March 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0477-1: moderate: Recommended update for filesystem and systemd
by maintenance＠opensuse.org 26 Mar '21

26 Mar '21

openSUSE Recommended Update: Recommended update for filesystem and systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0477-1 Rating: moderate References: #1078466 #1146705 #1175519 #1178775 #1180020 #1180083 #1180596 #1181011 #1181831 #1183094 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for filesystem and systemd fixes the following issues: - Remove duplicate line due to merge error - Add fix for 'mesa' creating cache with perm 0700. (bsc#1181011) - Fixed an issue causing failure during installation/upgrade a failure. (rh#1548403) (bsc#1146705) - Allows to override config to add cleanup options of '/var/tmp'. (bsc#1078466) - Create config to cleanup '/tmp' regular required with 'tmpfs'. (bsc#1175519) This update for systemd fixes the following issues: - Fix for a possible memory leak. (bsc#1180020) - Fix for a case when to a bind mounted directory results inactive mount units. (#7811) (bsc#1180596) - Fixed an issue when starting a container conflicts with another one. (bsc#1178775) - Drop most of the tmpfiles that deal with generic paths and avoid warnings. (bsc#1078466, bsc#1181831) - Don't use shell redirections when calling a rpm macro. (bsc#1183094) - 'systemd' requires 'aaa_base' >= 13.2. (bsc#1180083) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-477=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): filesystem-15.0-lp152.11.3.1 libsystemd0-234-lp152.31.22.1 libsystemd0-debuginfo-234-lp152.31.22.1 libsystemd0-mini-234-lp152.31.22.1 libsystemd0-mini-debuginfo-234-lp152.31.22.1 libudev-devel-234-lp152.31.22.1 libudev-mini-devel-234-lp152.31.22.1 libudev-mini1-234-lp152.31.22.1 libudev-mini1-debuginfo-234-lp152.31.22.1 libudev1-234-lp152.31.22.1 libudev1-debuginfo-234-lp152.31.22.1 nss-myhostname-234-lp152.31.22.1 nss-myhostname-debuginfo-234-lp152.31.22.1 nss-mymachines-234-lp152.31.22.1 nss-mymachines-debuginfo-234-lp152.31.22.1 nss-systemd-234-lp152.31.22.1 nss-systemd-debuginfo-234-lp152.31.22.1 systemd-234-lp152.31.22.1 systemd-container-234-lp152.31.22.1 systemd-container-debuginfo-234-lp152.31.22.1 systemd-coredump-234-lp152.31.22.1 systemd-coredump-debuginfo-234-lp152.31.22.1 systemd-debuginfo-234-lp152.31.22.1 systemd-debugsource-234-lp152.31.22.1 systemd-devel-234-lp152.31.22.1 systemd-journal-remote-234-lp152.31.22.1 systemd-journal-remote-debuginfo-234-lp152.31.22.1 systemd-logger-234-lp152.31.22.1 systemd-mini-234-lp152.31.22.1 systemd-mini-container-mini-234-lp152.31.22.1 systemd-mini-container-mini-debuginfo-234-lp152.31.22.1 systemd-mini-coredump-mini-234-lp152.31.22.1 systemd-mini-coredump-mini-debuginfo-234-lp152.31.22.1 systemd-mini-debuginfo-234-lp152.31.22.1 systemd-mini-debugsource-234-lp152.31.22.1 systemd-mini-devel-234-lp152.31.22.1 systemd-mini-sysvinit-234-lp152.31.22.1 systemd-network-234-lp152.31.22.1 systemd-network-debuginfo-234-lp152.31.22.1 systemd-sysvinit-234-lp152.31.22.1 udev-234-lp152.31.22.1 udev-debuginfo-234-lp152.31.22.1 udev-mini-234-lp152.31.22.1 udev-mini-debuginfo-234-lp152.31.22.1 - openSUSE Leap 15.2 (noarch): systemd-bash-completion-234-lp152.31.22.1 systemd-mini-bash-completion-234-lp152.31.22.1 - openSUSE Leap 15.2 (x86_64): libsystemd0-32bit-234-lp152.31.22.1 libsystemd0-32bit-debuginfo-234-lp152.31.22.1 libudev-devel-32bit-234-lp152.31.22.1 libudev1-32bit-234-lp152.31.22.1 libudev1-32bit-debuginfo-234-lp152.31.22.1 nss-myhostname-32bit-234-lp152.31.22.1 nss-myhostname-32bit-debuginfo-234-lp152.31.22.1 nss-mymachines-32bit-234-lp152.31.22.1 nss-mymachines-32bit-debuginfo-234-lp152.31.22.1 systemd-32bit-234-lp152.31.22.1 systemd-32bit-debuginfo-234-lp152.31.22.1 References: https://bugzilla.suse.com/1078466 https://bugzilla.suse.com/1146705 https://bugzilla.suse.com/1175519 https://bugzilla.suse.com/1178775 https://bugzilla.suse.com/1180020 https://bugzilla.suse.com/1180083 https://bugzilla.suse.com/1180596 https://bugzilla.suse.com/1181011 https://bugzilla.suse.com/1181831 https://bugzilla.suse.com/1183094

