March 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0467-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 23 Mar '21

23 Mar '21

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0467-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.9.1: + Bugfixes: + Fix duplicating songs in the DB when organizing songs between 2 different collection directories. + Fix overwriting existing newer last played when importing last played from last.fm. + Fix memory leak on song change when moodbar is disabled. + Fix playlist filter search for text with spaces with Qt 6. + Fix 'Except between tracks on the same album' backend fade option always greyed out. + Fix read and save vorbis comment grouping tag. + Fix QAtomicInteger compile error on armv. + Fix compile error with protobuf 3.15.0 and newer. + Fix possible tagreader (messagereply) crashes. + Fix save album cover when album directory and no overwrite is used for saving covers. + Fix right click save cover action when album has embedded cover. + Fix temporary art saved to /tmp. + Fix playlist bitrate sometimes stuck when changing track to previous. + Enhancements: + Improve Musixmatch cover and lyrics search. + Decode any HTML entities in some rare cases they appear in the retrieved lyrics from the API's. + Use mimetype instead of description from stream metadata by default when updating song filetype. + Set limits for collection pixmap cache based on size units. + Convert all signal/slot connections to new Qt 5/6 syntax. + Improve album cover management. + Add right click actions to clear set cover, and option delete covers. + Show artist and album underneath the albums in the cover manager when all Artists is selected. + Disable unavailable right click cover actions. + Remove 3rdparty TagLib now that TagLib 1.12 is available. + New features: + Add option and support for saving embedded covers for FLAC, Ogg Vorbis, MP3 and MP4/AAC. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-467=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): strawberry-0.9.1-bp152.2.20.1 References:

1 0

openSUSE-RU-2021:0466-1: moderate: Recommended update for fetchmail
by maintenance＠opensuse.org 23 Mar '21

23 Mar '21

openSUSE Recommended Update: Recommended update for fetchmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0466-1 Rating: moderate References: #1136538 #1182807 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for fetchmail fixes the following issues: - Remove comment about not available FETCHMAIL_USER configuration variable in sysconfig.fetchmail. (bsc#1136538) - Set the hostname for SNI when using TLS (bsc#1182807) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-466=1 Package List: - openSUSE Leap 15.2 (x86_64): fetchmail-6.3.26-lp152.6.3.1 fetchmail-debuginfo-6.3.26-lp152.6.3.1 fetchmail-debugsource-6.3.26-lp152.6.3.1 fetchmailconf-6.3.26-lp152.6.3.1 References: https://bugzilla.suse.com/1136538 https://bugzilla.suse.com/1182807

1 0

openSUSE-RU-2021:0465-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 23 Mar '21

23 Mar '21

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0465-1 Rating: moderate References: #1099976 #1172110 #1174855 #1180101 #1180818 #1181290 #1181347 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Only require python-certifi for CentOS7 - Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110) - Adjust and rename patch files - Exclude SLE 12 from requiring python-certifi - Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976) - Fix recursion false detection in payload (bsc#1180101) - Add sleep on exception handling on minion connection attempt to the master (bsc#1174855) - Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347) - Always require python-certifi (used by salt.ext.tornado) - Do not crash when unexpected cmd output at listing patches (bsc#1181290) - Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-465=1 Package List: - openSUSE Leap 15.2 (x86_64): python2-salt-3000-lp152.3.30.1 python3-salt-3000-lp152.3.30.1 salt-3000-lp152.3.30.1 salt-api-3000-lp152.3.30.1 salt-cloud-3000-lp152.3.30.1 salt-doc-3000-lp152.3.30.1 salt-master-3000-lp152.3.30.1 salt-minion-3000-lp152.3.30.1 salt-proxy-3000-lp152.3.30.1 salt-ssh-3000-lp152.3.30.1 salt-standalone-formulas-configuration-3000-lp152.3.30.1 salt-syndic-3000-lp152.3.30.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3000-lp152.3.30.1 salt-fish-completion-3000-lp152.3.30.1 salt-zsh-completion-3000-lp152.3.30.1 References: https://bugzilla.suse.com/1099976 https://bugzilla.suse.com/1172110 https://bugzilla.suse.com/1174855 https://bugzilla.suse.com/1180101 https://bugzilla.suse.com/1180818 https://bugzilla.suse.com/1181290 https://bugzilla.suse.com/1181347

