February 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0339-1: moderate: Recommended update for yast2-security
by maintenance＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Recommended Update: Recommended update for yast2-security ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0339-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for yast2-security fixes the following issues: - Added support for handling SELinux at boot time (jsc#SLE-17427, jsc#SLE-17307, jsc#SLE-17342) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-339=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-installation-control-4.2.12-lp152.2.7.1 yast2-security-4.2.16-lp152.2.9.1 References:

1 0

openSUSE-RU-2021:0343-1: moderate: Recommended update for Box2D
by maintenance＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Recommended Update: Recommended update for Box2D ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0343-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for Box2D fixes the following issues: - Download the real upstream tarball This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-343=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libBox2D-devel-2.3.1-bp152.4.3.1 libBox2D2_3_1-2.3.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libBox2D-devel-64bit-2.3.1-bp152.4.3.1 libBox2D2_3_1-64bit-2.3.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): Box2D-doc-2.3.1-bp152.4.3.1 References:

1 0

openSUSE-RU-2021:0342-1: moderate: Recommended update for postgresql10
by maintenance＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Recommended Update: Recommended update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0342-1 Rating: moderate References: #1179765 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for postgresql10 fixes the following issues: - updated postgresql version to 10.16 Note: Reindexing might be needed after applying this update. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-342=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): postgresql10-10.16-lp152.2.15.1 postgresql10-contrib-10.16-lp152.2.15.1 postgresql10-contrib-debuginfo-10.16-lp152.2.15.1 postgresql10-debuginfo-10.16-lp152.2.15.1 postgresql10-debugsource-10.16-lp152.2.15.1 postgresql10-devel-10.16-lp152.2.15.1 postgresql10-devel-debuginfo-10.16-lp152.2.15.1 postgresql10-plperl-10.16-lp152.2.15.1 postgresql10-plperl-debuginfo-10.16-lp152.2.15.1 postgresql10-plpython-10.16-lp152.2.15.1 postgresql10-plpython-debuginfo-10.16-lp152.2.15.1 postgresql10-pltcl-10.16-lp152.2.15.1 postgresql10-pltcl-debuginfo-10.16-lp152.2.15.1 postgresql10-server-10.16-lp152.2.15.1 postgresql10-server-debuginfo-10.16-lp152.2.15.1 postgresql10-test-10.16-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): postgresql10-docs-10.16-lp152.2.15.1 References: https://bugzilla.suse.com/1179765

1 0

openSUSE-RU-2021:0344-1: moderate: Recommended update for tboot
by maintenance＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Recommended Update: Recommended update for tboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0344-1 Rating: moderate References: #1180756 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tboot fixes the following issues: - Backported some patches to fix boot issues in UEFI mode on some newer machines/firmwares (bsc#1180756) - Fixed boot issues in legacy mode on some machines when using grub2 multiboot(1) directive (bsc#1180756) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-344=1 Package List: - openSUSE Leap 15.2 (x86_64): tboot-20170711_1.9.8-lp152.5.9.1 tboot-debuginfo-20170711_1.9.8-lp152.5.9.1 tboot-debugsource-20170711_1.9.8-lp152.5.9.1 References: https://bugzilla.suse.com/1180756

1 0

openSUSE-SU-2021:0338-1: important: Security update for python-djangorestframework
by opensuse-security＠opensuse.org 25 Feb '21

25 Feb '21

openSUSE Security Update: Security update for python-djangorestframework ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0338-1 Rating: important References: #1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-djangorestframework fixes the following issues: Update to 3.11.2 * Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626) * update Django for APIs book to 3.0 edition * decode base64 credentials as utf8; adjust tests * Remove compat urls for Django < 2.0 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-338=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python3-djangorestframework-3.11.2-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25626.html https://bugzilla.suse.com/1177205

1 0

openSUSE-RU-2021:0336-1: moderate: Recommended update for python-pycryptodomex
by maintenance＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Recommended Update: Recommended update for python-pycryptodomex ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0336-1 Rating: moderate References: #1181611 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pycryptodomex fixes the following issues: - Fixed a compatibility problem with salt 3002 (bsc#1181611) This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-336=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): python2-pycryptodomex-3.9.9-bp152.2.3.1 python3-pycryptodomex-3.9.9-bp152.2.3.1 References: https://bugzilla.suse.com/1181611