1 0

openSUSE-SU-2021:0476-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 26 Mar '21

26 Mar '21

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0476-1 Rating: important References: #1183852 Cross-References: CVE-2021-3449 CVSS scores: CVE-2021-3449 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_1 fixes the security issue: * CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension but includes a signature_algorithms_cert extension, then a NULL pointer dereference will result, leading to a crash and a denial of service attack. OpenSSL TLS clients are not impacted by this issue. [bsc#1183852] This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-476=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_1-devel-1.1.1d-lp152.7.15.1 libopenssl1_1-1.1.1d-lp152.7.15.1 libopenssl1_1-debuginfo-1.1.1d-lp152.7.15.1 libopenssl1_1-hmac-1.1.1d-lp152.7.15.1 openssl-1_1-1.1.1d-lp152.7.15.1 openssl-1_1-debuginfo-1.1.1d-lp152.7.15.1 openssl-1_1-debugsource-1.1.1d-lp152.7.15.1 - openSUSE Leap 15.2 (noarch): openssl-1_1-doc-1.1.1d-lp152.7.15.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-lp152.7.15.1 libopenssl1_1-32bit-1.1.1d-lp152.7.15.1 libopenssl1_1-32bit-debuginfo-1.1.1d-lp152.7.15.1 libopenssl1_1-hmac-32bit-1.1.1d-lp152.7.15.1 References: https://www.suse.com/security/cve/CVE-2021-3449.html https://bugzilla.suse.com/1183852

1 0

openSUSE-RU-2021:0475-1: moderate: Recommended update for pcm
by maintenance＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Recommended Update: Recommended update for pcm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0475-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for pcm fixes the following issues: pcm was updated to 202101: * Add Comet Lake support * Add Tiger Lake support * Add support for additional Icelake cpu model * Support Linux resctrl driver for RDT Metrics (see ENVVAR_README.md) * Improve robustness in handling rare core event overflows * A few fixes for c_example * Support using Linux perf API for core PMU for systems with offlined cores * Add -i parameter to more tools * support select metrics in virtual machines with vPMU support (e.g. AWS virtualized instances with arch_perfmon flag). * pcm-memory: make -pmm/-pmem the default option on systems with PMM/PMem support * pcm-tsx: update events for ICL and SKL, allow collection of up to 8 events * pcm-raw: support fixed PMU counters * fix UBOX MSR addresses for Jaketown/Ivytown * support Icelake client CPUs * new pcm-raw utility: to program arbitrary core and uncore events by specifying raw register event ID encoding * pcm-memory: support -all option to show channels event if they do not have any traffic (inactive memory channels) * pcm-memory: csv output for Near Memory hit rate (in PMem Memory Mode) * pcm-memory: show memory channels with PMM but w/o DRAM DIMMs * unfreeze counters using global uncore counter control register during uncore PMU initialization (some other tools freeze using global control before exit) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-475=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): pcm-202101-bp151.5.1 References:

1 0

openSUSE-SU-2021:0474-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0474-1 Rating: moderate References: #1183726 Cross-References: CVE-2021-28089 CVE-2021-28090 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.7 * https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html * Fix 2 denial of service security issues (boo#1183726) + Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089) + Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090) * Ship geoip files based on the IPFire Location Database This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-474=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): tor-0.4.5.7-bp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-28089.html https://www.suse.com/security/cve/CVE-2021-28090.html https://bugzilla.suse.com/1183726

1 0

openSUSE-SU-2021:0471-1: important: Security update for ruby2.5
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0471-1 Rating: important References: #1177125 #1177222 Cross-References: CVE-2020-25613 CVSS scores: CVE-2020-25613 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2020-25613 (SUSE): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ruby2.5 fixes the following issues: - CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick (bsc#1177125). - Enable optimizations also on ARM64 (bsc#1177222) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-471=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libruby2_5-2_5-2.5.8-lp152.2.3.1 libruby2_5-2_5-debuginfo-2.5.8-lp152.2.3.1 ruby2.5-2.5.8-lp152.2.3.1 ruby2.5-debuginfo-2.5.8-lp152.2.3.1 ruby2.5-debugsource-2.5.8-lp152.2.3.1 ruby2.5-devel-2.5.8-lp152.2.3.1 ruby2.5-devel-extra-2.5.8-lp152.2.3.1 ruby2.5-doc-2.5.8-lp152.2.3.1 ruby2.5-stdlib-2.5.8-lp152.2.3.1 ruby2.5-stdlib-debuginfo-2.5.8-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): ruby2.5-doc-ri-2.5.8-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25613.html https://bugzilla.suse.com/1177125 https://bugzilla.suse.com/1177222

1 0

openSUSE-SU-2021:0472-1: important: Security update for libass
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for libass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0472-1 Rating: important References: #1177862 Cross-References: CVE-2020-26682 CVSS scores: CVE-2020-26682 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-26682 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libass fixes the following issues: - CVE-2020-26682: Fixed a signed integer overflow in the call to outline_stroke() (bsc#1177862). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-472=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libass-debugsource-0.14.0-lp152.4.3.1 libass-devel-0.14.0-lp152.4.3.1 libass9-0.14.0-lp152.4.3.1 libass9-debuginfo-0.14.0-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libass9-32bit-0.14.0-lp152.4.3.1 libass9-32bit-debuginfo-0.14.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-26682.html https://bugzilla.suse.com/1177862

1 0

openSUSE-SU-2021:0473-1: important: Security update for hawk2
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0473-1 Rating: important References: #1179999 #1182165 #1182166 Cross-References: CVE-2020-35459 CVE-2021-25314 CVSS scores: CVE-2020-35459 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-35459 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25314 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for hawk2 fixes the following issues: - Update to version 2.6.3: * Remove hawk_invoke and use capture3 instead of runas (bsc#1179999)(CVE-2020-35459) * Remove unnecessary chmod (bsc#1182166)(CVE-2021-25314) * Sanitize filename to contains whitelist of alphanumeric (bsc#1182165) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-473=1 Package List: - openSUSE Leap 15.2 (x86_64): hawk2-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 hawk2-debuginfo-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 hawk2-debugsource-2.6.3+git.1614684118.af555ad9-lp152.2.18.1 References: https://www.suse.com/security/cve/CVE-2020-35459.html https://www.suse.com/security/cve/CVE-2021-25314.html https://bugzilla.suse.com/1179999 https://bugzilla.suse.com/1182165 https://bugzilla.suse.com/1182166