1 0

openSUSE-RU-2021:0464-1: moderate: Recommended update for singularity
by maintenance＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Recommended Update: Recommended update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0464-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for singularity fixes the following issues: singularity was updated to version 3.7.2: - Bug Fixes - Fix progress bar display when source image size is unknown. - Fix a memory usage / leak issue when building from an existing image file. - Fix to allow use of ``--library`` flag to point push/pull at default cloud library when another remote is in use. - Address false positive loop test errors, and an e2e test registry setup issue. New version 3.7.1 - Bug Fixes - Accommodate /sys/fs/selinux mount changes on kernel 5.9+. - Fix loop devices file descriptor leak when shared loop devices is enabled. - Use MaxLoopDevices variable from config file in all appropriate locations. - Use -buildmode=default (non pie) on ppc64le to prevent crashes when using plugins. - Remove spurious warning in parseTokenSection() - e2e test fixes for new kernels, new unsquashfs version. - Show correct web URI for detached builds against alternate remotes. New version 3.7.0 - New features / functionalities - Allow configuration of global custom keyservers, separate from remote endpoints. - Add a new global keyring, for public keys only (used for ECL). - The `remote login` commmand now suports authentication to Docker/OCI registries and custom keyservers. - New `--exclusive` option for `remote use` allows admin to lock usage to a specific remote. - A new `Fingerprints:` header in definition files will check that a SIF source image can be verified, and is signed with keys matching all specified fingerprints. - Labels can be set dynamically from a build's `%post` section by setting them in the `SINGULARITY_LABELS` environment variable. - New `build-arch` label is automatically set to the architecure of the host during a container build. - New `-D/--description` flag for `singularity push` sets description for a library container image. - `singularity remote status` shows validity of authentication token if set. - `singularity push` reports quota usage and URL on successful push to a library server that supports this. - A new `--no-mount` flag for actions allows a user to disable proc/sys/dev/devpts/home/tmp/hostfs/cwd mounts, even if they are enabled in `singularity.conf`. - Changed defaults / behaviours - When actions (run/shell/exec...) are used without `--fakeroot` the umask from the calling environment will be propagated into the container, so that files are created with expected permissions. Use the new `--no-umask` flag to return to the previous behaviour of setting a default 0022 umask. - Container metadata, environment, scripts are recorded in a descriptor in builds to SIF files, and `inspect` will use this if present. - The `--nv` flag for NVIDIA GPU support will not resolve libraries reported by `nvidia-container-cli` via the ld cache. Will instead respect absolute paths to libraries reported by the tool, and bind all versioned symlinks to them. - General re-work of the `remote login` flow, adds prompts and token verification before replacing an existing authentication token. - The Execution Control List (ECL) now verifies container fingerprints using the new global keyring. Previously all users would need relevant keys in their own keyring. - The SIF layer mediatype for ORAS has been changed to `application/vnd.sylabs.sif.layer.v1.sif` reflecting the published [opencontainers/artifacts](https://github.com/opencontainers/artifacts/blob /master/artifact-authors.md#defining-layermediatypes) value. - `SINGULARITY_BIND` has been restored as an environment variable set within a running container. It now reflects all user binds requested by the `-B/--bind` flag, as well as via `SINGULARITY_BIND[PATHS]`. - `singularity search` now correctly searches for container images matching the host architecture by default. A new `--arch` flag allows searching for other architectures. A new results format gives more detail about container image results, while users and collections are no longer returned. - Bug Fixes - Support larger definition files, environments etc. by passing engine configuration in the environment vs. via socket buffer. - Ensure `docker-daemon:` and other source operations respect `SINGULARITY_TMPDIR` for all temporary files. - Support double quoted filenames in the `%files` section of build definitions. - Correct `cache list` sizes to show KiB with powers of 1024, matching `du` etc. - Don't fail on `enable fusemount=no` when no fuse mounts are needed. - Pull OCI images to the correct requested location when the cache is disabled. - Ensure `Singularity>` prompt is set when container has no environment script, or singularity is called through a wrapper script. - Avoid build failures in `yum/dnf` operations against the 'setup' package on `RHEL/CentOS/Fedora` by ensuring staged `/etc/` files do not match distro default content. - Failed binds to `/etc/hosts` and `/etc/localtime` in a container run with `--contain` are no longer fatal errors. - Don't initialize the cache for actions where it is not required. - Increase embedded shell interpreter timeout, to allow slow-running environment scripts to complete. - Correct buffer handling for key import to allow import from STDIN. - Reset environment to avoid `LD_LIBRARY_PATH` issues when resolving dependencies for the `unsquashfs` sandbox. - Fall back to `/sbin/ldconfig` if `ldconfig` on `PATH` fails while resolving GPU libraries. Fixes problems on systems using Nix / Guix. - Address issues caused by error code changes in `unsquashfs` version 4.4. - Ensure `/dev/kfd` is bound into container for ROCm when `--rocm` is used with `--contain`. - Tolerate comments on `%files` sections in build definition files. - Fix a loop device file descriptor leak. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-464=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 s390x x86_64): singularity-3.7.2-bp152.2.16.1 References:

