepart-20.04.2-bp153.2.5.1 - openSUSE Backports SLE-15-SP3 (noarch): konqueror-lang-20.04.2-bp153.2.5.1 References: https://bugzilla.suse.com/1173711

1 0

openSUSE-SU-2021:4192-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:4192-1 Rating: moderate References: #1174504 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for permissions fixes the following issues: - Update to version 20181225: * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-4192=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): permissions-20181225-23.9.1 permissions-debuginfo-20181225-23.9.1 permissions-debugsource-20181225-23.9.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20181225-23.9.1 References: https://bugzilla.suse.com/1174504

1 0

openSUSE-RU-2021:1633-1: moderate: Recommended update for chromium
by maintenance＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Recommended Update: Recommended update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1633-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for chromium fixes the following issues: Various build related fixes: - Unbundle freetype on TW - Unbundle icu on 15.4 - Disable lto and update _constraints on aarch64 - Remove MEIPreload: it gets installed through component updater Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1633=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-96.0.4664.110-bp153.2.51.1 chromium-96.0.4664.110-bp153.2.51.1 References:

1 0

openSUSE-SU-2021:1632-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Dec '21

28 Dec '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1632-1 Rating: important References: #1192310 #1192734 #1193519 #1193713 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 CVE-2021-4078 CVE-2021-4079 CVE-2021-4098 CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 96.0.4664.110 (boo#1193713): * CVE-2021-4098: Insufficient data validation in Mojo * CVE-2021-4099: Use after free in Swiftshader * CVE-2021-4100: Object lifecycle issue in ANGLE * CVE-2021-4101: Heap buffer overflow in Swiftshader * CVE-2021-4102: Use after free in V8 Lord of the Browsers: The Two Compilers: * Go back to GCC * GCC: LTO removes needed assembly symbols * Clang: issues with libstdc++ Chromium 96.0.4664.93 (boo#1193519): * CVE-2021-4052: Use after free in web apps * CVE-2021-4053: Use after free in UI * CVE-2021-4079: Out of bounds write in WebRTC * CVE-2021-4054: Incorrect security UI in autofill * CVE-2021-4078: Type confusion in V8 * CVE-2021-4055: Heap buffer overflow in extensions * CVE-2021-4056: Type Confusion in loader * CVE-2021-4057: Use after free in file API * CVE-2021-4058: Heap buffer overflow in ANGLE * CVE-2021-4059: Insufficient data validation in loader * CVE-2021-4061: Type Confusion in V8 * CVE-2021-4062: Heap buffer overflow in BFCache * CVE-2021-4063: Use after free in developer tools * CVE-2021-4064: Use after free in screen capture * CVE-2021-4065: Use after free in autofill * CVE-2021-4066: Integer underflow in ANGLE * CVE-2021-4067: Use after free in window manager * CVE-2021-4068: Insufficient validation of untrusted input in new tab page Chromium 96.0.4664.45 (boo#1192734): * CVE-2021-38007: Type Confusion in V8 * CVE-2021-38008: Use after free in media * CVE-2021-38009: Inappropriate implementation in cache * CVE-2021-38006: Use after free in storage foundation * CVE-2021-38005: Use after free in loader * CVE-2021-38010: Inappropriate implementation in service workers * CVE-2021-38011: Use after free in storage foundation * CVE-2021-38012: Type Confusion in V8 * CVE-2021-38013: Heap buffer overflow in fingerprint recognition * CVE-2021-38014: Out of bounds write in Swiftshader * CVE-2021-38015: Inappropriate implementation in input * CVE-2021-38016: Insufficient policy enforcement in background fetch * CVE-2021-38017: Insufficient policy enforcement in iframe sandbox * CVE-2021-38018: Inappropriate implementation in navigation * CVE-2021-38019: Insufficient policy enforcement in CORS * CVE-2021-38020: Insufficient policy enforcement in contacts picker * CVE-2021-38021: Inappropriate implementation in referrer * CVE-2021-38022: Inappropriate implementation in WebAuthentication Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1632=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-96.0.4664.110-lp152.2.143.1 chromedriver-debuginfo-96.0.4664.110-lp152.2.143.1 chromium-96.0.4664.110-lp152.2.143.1 chromium-debuginfo-96.0.4664.110-lp152.2.143.1 References: https://www.suse.com/security/cve/CVE-2021-38005.html https://www.suse.com/security/cve/CVE-2021-38006.html https://www.suse.com/security/cve/CVE-2021-38007.html https://www.suse.com/security/cve/CVE-2021-38008.html https://www.suse.com/security/cve/CVE-2021-38009.html https://www.suse.com/security/cve/CVE-2021-38010.html https://www.suse.com/security/cve/CVE-2021-38011.html https://www.suse.com/security/cve/CVE-2021-38012.html https://www.suse.com/security/cve/CVE-2021-38013.html https://www.suse.com/security/cve/CVE-2021-38014.html https://www.suse.com/security/cve/CVE-2021-38015.html https://www.suse.com/security/cve/CVE-2021-38016.html https://www.suse.com/security/cve/CVE-2021-38017.html https://www.suse.com/security/cve/CVE-2021-38018.html https://www.suse.com/security/cve/CVE-2021-38019.html https://www.suse.com/security/cve/CVE-2021-38020.html https://www.suse.com/security/cve/CVE-2021-38021.html https://www.suse.com/security/cve/CVE-2021-38022.html https://www.suse.com/security/cve/CVE-2021-4052.html https://www.suse.com/security/cve/CVE-2021-4053.html https://www.suse.com/security/cve/CVE-2021-4054.html https://www.suse.com/security/cve/CVE-2021-4055.html https://www.suse.com/security/cve/CVE-2021-4056.html https://www.suse.com/security/cve/CVE-2021-4057.html https://www.suse.com/security/cve/CVE-2021-4058.html https://www.suse.com/security/cve/CVE-2021-4059.html https://www.suse.com/security/cve/CVE-2021-4061.html https://www.suse.com/security/cve/CVE-2021-4062.html https://www.suse.com/security/cve/CVE-2021-4063.html https://www.suse.com/security/cve/CVE-2021-4064.html https://www.suse.com/security/cve/CVE-2021-4065.html https://www.suse.com/security/cve/CVE-2021-4066.html https://www.suse.com/security/cve/CVE-2021-4067.html https://www.suse.com/security/cve/CVE-2021-4068.html https://www.suse.com/security/cve/CVE-2021-4078.html https://www.suse.com/security/cve/CVE-2021-4079.html https://www.suse.com/security/cve/CVE-2021-4098.html https://www.suse.com/security/cve/CVE-2021-4099.html https://www.suse.com/security/cve/CVE-2021-4100.html https://www.suse.com/security/cve/CVE-2021-4101.html https://www.suse.com/security/cve/CVE-2021-4102.html https://bugzilla.suse.com/1192310 https://bugzilla.suse.com/1192734 https://bugzilla.suse.com/1193519 https://bugzilla.suse.com/1193713

1 0