1 0

openSUSE-SU-2021:0337-1: moderate: Security update for postgresql, postgresql13
by opensuse-security＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Security Update: Security update for postgresql, postgresql13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0337-1 Rating: moderate References: #1178666 #1178667 #1178668 #1178961 Cross-References: CVE-2020-25694 CVE-2020-25695 CVE-2020-25696 CVSS scores: CVE-2020-25694 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-25694 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-25695 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25695 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-25696 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-25696 (SUSE): 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for postgresql, postgresql13 fixes the following issues: This update ships postgresql13. Upgrade to version 13.1: * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. * CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb. b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used. * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables. * Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch) * https://www.postgresql.org/about/news/2111/ * https://www.postgresql.org/docs/13/release-13-1.html Initial packaging of PostgreSQL 13: * https://www.postgresql.org/about/news/2077/ * https://www.postgresql.org/docs/13/release-13.html - bsc#1178961: %ghost the symlinks to pg_config and ecpg. Changes in postgresql wrapper package: - Bump major version to 13. - We also transfer PostgreSQL 9.4.26 to the new package layout in SLE12-SP2 and newer. Reflect this in the conflict with postgresql94. - Also conflict with PostgreSQL versions before 9. - Conflicting with older versions is not limited to SLE. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-337=1 Package List: - openSUSE Leap 15.2 (noarch): postgresql-13-lp152.3.6.1 postgresql-contrib-13-lp152.3.6.1 postgresql-devel-13-lp152.3.6.1 postgresql-docs-13-lp152.3.6.1 postgresql-llvmjit-13-lp152.3.6.1 postgresql-plperl-13-lp152.3.6.1 postgresql-plpython-13-lp152.3.6.1 postgresql-pltcl-13-lp152.3.6.1 postgresql-server-13-lp152.3.6.1 postgresql-server-devel-13-lp152.3.6.1 postgresql-test-13-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2020-25694.html https://www.suse.com/security/cve/CVE-2020-25695.html https://www.suse.com/security/cve/CVE-2020-25696.html https://bugzilla.suse.com/1178666 https://bugzilla.suse.com/1178667 https://bugzilla.suse.com/1178668 https://bugzilla.suse.com/1178961

1 0

openSUSE-SU-2021:0335-1: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Feb '21

24 Feb '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0335-1 Rating: low References: #1181848 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.7.1 ESR (bsc#1181848) - Fixed: Prevent access to NTFS special paths that could lead to filesystem corruption. - Buffer overflow in depth pitch calculations for compressed textures Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-335=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.7.1-lp152.2.46.1 MozillaFirefox-branding-upstream-78.7.1-lp152.2.46.1 MozillaFirefox-buildsymbols-78.7.1-lp152.2.46.1 MozillaFirefox-debuginfo-78.7.1-lp152.2.46.1 MozillaFirefox-debugsource-78.7.1-lp152.2.46.1 MozillaFirefox-devel-78.7.1-lp152.2.46.1 MozillaFirefox-translations-common-78.7.1-lp152.2.46.1 MozillaFirefox-translations-other-78.7.1-lp152.2.46.1 References: https://bugzilla.suse.com/1181848

1 0

openSUSE-SU-2021:0334-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 23 Feb '21

23 Feb '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0334-1 Rating: moderate References: #1178741 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.6: * https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.ht ml * Introduce a new MetricsPort HTTP interface * Support IPv6 in the torrc Address option * Add event-tracing library support for USDT and LTTng-UST * Try to read N of N bytes on a TLS connection tor was updated to 0.4.4.7: * https://blog.torproject.org/node/1990 * Stop requiring a live consensus for v3 clients and services * Re-entry into the network is now denied at the Exit level * Fix undefined behavior on our Keccak library * Strip '\r' characters when reading text files on Unix platforms * Handle partial SOCKS5 messages correctly * Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-334=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.5.6-bp152.2.6.1 References: https://bugzilla.suse.com/1178741

1 0

openSUSE-RU-2021:0333-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 23 Feb '21

23 Feb '21

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0333-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for virtualbox fixes the following issues: - Add build of guest kernel modules back in for Leap 15.2. File "vboxguestconfig.sh" is added. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-333=1 Package List: - openSUSE Leap 15.2 (noarch): virtualbox-guest-desktop-icons-6.1.18-lp152.2.14.1 virtualbox-guest-source-6.1.18-lp152.2.14.1 virtualbox-host-source-6.1.18-lp152.2.14.1 - openSUSE Leap 15.2 (x86_64): python3-virtualbox-6.1.18-lp152.2.14.1 python3-virtualbox-debuginfo-6.1.18-lp152.2.14.1 virtualbox-6.1.18-lp152.2.14.1 virtualbox-debuginfo-6.1.18-lp152.2.14.1 virtualbox-debugsource-6.1.18-lp152.2.14.1 virtualbox-devel-6.1.18-lp152.2.14.1 virtualbox-guest-tools-6.1.18-lp152.2.14.1 virtualbox-guest-tools-debuginfo-6.1.18-lp152.2.14.1 virtualbox-guest-x11-6.1.18-lp152.2.14.1 virtualbox-guest-x11-debuginfo-6.1.18-lp152.2.14.1 virtualbox-kmp-debugsource-6.1.18-lp152.2.14.1 virtualbox-kmp-default-6.1.18_k5.3.18_lp152.63-lp152.2.14.1 virtualbox-kmp-default-debuginfo-6.1.18_k5.3.18_lp152.63-lp152.2.14.1 virtualbox-kmp-preempt-6.1.18_k5.3.18_lp152.63-lp152.2.14.1 virtualbox-kmp-preempt-debuginfo-6.1.18_k5.3.18_lp152.63-lp152.2.14.1 virtualbox-qt-6.1.18-lp152.2.14.1 virtualbox-qt-debuginfo-6.1.18-lp152.2.14.1 virtualbox-vnc-6.1.18-lp152.2.14.1 virtualbox-websrv-6.1.18-lp152.2.14.1 virtualbox-websrv-debuginfo-6.1.18-lp152.2.14.1 References:

1 0