1 0

openSUSE-SU-2021:0462-1: important: Security update for grub2
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0462-1 Rating: important References: #1175970 #1176711 #1177883 #1179264 #1179265 #1182057 #1182262 #1182263 #1183073 Cross-References: CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 CVSS scores: CVE-2020-14372 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-14372 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25632 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25632 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-25647 (NVD) : 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-25647 (SUSE): 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2020-27749 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-27749 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-27779 (NVD) : 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2020-27779 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20225 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20225 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20233 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-20233 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for grub2 fixes the following issues: grub2 implements the new "SBAT" method for SHIM based secure boot revocation. (bsc#1182057) - CVE-2020-25632: Fixed a use-after-free in rmmod command (bsc#1176711) - CVE-2020-25647: Fixed an out-of-bound write in grub_usb_device_initialize() (bsc#1177883) - CVE-2020-27749: Fixed a stack buffer overflow in grub_parser_split_cmdline (bsc#1179264) - CVE-2020-27779, CVE-2020-14372: Disallow cutmem and acpi commands in secure boot mode (bsc#1179265 bsc#1175970) - CVE-2021-20225: Fixed a heap out-of-bounds write in short form option parser (bsc#1182262) - CVE-2021-20233: Fixed a heap out-of-bound write due to mis-calculation of space required for quoting (bsc#1182263) - Fixed chainloading windows on dual boot machine (bsc#1183073) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-462=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): grub2-2.04-lp152.7.22.7 grub2-branding-upstream-2.04-lp152.7.22.7 grub2-debuginfo-2.04-lp152.7.22.7 grub2-debugsource-2.04-lp152.7.22.7 - openSUSE Leap 15.2 (noarch): grub2-i386-efi-2.04-lp152.7.22.7 grub2-i386-efi-debug-2.04-lp152.7.22.7 grub2-i386-pc-2.04-lp152.7.22.7 grub2-i386-pc-debug-2.04-lp152.7.22.7 grub2-i386-xen-2.04-lp152.7.22.7 grub2-snapper-plugin-2.04-lp152.7.22.7 grub2-systemd-sleep-plugin-2.04-lp152.7.22.7 grub2-x86_64-efi-2.04-lp152.7.22.7 grub2-x86_64-efi-debug-2.04-lp152.7.22.7 grub2-x86_64-xen-2.04-lp152.7.22.7 References: https://www.suse.com/security/cve/CVE-2020-14372.html https://www.suse.com/security/cve/CVE-2020-25632.html https://www.suse.com/security/cve/CVE-2020-25647.html https://www.suse.com/security/cve/CVE-2020-27749.html https://www.suse.com/security/cve/CVE-2020-27779.html https://www.suse.com/security/cve/CVE-2021-20225.html https://www.suse.com/security/cve/CVE-2021-20233.html https://bugzilla.suse.com/1175970 https://bugzilla.suse.com/1176711 https://bugzilla.suse.com/1177883 https://bugzilla.suse.com/1179264 https://bugzilla.suse.com/1179265 https://bugzilla.suse.com/1182057 https://bugzilla.suse.com/1182262 https://bugzilla.suse.com/1182263 https://bugzilla.suse.com/1183073

1 0

openSUSE-RU-2021:0463-1: Recommended update for hwdata
by maintenance＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0463-1 Rating: low References: #1170160 #1182482 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for hwdata fixes the following issues: - Updated pci, usb and vendor ids (bsc#1182482, bsc#1170160, jsc#SLE-13791) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-463=1 Package List: - openSUSE Leap 15.2 (noarch): hwdata-0.345-lp152.2.6.1 References: https://bugzilla.suse.com/1170160 https://bugzilla.suse.com/1182482

