March 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0456-1: moderate: Recommended update for libsolv, libzypp, zypper
by maintenance＠opensuse.org 21 Mar '21

21 Mar '21

openSUSE Recommended Update: Recommended update for libsolv, libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0456-1 Rating: moderate References: #1179847 #1181328 #1181622 #1182629 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for libsolv, libzypp, zypper fixes the following issues: - support multiple collections in updateinfo parser - Fixed an issue when some 'systemd' tools require '/proc' to be mounted and fail if it's not there. (bsc#1181328) - Enable release packages to request a releaxed suse/opensuse vendorcheck in dup when migrating. (bsc#1182629) - Patch: Identify well-known category names to allow to use the RH and SUSE patch category names synonymously. (bsc#1179847) - Fix '%posttrans' script execution. (fixes #265) - Repo: Allow multiple baseurls specified on one line (fixes #285) - Regex: Fix memory leak and undefined behavior. - Add rpm buildrequires for test suite (fixes #279) - Use rpmdb2solv new -D switch to tell the location of the rpmdatabase to use. - doc: give more details about creating versioned package locks. (bsc#1181622) - man: Document synonymously used patch categories (bsc#1179847) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-456=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsolv-debuginfo-0.7.17-lp152.2.16.1 libsolv-debugsource-0.7.17-lp152.2.16.1 libsolv-demo-0.7.17-lp152.2.16.1 libsolv-demo-debuginfo-0.7.17-lp152.2.16.1 libsolv-devel-0.7.17-lp152.2.16.1 libsolv-devel-debuginfo-0.7.17-lp152.2.16.1 libsolv-tools-0.7.17-lp152.2.16.1 libsolv-tools-debuginfo-0.7.17-lp152.2.16.1 libzypp-17.25.8-lp152.2.22.1 libzypp-debuginfo-17.25.8-lp152.2.22.1 libzypp-debugsource-17.25.8-lp152.2.22.1 libzypp-devel-17.25.8-lp152.2.22.1 libzypp-devel-doc-17.25.8-lp152.2.22.1 perl-solv-0.7.17-lp152.2.16.1 perl-solv-debuginfo-0.7.17-lp152.2.16.1 python-solv-0.7.17-lp152.2.16.1 python-solv-debuginfo-0.7.17-lp152.2.16.1 python3-solv-0.7.17-lp152.2.16.1 python3-solv-debuginfo-0.7.17-lp152.2.16.1 ruby-solv-0.7.17-lp152.2.16.1 ruby-solv-debuginfo-0.7.17-lp152.2.16.1 zypper-1.14.43-lp152.2.18.1 zypper-debuginfo-1.14.43-lp152.2.18.1 zypper-debugsource-1.14.43-lp152.2.18.1 - openSUSE Leap 15.2 (noarch): zypper-aptitude-1.14.43-lp152.2.18.1 zypper-log-1.14.43-lp152.2.18.1 zypper-needs-restarting-1.14.43-lp152.2.18.1 References: https://bugzilla.suse.com/1179847 https://bugzilla.suse.com/1181328 https://bugzilla.suse.com/1181622 https://bugzilla.suse.com/1182629

1 0

openSUSE-RU-2021:0457-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 21 Mar '21

21 Mar '21

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0457-1 Rating: moderate References: #1182510 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Fix broken man page in 'autoconf' build. (bsc#1182510) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-457=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.18.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.18.1 xorg-x11-server-debugsource-1.20.3-lp152.8.18.1 xorg-x11-server-extra-1.20.3-lp152.8.18.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.18.1 xorg-x11-server-sdk-1.20.3-lp152.8.18.1 xorg-x11-server-source-1.20.3-lp152.8.18.1 xorg-x11-server-wayland-1.20.3-lp152.8.18.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.18.1 References: https://bugzilla.suse.com/1182510

1 0

openSUSE-RU-2021:0455-1: moderate: Recommended update for AusweisApp2
by maintenance＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Recommended Update: Recommended update for AusweisApp2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0455-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for AusweisApp2 fixes the following issues: Version 1.22.1 * The release notes are now displayed within the app. * Improvements have been made to the display and reporting of error messages within the mobile app. * Fixed possible freezing of the app when checking the ID. * The pairing of a smartphone can now be started directly. * The mobile app now starts with the SaK view if this was the last setting used. * The smartphone function as a card reader can now always be activated on iOS. * Animations on iOS have been improved. * Minor bug fixes. * In the SDK for iOS, the handleInterrupt parameter was added to RUN_AUTH and RUN_CHANGE_PIN. Like the associated INTERRUPT command. * In the SDK for iOS, parameters have been added for RUN_AUTH and RUN_CHANGE_PIN, which allow messages to be displayed in the system scan dialog. * The following error is now returned in the SDK for an expired ID card: DocumentValidityVerificationFailed * Added support for the new protocol version for smartphones as card readers in accordance with the supplement to BSI TR-03112 Part 6. * A crash on Windows when pairing PersoSim has been fixed. * Added support for PersoSim for Android with host card emulation. * A possible infinite loop in the SDK for Android has been fixed. * Update of OpenSSL to version 1.1.1j. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-455=1 Package List: - openSUSE Leap 15.2 (x86_64): AusweisApp2-1.22.1-lp152.2.9.1 AusweisApp2-debuginfo-1.22.1-lp152.2.9.1 AusweisApp2-debugsource-1.22.1-lp152.2.9.1 References:

