February 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0231-1: moderate: Security update for segv_handler
by opensuse-security＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Security Update: Security update for segv_handler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0231-1 Rating: moderate References: #1180665 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for segv_handler fixes the following issues: - Replace by empty package with README explaining the removal for security reasons (boo#1180665). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-231=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): segv_handler-0.0.1-bp152.4.3.1 References: https://bugzilla.suse.com/1180665

1 0

openSUSE-RU-2021:0230-1: Recommended update for hello
by maintenance＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Recommended Update: Recommended update for hello ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0230-1 Rating: low References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides a test update for openSUSE Leap 15.3, using Backports repo. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-230=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): hello-2.10-bp153.2.2.1 - openSUSE Backports SLE-15-SP3 (noarch): hello-lang-2.10-bp153.2.2.1 References:

1 0

openSUSE-SU-2021:0229-1: moderate: Security update for segv_handler
by opensuse-security＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Security Update: Security update for segv_handler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0229-1 Rating: moderate References: #1180665 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for segv_handler fixes the following issues: - Replace by empty package with README explaining the removal for security reasons (boo#1180665). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-229=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): segv_handler-0.0.1-bp151.4.3.1 References: https://bugzilla.suse.com/1180665

1 0

openSUSE-SU-2021:0227-1: moderate: Security update for messagelib
by opensuse-security＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Security Update: Security update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0227-1 Rating: moderate References: #1131885 Cross-References: CVE-2019-10732 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for messagelib fixes the following issues: - CVE-2019-10732: Prevented accidental disclosure of encrypted content when replying (boo#1131885). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-227=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): messagelib-18.12.3-bp151.3.3.1 messagelib-devel-18.12.3-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (noarch): messagelib-lang-18.12.3-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-10732.html https://bugzilla.suse.com/1131885

1 0

openSUSE-RU-2021:0226-1: moderate: Recommended update for sparse
by maintenance＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Recommended Update: Recommended update for sparse ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0226-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for sparse fixes the following issues: sparse was updated to version 0.6.3: * For full list of changes see: https://sparse.docs.kernel.org/en/latest/release-notes/v0.6.3.html update to 0.6.2: * changelog of 0.6.2 is available here: https://sparse.docs.kernel.org/en/latest/release-notes/v0.6.2.html Update to version 0.6.1+20200606: * pre-process: fix a compiler array subscript type warning * univ-init: set default to -Wno-universal-initializer * univ-init: scalar initializer needs some additional checks * evaluate: mark evaluate_generic_selection() as static * add support for _Generic * testsuite: add testcase for duplicated local definitions * add an option to suppress warning 'no newline at EOF' * univ-init: conditionally accept { 0 } without warnings * bad-label: respect attribute((unused)) * bad-label: mark labels as used when needed * bad-label: check for unused labels * bad-goto: check declaration of label expressions * bad-goto: extract check_label_declaration() * bad-goto: label expression inside a statement expression is UB * bad-goto: jumping inside a statement expression is an error * scope: give a scope for labels & gotos * build: fix LLVM version detection Update to version 0.6.1+20200413: * do not use expr->left for conditionals * add support for GCC's __auto_type * And plenty more Use llvm9 for building as llvm10 is not yet supported - Update to version 0.6.1+20200129: * domtree: domtree_build() creates extraneous bb->doms entries * predefine "i386" if needed * correct sparcv9 defines * pre-define __unix__ and friends * add necessary defined for sunos-derived systems * define __PRAGMA_REDEFINE_EXTNAME * allow to easily test if the OS is UNIX-like * detect OS_UNIX as native OS * add predefine_nostd() * show_parse: avoid null pointer dereference in do_show_type() * ptrlist: fix typos * fix testcase with non-constant initializer * and much more - Update to version 0.6.1+20191101: * .gitignore: alphasort the patterns * Add '__' prefix and suffix to all __attribute__ #defines * options: add support for -mcmodel * options: add support for -fpic, -fPIC, -fpie & -fPIE * Sparse v0.6.1 * doc: fix typo in binops' description * "graph" segfaults on top-level asm * llvm: fix sparsec breakage on recent cygwin version - Update to version 0.6.1rc2+20191007: * expand more builtins like __builtin_ffs() * make 'directive in argument list' clearer * asm: warn on invalid empty constraints * fix sign extension in casting enums * remove useless optimization in cast_enum_list() * add test for enum sign extension * do not linearize invalid expression * asm: arrays & functions in non-memory operand degenerate into pointers * asm: fix missing expansion of asm statements * asm: fix liveness memory operand * asm: linearization of output memory operands is different * asm: missing evaluation of asm statements * asm: use parse_asm_constraint() to verify constraints * asm: parse constraints * asm: keep using struct asm_operand during linearization * asm: use a specific struct for asm operands * asm: check earlier that body & constraints are strings * asm: add test evaluation, expansion & linearization of ASM operands * string: use string_expression() in parse_static_assert() * string: add helper string_expression() * dissect: fix processing of ASM statements * and more... - Update to version 20190404: * fix allowing casts of AS pointers to uintptr_t * man: explain role of uintptr_t & unsigned long in casts from AS pointers * also accept casts of AS pointers to uintptr_t * evaluate: externally_visible functions don't need a declaration * expand: add explanation to 'conservative' * expand: 'conservative' must not bypass valid simplifications * Sparse v0.6.1-rc1 * remove confusing intermediate 'where' in evaluate_assignment() * display extra info for type errors in compare & conditional * cgcc: use strict & warnings * cgcc: add support for x86-x32 * cgcc: favor using 'gcc -dumpmachine' to determine specifics * cgcc: simpler handling of hard-float ARM * cgcc: add pseudo-archs for ppc64be/ppc64le * and a lot more... This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-226=1 Package List: - openSUSE Leap 15.2 (x86_64): sparse-0.6.3-lp152.4.3.1 sparse-debuginfo-0.6.3-lp152.4.3.1 sparse-debugsource-0.6.3-lp152.4.3.1 sparse-inspect-0.6.3-lp152.4.3.1 sparse-inspect-debuginfo-0.6.3-lp152.4.3.1 sparse-llvm-0.6.3-lp152.4.3.1 sparse-llvm-debuginfo-0.6.3-lp152.4.3.1 References:

1 0

openSUSE-RU-2021:0228-1: moderate: Recommended update for lxc
by maintenance＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Recommended Update: Recommended update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0228-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lxc fixes the following issues: lxc was updated to 4.0.5: * Support allocating PTS devices from within the container * Harden more path/mount handling logics * Rework LSM logic to limit initializer use * for full list of changes see https://discuss.linuxcontainers.org/t/lxc-4-0-5-lts-has-been-released/9269 Update to LXC 4.0.2: * https://discuss.linuxcontainers.org/t/lxc-4-0-2-lts-has-been-released/7449 Update to LXC 4.0.1: * Tweak systemd ordering (start after remote-fs.target) * Fix various issues around attach and cgroups * Fix shutdown timeout not working on pidfd systems * Fix cgroup issue on 4.9 kernel * Fix write issues in /dev/stdout Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-228=1 Package List: - openSUSE Leap 15.2 (noarch): lxc-bash-completion-4.0.5-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): liblxc-devel-4.0.5-lp152.3.3.1 liblxc1-4.0.5-lp152.3.3.1 liblxc1-debuginfo-4.0.5-lp152.3.3.1 lxc-4.0.5-lp152.3.3.1 lxc-debuginfo-4.0.5-lp152.3.3.1 lxc-debugsource-4.0.5-lp152.3.3.1 pam_cgfs-4.0.5-lp152.3.3.1 pam_cgfs-debuginfo-4.0.5-lp152.3.3.1 References:

1 0

openSUSE-RU-2021:0225-1: moderate: Recommended update for lxc
by maintenance＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Recommended Update: Recommended update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0225-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lxc fixes the following issues: lxc was updated to 4.0.5: * Support allocating PTS devices from within the container * Harden more path/mount handling logics * Rework LSM logic to limit initializer use * for full list of changes see: https://discuss.linuxcontainers.org/t/lxc-4-0-5-lts-has-been-released/9269 Update to LXC 4.0.2 * https://discuss.linuxcontainers.org/t/lxc-4-0-2-lts-has-been-released/7449 Update to LXC 4.0.1: * Tweak systemd ordering (start after remote-fs.target) * Fix various issues around attach and cgroups * Fix shutdown timeout not working on pidfd systems * Fix cgroup issue on 4.9 kernel * Fix write issues in /dev/stdout Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-225=1 Package List: - openSUSE Leap 15.1 (x86_64): liblxc-devel-4.0.5-lp151.4.22.2 liblxc1-4.0.5-lp151.4.22.2 liblxc1-debuginfo-4.0.5-lp151.4.22.2 lxc-4.0.5-lp151.4.22.2 lxc-debuginfo-4.0.5-lp151.4.22.2 lxc-debugsource-4.0.5-lp151.4.22.2 pam_cgfs-4.0.5-lp151.4.22.2 pam_cgfs-debuginfo-4.0.5-lp151.4.22.2 - openSUSE Leap 15.1 (noarch): lxc-bash-completion-4.0.5-lp151.4.22.2 References:

1 0

openSUSE-RU-2021:0224-1: moderate: Recommended update for sparse
by maintenance＠opensuse.org 02 Feb '21

02 Feb '21

openSUSE Recommended Update: Recommended update for sparse ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0224-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for sparse fixes the following issues: sparse was updated to version 0.6.3: * For full list of changes see: https://sparse.docs.kernel.org/en/latest/release-notes/v0.6.3.html update to 0.6.2: * changelog of 0.6.2 is available here: https://sparse.docs.kernel.org/en/latest/release-notes/v0.6.2.html Update to version 0.6.1+20200606: * pre-process: fix a compiler array subscript type warning * univ-init: set default to -Wno-universal-initializer * univ-init: scalar initializer needs some additional checks * evaluate: mark evaluate_generic_selection() as static * add support for _Generic * testsuite: add testcase for duplicated local definitions * add an option to suppress warning 'no newline at EOF' * univ-init: conditionally accept { 0 } without warnings * bad-label: respect attribute((unused)) * bad-label: mark labels as used when needed * bad-label: check for unused labels * bad-goto: check declaration of label expressions * bad-goto: extract check_label_declaration() * bad-goto: label expression inside a statement expression is UB * bad-goto: jumping inside a statement expression is an error * scope: give a scope for labels & gotos * build: fix LLVM version detection Update to version 0.6.1+20200413: * do not use expr->left for conditionals * add support for GCC's __auto_type * And plenty more Use llvm9 for building as llvm10 is not yet supported - Update to version 0.6.1+20200129: * domtree: domtree_build() creates extraneous bb->doms entries * predefine "i386" if needed * correct sparcv9 defines * pre-define __unix__ and friends * add necessary defined for sunos-derived systems * define __PRAGMA_REDEFINE_EXTNAME * allow to easily test if the OS is UNIX-like * detect OS_UNIX as native OS * add predefine_nostd() * show_parse: avoid null pointer dereference in do_show_type() * ptrlist: fix typos * fix testcase with non-constant initializer * and much more - Update to version 0.6.1+20191101: * .gitignore: alphasort the patterns * Add '__' prefix and suffix to all __attribute__ #defines * options: add support for -mcmodel * options: add support for -fpic, -fPIC, -fpie & -fPIE * Sparse v0.6.1 * doc: fix typo in binops' description * "graph" segfaults on top-level asm * llvm: fix sparsec breakage on recent cygwin version - Update to version 0.6.1rc2+20191007: * expand more builtins like __builtin_ffs() * make 'directive in argument list' clearer * asm: warn on invalid empty constraints * fix sign extension in casting enums * remove useless optimization in cast_enum_list() * add test for enum sign extension * do not linearize invalid expression * asm: arrays & functions in non-memory operand degenerate into pointers * asm: fix missing expansion of asm statements * asm: fix liveness memory operand * asm: linearization of output memory operands is different * asm: missing evaluation of asm statements * asm: use parse_asm_constraint() to verify constraints * asm: parse constraints * asm: keep using struct asm_operand during linearization * asm: use a specific struct for asm operands * asm: check earlier that body & constraints are strings * asm: add test evaluation, expansion & linearization of ASM operands * string: use string_expression() in parse_static_assert() * string: add helper string_expression() * dissect: fix processing of ASM statements * and more... - Update to version 20190404: * fix allowing casts of AS pointers to uintptr_t * man: explain role of uintptr_t & unsigned long in casts from AS pointers * also accept casts of AS pointers to uintptr_t * evaluate: externally_visible functions don't need a declaration * expand: add explanation to 'conservative' * expand: 'conservative' must not bypass valid simplifications * Sparse v0.6.1-rc1 * remove confusing intermediate 'where' in evaluate_assignment() * display extra info for type errors in compare & conditional * cgcc: use strict & warnings * cgcc: add support for x86-x32 * cgcc: favor using 'gcc -dumpmachine' to determine specifics * cgcc: simpler handling of hard-float ARM * cgcc: add pseudo-archs for ppc64be/ppc64le * and a lot more... This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-224=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): sparse-0.6.3-bp151.4.3.1 sparse-inspect-0.6.3-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (x86_64): sparse-llvm-0.6.3-bp151.4.3.1 References:

1 0

openSUSE-SU-2021:0223-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 01 Feb '21

01 Feb '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0223-1 Rating: important References: #1181414 Cross-References: CVE-2020-26976 CVE-2021-23953 CVE-2021-23954 CVE-2021-23960 CVE-2021-23964 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.7.0 ESR (MFSA 2021-04, bsc#1181414) * CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests * CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements * CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been * CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC * CVE-2021-23964: Fixed Memory safety bugs This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-223=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.7.0-lp152.2.43.1 MozillaFirefox-branding-upstream-78.7.0-lp152.2.43.1 MozillaFirefox-buildsymbols-78.7.0-lp152.2.43.1 MozillaFirefox-debuginfo-78.7.0-lp152.2.43.1 MozillaFirefox-debugsource-78.7.0-lp152.2.43.1 MozillaFirefox-devel-78.7.0-lp152.2.43.1 MozillaFirefox-translations-common-78.7.0-lp152.2.43.1 MozillaFirefox-translations-other-78.7.0-lp152.2.43.1 References: https://www.suse.com/security/cve/CVE-2020-26976.html https://www.suse.com/security/cve/CVE-2021-23953.html https://www.suse.com/security/cve/CVE-2021-23954.html https://www.suse.com/security/cve/CVE-2021-23960.html https://www.suse.com/security/cve/CVE-2021-23964.html https://bugzilla.suse.com/1181414

1 0

openSUSE-SU-2021:0222-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 01 Feb '21

01 Feb '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0222-1 Rating: important References: #1181414 Cross-References: CVE-2020-26976 CVE-2021-23953 CVE-2021-23954 CVE-2021-23960 CVE-2021-23964 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.7.0 ESR (MFSA 2021-04, bsc#1181414) * CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests * CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements * CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been * CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC * CVE-2021-23964: Fixed Memory safety bugs This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2021-222=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-78.7.0-lp151.2.88.2 MozillaFirefox-branding-upstream-78.7.0-lp151.2.88.2 MozillaFirefox-buildsymbols-78.7.0-lp151.2.88.2 MozillaFirefox-debuginfo-78.7.0-lp151.2.88.2 MozillaFirefox-debugsource-78.7.0-lp151.2.88.2 MozillaFirefox-devel-78.7.0-lp151.2.88.2 MozillaFirefox-translations-common-78.7.0-lp151.2.88.2 MozillaFirefox-translations-other-78.7.0-lp151.2.88.2 References: https://www.suse.com/security/cve/CVE-2020-26976.html https://www.suse.com/security/cve/CVE-2021-23953.html https://www.suse.com/security/cve/CVE-2021-23954.html https://www.suse.com/security/cve/CVE-2021-23960.html https://www.suse.com/security/cve/CVE-2021-23964.html https://bugzilla.suse.com/1181414

1 0