1 0

openSUSE-RU-2021:0458-1: moderate: Recommended update for charliecloud
by maintenance＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Recommended Update: Recommended update for charliecloud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0458-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for charliecloud fixes the following issues: Update to version 0.22. - ��ch-image�� can now push images to a registry, with the ��push�� subcommand - As a reminder, ��ch-grow�� has been renamed to ��ch-image��. The old name still works but will be removed in 0.23. - ch-image: new subcommand ��delete�� - ch-image pull: * now keeps some metadata from pulled image * now works with public images in nVidia NGC registry * setuid/setgid bits in pulled image now cleared * performance improvements for images with many whiteouts - ch-image build: * environment variables now kept from base image * SHELL instruction now supported - several scripts now work correctly if image name contains slash - ��sudo make install�� now works correctly with restrictive umasks - miscellaneous bug fixes and improvements Update to version 0.21. - renamed the internal builder ch-grow to ch-image to reflect its broader functionality. ch-grow still works but will be deprecated in 0.23 - ch-image unprivileged build workarounds using fakeroot now default to off and must be requested with --force; the option --no-fakeroot has been removed. ch-image will by default print a warning if it thinks --force might fix a build failure. - ch-image pull now works with registries that use HTTP basic auth and with images that use manifest schema version 1. - ch-image build has a new option --bind to bind-mount directories during build and COPY: improve symlink and directory handling - miscellaneous bug fixes and improvements - Full changelog at https://groups.io/g/charliecloud/message/108 Update to version 0.20. - improvement for unprivileged image build using fakeroot This feature can be turned off with ��ch-grow build --no-fakeroot�� Further details are in the ch-grow man page - miscellaneous bug fixes and improvements - Full changelot at https://groups.io/g/charliecloud/message/107 Update to version 0.19. Two particularly notable changes: - ch-grow now supports multi-stage build (#768), which as always is fully unprivileged. This represents a big step forward in functionality. - ch-grow now has subcommands; what used to be plain ch-grow is now ch-grow build, and ch-tug has become ch-grow pull. - miscellaneous bug fixes and improvements - Full changelog at https://groups.io/g/charliecloud/message/106 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-458=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): charliecloud-0.22-bp152.2.8.1 - openSUSE Backports SLE-15-SP2 (noarch): charliecloud-doc-0.22-bp152.2.8.1 charliecloud-examples-0.22-bp152.2.8.1 References:

1 0

openSUSE-SU-2021:0460-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0460-1 Rating: moderate References: #1183129 Cross-References: CVE-2021-20272 CVE-2021-20273 CVE-2021-20274 CVE-2021-20275 CVE-2021-20276 CVSS scores: CVE-2021-20272 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20273 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20274 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20275 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20276 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for privoxy fixes the following issues: Update to version 3.0.32: - Security/Reliability (boo#1183129) - ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera) - cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera) - socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera) - chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera) - Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera) - Bug fixes: - Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera) - decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera). - decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment. - decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera) - gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera). - buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour "applying zero offset to null pointer". Reported by: Joshua Rogers (Opera) - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera). - Respect DESTDIR when considering whether or not to install config files with ".new" extension. - OpenSSL ssl_store_cert(): Fix two error messages. - Fix a couple of format specifiers. - Silence compiler warnings when compiling with NDEBUG. - fuzz_server_header(): Fix compiler warning. - fuzz_client_header(): Fix compiler warning. - cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file. - General improvements: - Log the TLS version and the the cipher when debug 2 is enabled. - ssl_send_certificate_error(): Respect HEAD requests by not sending a body. - ssl_send_certificate_error(): End the body with a single new line. - serve(): Increase the chances that the host is logged when closing a server socket. - handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera). - decompress_iob(): Add periods to a couple of log messages - Terminate the body of the HTTP snipplets with a single new line instead of "\r\n". - configure: Add --with-assertions option and only enable assertions when it is used - windows build: Use --with-brotli and --with-mbedtls by default and enable dynamic error checking. - gif_deanimate(): Confirm we've got an image before trying to write it Saves a pointless buf_copy() call. - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number. - Action file improvements: - Disable fast-redirects for .golem.de/ - Unblock requests to adri*. - Block requests for trc*.taboola.com/ - Disable fast-redirects for .linkedin.com/ - Filter file improvements: - Make the second pcrs job of the img-reorder filter greedy again. The ungreedy version broke the img tags on: https://bulk.fefe.de/scalability/. - Privoxy-Log-Parser: - Highlight a few more messages. - Clarify the --statistics output. The shown "Reused connections" are server connections so name them appropriately. - Bump version to 0.9.3. - Privoxy-Regression-Test: - Add the --check-bad-ssl option to the --help output. - Bump version to 0.7.3. - Documentation: - Add pushing the created tag to the release steps in the developer manual. - Clarify that 'debug 32768' should be used in addition to the other debug directives when reporting problems. - Add a 'Third-party licenses and copyrights' section to the user manual. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-460=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): privoxy-3.0.32-bp152.4.9.1 - openSUSE Backports SLE-15-SP2 (noarch): privoxy-doc-3.0.32-bp152.4.9.1 References: https://www.suse.com/security/cve/CVE-2021-20272.html https://www.suse.com/security/cve/CVE-2021-20273.html https://www.suse.com/security/cve/CVE-2021-20274.html https://www.suse.com/security/cve/CVE-2021-20275.html https://www.suse.com/security/cve/CVE-2021-20276.html https://bugzilla.suse.com/1183129