1 0

openSUSE-RU-2021:0453-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0453-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.9.1: + Bugfixes: + Fix duplicating songs in the DB when organizing songs between 2 different collection directories. + Fix overwriting existing newer last played when importing last played from last.fm. + Fix memory leak on song change when moodbar is disabled. + Fix playlist filter search for text with spaces with Qt 6. + Fix 'Except between tracks on the same album' backend fade option always greyed out. + Fix read and save vorbis comment grouping tag. + Fix QAtomicInteger compile error on armv. + Fix compile error with protobuf 3.15.0 and newer. + Fix possible tagreader (messagereply) crashes. + Fix save album cover when album directory and no overwrite is used for saving covers. + Fix right click save cover action when album has embedded cover. + Fix temporary art saved to /tmp. + Fix playlist bitrate sometimes stuck when changing track to previous. + Enhancements: + Improve Musixmatch cover and lyrics search. + Decode any HTML entities in some rare cases they appear in the retrieved lyrics from the API's. + Use mimetype instead of description from stream metadata by default when updating song filetype. + Set limits for collection pixmap cache based on size units. + Convert all signal/slot connections to new Qt 5/6 syntax. + Improve album cover management. + Add right click actions to clear set cover, and option delete covers. + Show artist and album underneath the albums in the cover manager when all Artists is selected. + Disable unavailable right click cover actions. + Remove 3rdparty TagLib now that TagLib 1.12 is available. + New features: + Add option and support for saving embedded covers for FLAC, Ogg Vorbis, MP3 and MP4/AAC. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-453=1 Package List: - openSUSE Leap 15.2 (x86_64): strawberry-0.9.1-lp152.2.24.1 strawberry-debuginfo-0.9.1-lp152.2.24.1 strawberry-debugsource-0.9.1-lp152.2.24.1 References:

1 0

openSUSE-RU-2021:0454-1: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0454-1 Rating: low References: #1182661 #1183012 #1183051 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for systemd-rpm-macros fixes the following issues: - Added a %systemd_user_pre macro (bsc#1183051, bsc#1183012) - Fixed an issue with %systemd_user_post, where the --global parameter was treated like if it was another service (bsc#1183051, bsc#1182661) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-454=1 Package List: - openSUSE Leap 15.2 (noarch): systemd-rpm-macros-7-lp152.8.13.1 References: https://bugzilla.suse.com/1182661 https://bugzilla.suse.com/1183012 https://bugzilla.suse.com/1183051

1 0

openSUSE-SU-2021:0452-1: moderate: Security update for connman
by opensuse-security＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Security Update: Security update for connman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: #1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 (NVD) : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for connman fixes the following issues: Update to 1.39 (boo#1181751): * Fix issue with scanning state synchronization and iwd. * Fix issue with invalid key with 4-way handshake offloading. * Fix issue with DNS proxy length checks to prevent buffer overflow. (CVE-2021-26675) * Fix issue with DHCP leaking stack data via uninitialized variable. (CVE-2021-26676) Update to 1.38: * Fix issue with online check on IP address update. * Fix issue with OpenVPN and encrypted private keys. * Fix issue with finishing of VPN connections. * Add support for updated stable iwd APIs. * Add support for WireGuard networks. Update to 1.37: * Fix issue with handling invalid gateway addresses. * Fix issue with handling updates of default gateway. * Fix issue with DHCP servers that require broadcast flag. * Add support for option to use gateways as time servers. * Add support for option to select default technology. * Add support for Address Conflict Detection (ACD). * Add support for IPv6 iptables management. Change in 1.36: * Fix issue with DNS short response on error handling. * Fix issue with handling incoming DNS requests. * Fix issue with handling empty timeserver list. * Fix issue with incorrect DHCP byte order. * Fix issue with AllowDomainnameUpdates handling. * Fix issue with IPv4 link-local IP conflict error. * Fix issue with handling WISPr over TLS connections. * Fix issue with WiFi background scanning handling. * Fix issue with WiFi disconnect+connect race condition. * Fix issue with WiFi scanning and tethering operation. * Fix issue with WiFi security change handling. * Fix issue with missing signal for WPS changes. * Fix issue with online check retry handling. * Add support for systemd-resolved backend. * Add support for mDNS configuration setup. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-452=1 Package List: - openSUSE Backports SLE-15-SP2 (x86_64): connman-1.39-bp152.4.3.1 connman-client-1.39-bp152.4.3.1 connman-devel-1.39-bp152.4.3.1 connman-doc-1.39-bp152.4.3.1 connman-nmcompat-1.39-bp152.4.3.1 connman-plugin-hh2serial-gps-1.39-bp152.4.3.1 connman-plugin-iospm-1.39-bp152.4.3.1 connman-plugin-l2tp-1.39-bp152.4.3.1 connman-plugin-openconnect-1.39-bp152.4.3.1 connman-plugin-openvpn-1.39-bp152.4.3.1 connman-plugin-polkit-1.39-bp152.4.3.1 connman-plugin-pptp-1.39-bp152.4.3.1 connman-plugin-tist-1.39-bp152.4.3.1 connman-plugin-vpnc-1.39-bp152.4.3.1 connman-plugin-wireguard-1.39-bp152.4.3.1 connman-test-1.39-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-26675.html https://www.suse.com/security/cve/CVE-2021-26676.html https://bugzilla.suse.com/1181751