1 0

openSUSE-SU-2021:0468-1: important: Security update for nghttp2
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0468-1 Rating: important References: #1172442 #1181358 Cross-References: CVE-2020-11080 CVSS scores: CVE-2020-11080 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-11080 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nghttp2 fixes the following issues: - CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-468=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libnghttp2-14-1.40.0-lp152.2.6.1 libnghttp2-14-debuginfo-1.40.0-lp152.2.6.1 libnghttp2-devel-1.40.0-lp152.2.6.1 libnghttp2_asio-devel-1.40.0-lp152.2.6.1 libnghttp2_asio1-1.40.0-lp152.2.6.1 libnghttp2_asio1-debuginfo-1.40.0-lp152.2.6.1 nghttp2-1.40.0-lp152.2.6.1 nghttp2-debuginfo-1.40.0-lp152.2.6.1 nghttp2-debugsource-1.40.0-lp152.2.6.1 nghttp2-python-debugsource-1.40.0-lp152.2.6.1 python3-nghttp2-1.40.0-lp152.2.6.1 python3-nghttp2-debuginfo-1.40.0-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): libnghttp2-14-32bit-1.40.0-lp152.2.6.1 libnghttp2-14-32bit-debuginfo-1.40.0-lp152.2.6.1 libnghttp2_asio1-32bit-1.40.0-lp152.2.6.1 libnghttp2_asio1-32bit-debuginfo-1.40.0-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-11080.html https://bugzilla.suse.com/1172442 https://bugzilla.suse.com/1181358

1 0

openSUSE-SU-2021:0470-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0470-1 Rating: important References: #1183456 #1183457 Cross-References: CVE-2021-20231 CVE-2021-20232 CVSS scores: CVE-2021-20231 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20231 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-20232 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20232 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gnutls fixes the following issues: - CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183456). - CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183457). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-470=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gnutls-3.6.7-lp152.9.9.1 gnutls-debuginfo-3.6.7-lp152.9.9.1 gnutls-debugsource-3.6.7-lp152.9.9.1 gnutls-guile-3.6.7-lp152.9.9.1 gnutls-guile-debuginfo-3.6.7-lp152.9.9.1 libgnutls-dane-devel-3.6.7-lp152.9.9.1 libgnutls-dane0-3.6.7-lp152.9.9.1 libgnutls-dane0-debuginfo-3.6.7-lp152.9.9.1 libgnutls-devel-3.6.7-lp152.9.9.1 libgnutls30-3.6.7-lp152.9.9.1 libgnutls30-debuginfo-3.6.7-lp152.9.9.1 libgnutls30-hmac-3.6.7-lp152.9.9.1 libgnutlsxx-devel-3.6.7-lp152.9.9.1 libgnutlsxx28-3.6.7-lp152.9.9.1 libgnutlsxx28-debuginfo-3.6.7-lp152.9.9.1 - openSUSE Leap 15.2 (x86_64): libgnutls-devel-32bit-3.6.7-lp152.9.9.1 libgnutls30-32bit-3.6.7-lp152.9.9.1 libgnutls30-32bit-debuginfo-3.6.7-lp152.9.9.1 libgnutls30-hmac-32bit-3.6.7-lp152.9.9.1 References: https://www.suse.com/security/cve/CVE-2021-20231.html https://www.suse.com/security/cve/CVE-2021-20232.html https://bugzilla.suse.com/1183456 https://bugzilla.suse.com/1183457

1 0

openSUSE-SU-2021:0469-1: important: Security update for ldb
by opensuse-security＠opensuse.org 25 Mar '21

25 Mar '21

openSUSE Security Update: Security update for ldb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0469-1 Rating: important References: #1183572 #1183574 Cross-References: CVE-2020-27840 CVE-2021-20277 CVSS scores: CVE-2020-27840 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20277 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ldb fixes the following issues: - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572). - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-469=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ldb-debugsource-2.0.12-lp152.2.9.1 ldb-tools-2.0.12-lp152.2.9.1 ldb-tools-debuginfo-2.0.12-lp152.2.9.1 libldb-devel-2.0.12-lp152.2.9.1 libldb2-2.0.12-lp152.2.9.1 libldb2-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-2.0.12-lp152.2.9.1 python3-ldb-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-devel-2.0.12-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): libldb2-32bit-2.0.12-lp152.2.9.1 libldb2-32bit-debuginfo-2.0.12-lp152.2.9.1 python3-ldb-32bit-2.0.12-lp152.2.9.1 python3-ldb-32bit-debuginfo-2.0.12-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-27840.html https://www.suse.com/security/cve/CVE-2021-20277.html https://bugzilla.suse.com/1183572 https://bugzilla.suse.com/1183574

1 0