1 0

openSUSE-SU-2021:0459-1: moderate: Security update for libmysofa
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for libmysofa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0459-1 Rating: moderate References: #1149919 #1149920 #1149922 #1149924 #1149926 #1159839 #1160040 #1181977 #1181978 #1181979 #1181980 #1181981 #1182883 Cross-References: CVE-2019-16091 CVE-2019-16092 CVE-2019-16093 CVE-2019-16094 CVE-2019-16095 CVE-2019-20016 CVE-2019-20063 CVE-2020-36148 CVE-2020-36149 CVE-2020-36150 CVE-2020-36151 CVE-2020-36152 CVE-2020-6860 CVSS scores: CVE-2019-16091 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-16092 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16093 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16094 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-16095 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-20016 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-20063 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-36148 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36149 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36150 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36151 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-36152 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-6860 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for libmysofa fixes the following issues: - Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883 Update to version 0.9.1 * Extended angular neighbor search to 'close the sphere' * Added and exposed mysofa_getfilter_float_nointerp method * Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-459=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libmysofa-devel-0.9.1-bp152.4.3.1 libmysofa0-0.9.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libmysofa0-64bit-0.9.1-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-16091.html https://www.suse.com/security/cve/CVE-2019-16092.html https://www.suse.com/security/cve/CVE-2019-16093.html https://www.suse.com/security/cve/CVE-2019-16094.html https://www.suse.com/security/cve/CVE-2019-16095.html https://www.suse.com/security/cve/CVE-2019-20016.html https://www.suse.com/security/cve/CVE-2019-20063.html https://www.suse.com/security/cve/CVE-2020-36148.html https://www.suse.com/security/cve/CVE-2020-36149.html https://www.suse.com/security/cve/CVE-2020-36150.html https://www.suse.com/security/cve/CVE-2020-36151.html https://www.suse.com/security/cve/CVE-2020-36152.html https://www.suse.com/security/cve/CVE-2020-6860.html https://bugzilla.suse.com/1149919 https://bugzilla.suse.com/1149920 https://bugzilla.suse.com/1149922 https://bugzilla.suse.com/1149924 https://bugzilla.suse.com/1149926 https://bugzilla.suse.com/1159839 https://bugzilla.suse.com/1160040 https://bugzilla.suse.com/1181977 https://bugzilla.suse.com/1181978 https://bugzilla.suse.com/1181979 https://bugzilla.suse.com/1181980 https://bugzilla.suse.com/1181981 https://bugzilla.suse.com/1182883

1 0

openSUSE-SU-2021:0461-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 22 Mar '21

22 Mar '21

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0461-1 Rating: moderate References: #1183726 Cross-References: CVE-2021-28089 CVE-2021-28090 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tor fixes the following issues: tor was updated to 0.4.5.7 * https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html * Fix 2 denial of service security issues (boo#1183726) + Disable the dump_desc() function that we used to dump unparseable information to disk (CVE-2021-28089) + Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority (CVE-2021-28090) * Ship geoip files based on the IPFire Location Database Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-461=1 Package List: - openSUSE Leap 15.2 (x86_64): tor-0.4.5.7-lp152.2.9.1 tor-debuginfo-0.4.5.7-lp152.2.9.1 tor-debugsource-0.4.5.7-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-28089.html https://www.suse.com/security/cve/CVE-2021-28090.html https://bugzilla.suse.com/1183726

1 0