1 0

openSUSE-SU-2021:0451-1: moderate: Security update for python-markdown2
by opensuse-security＠opensuse.org 20 Mar '21

20 Mar '21

openSUSE Security Update: Security update for python-markdown2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0451-1 Rating: moderate References: #1171379 #1181270 #1183171 Cross-References: CVE-2021-26813 CVSS scores: CVE-2021-26813 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for python-markdown2 fixes the following issues: Update to 2.4.0 (boo#1181270): - [pull #377] Fixed bug breaking strings elements in metadata lists - [pull #380] When rendering fenced code blocks, also add the language-LANG class - [pull #387] Regex DoS fixes (CVE-2021-26813, boo#1183171) - Switch off failing tests (gh#trentm/python-markdown2#388), ignore failing test suite. update to 2.3.9: - [pull #335] Added header support for wiki tables - [pull #336] Reset _toc when convert is run - [pull #353] XSS fix - [pull #350] XSS fix - Add patch to fix unsanitized input for cross-site scripting (boo#1171379) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-451=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): python2-markdown2-2.4.0-bp152.2.4.1 python3-markdown2-2.4.0-bp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2021-26813.html https://bugzilla.suse.com/1171379 https://bugzilla.suse.com/1181270 https://bugzilla.suse.com/1183171

1 0

openSUSE-SU-2021:0450-1: moderate: Security update for froxlor
by opensuse-security＠opensuse.org 19 Mar '21

19 Mar '21

openSUSE Security Update: Security update for froxlor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0450-1 Rating: moderate References: #1025193 #1082318 #846355 #958100 Cross-References: CVE-2016-5100 CVSS scores: CVE-2016-5100 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 (boo#846355) - Upstream upgrade to version 0.10.22 (boo#846355) - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc [boo#1082318] Upstream upgrade to version 0.9.40.1 (boo#846355) new features besides API that found their way in: - 2FA / TwoFactor Authentication for accounts - MySQL8 compatibility - new implementation of Let's Encrypt (acme.sh) - customizable error/access log handling for webserver (format, level, pipe-to-script, etc.) - lots and lots of bugfixes and small enhancements Upstream upgrade to version 0.9.39.5 (boo#846355) - PHP rand function for random number generation fixed in previous version (boo#1025193) CVE-2016-5100 - upstream upgrade to version 0.9.39 (boo#846355) - Add and change of froxlor config files and manual - Change Requires to enable use with php7 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-450=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): froxlor-0.10.23-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2016-5100.html https://bugzilla.suse.com/1025193 https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/846355 https://bugzilla.suse.com/958100

1 0

openSUSE-SU-2021:0448-1: moderate: Security update for netty
by opensuse-security＠opensuse.org 19 Mar '21

19 Mar '21

openSUSE Security Update: Security update for netty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0448-1 Rating: moderate References: #1183262 Cross-References: CVE-2021-21295 CVSS scores: CVE-2021-21295 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for netty fixes the following issues: - CVE-2021-21295: Fixed an improper Content-Length header field validation (bsc#1183262). : This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-448=1 Package List: - openSUSE Leap 15.2 (x86_64): netty-4.1.13-lp152.3.3.1 netty-javadoc-4.1.13-lp152.3.3.1 netty-poms-4.1.13-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-21295.html https://bugzilla.suse.com/1183262

1 0

openSUSE-RU-2021:0449-1: moderate: Recommended update for java-1_8_0-openj9
by maintenance＠opensuse.org 19 Mar '21

19 Mar '21

openSUSE Recommended Update: Recommended update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0449-1 Rating: moderate References: #1181239 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for java-1_8_0-openj9 fixes the following issues: - java-1_8_0-openj9 was updated to OpenJDK 8u282 build 08 with OpenJ9 0.24.0 virtual machine * including Oracle January 2021 CPU changes (bsc#1181239) * OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.24 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-449=1 Package List: - openSUSE Leap 15.2 (noarch): java-1_8_0-openj9-javadoc-1.8.0.282-lp152.3.6.1 - openSUSE Leap 15.2 (x86_64): java-1_8_0-openj9-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-accessibility-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-debuginfo-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-debugsource-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-demo-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-devel-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-headless-1.8.0.282-lp152.3.6.1 java-1_8_0-openj9-src-1.8.0.282-lp152.3.6.1 References: https://bugzilla.suse.com/1181239

1 0