April 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0628-1: moderate: Security update for nim
by opensuse-security＠opensuse.org 29 Apr '21

29 Apr '21

openSUSE Security Update: Security update for nim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0628-1 Rating: moderate References: #1185083 #1185084 #1185085 Cross-References: CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 CVSS scores: CVE-2021-21374 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nim fixes the following issues: num was updated to version 1.2.12: * Fixed GC crash resulting from inlining of the memory allocation procs * Fixed ��incorrect raises effect for $(NimNode)�� (#17454) From version 1.2.10: * Fixed ��JS backend doesn��t handle float->int type conversion �� (#8404) * Fixed ��The ��try except�� not work when the ��OSError: Too many open files�� error occurs!�� (#15925) * Fixed ��Nim emits #line 0 C preprocessor directives with ��debugger:native, with ICE in gcc-10�� (#15942) * Fixed ��tfuturevar fails when activated�� (#9695) * Fixed ��nre.escapeRe is not gcsafe�� (#16103) * Fixed ��Error: internal error: genRecordFieldAux�� - in the ��version-1-4�� branch�� (#16069) * Fixed ��-d:fulldebug switch does not compile with gc:arc�� (#16214) * Fixed ��osLastError may randomly raise defect and crash�� (#16359) * Fixed ��generic importc proc��s don��t work (breaking lots of vmops procs for js)�� (#16428) * Fixed ��Concept: codegen ignores parameter passing�� (#16897) * Fixed ��{.push exportc.} interacts with anonymous functions�� (#16967) * Fixed ��memory allocation during {.global.} init breaks GC�� (#17085) * Fixed "Nimble arbitrary code execution for specially crafted package metadata" + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962 p + (boo#1185083, CVE-2021-21372) * Fixed "Nimble falls back to insecure http url when fetching packages" + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp 8 + (boo#1185084, CVE-2021-21373) * Fixed "Nimble fails to validate certificates due to insecure httpClient defaults" + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhx x + (boo#1185085, CVE-2021-21374) from version 1.2.8 * Fixed ��Defer and ��gc:arc�� (#15071) * Fixed ��Issue with ��gc:arc at compile time�� (#15129) * Fixed ��Nil check on each field fails in generic function�� (#15101) * Fixed ��[strscans] scanf doesn��t match a single character with $+ if it��s the end of the string�� (#15064) * Fixed ��Crash and incorrect return values when using readPasswordFromStdin on Windows.�� (#15207) * Fixed ��Inconsistent unsigned -> signed RangeDefect usage across integer sizes�� (#15210) * Fixed ��toHex results in RangeDefect exception when used with large uint64�� (#15257) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��proc execCmdEx doesn��t work with -d:useWinAnsi�� (#14203) * Fixed ��memory corruption in tmarshall.nim�� (#9754) * Fixed ��Wrong number of variables�� (#15360) * Fixed ��defer doesnt work with block, break and await�� (#15243) * Fixed ��Sizeof of case object is incorrect. Showstopper�� (#15516) * Fixed ��Mixing ��return�� with expressions is allowed in 1.2�� (#15280) * Fixed ��regression(1.0.2 => 1.0.4) VM register messed up depending on unrelated context�� (#15704) from version 1.2.6 * Fixed ��The pegs module doesn��t work with generics!�� (#14718) * Fixed ��[goto exceptions] {.noReturn.} pragma is not detected in a case expression�� (#14458) * Fixed ��[exceptions:goto] C compiler error with dynlib pragma calling a proc�� (#14240) * Fixed ��Nim source archive install: ��install.sh�� fails with error: cp: cannot stat ��bin/nim-gdb��: No such file or directory�� (#14748) * Fixed ��Stropped identifiers don��t work as field names in tuple literals�� (#14911) * Fixed ��uri.decodeUrl crashes on incorrectly formatted input�� (#14082) * Fixed ��odbcsql module has some wrong integer types�� (#9771) * Fixed ��[ARC] Compiler crash declaring a finalizer proc directly in ��new�� (#15044) * Fixed ��code with named arguments in proc of winim/com can not been compiled�� (#15056) * Fixed ��javascript backend produces javascript code with syntax error in object syntax�� (#14534) * Fixed ��[ARC] SIGSEGV when calling a closure as a tuple field in a seq�� (#15038) * Fixed ��Compiler crashes when using string as object variant selector with else branch�� (#14189) * Fixed ��Constructing a uint64 range on a 32-bit machine leads to incorrect codegen�� (#14616) Update to version 1.2.2: * See https://nim-lang.org/blog.html for details Update to version 1.0.2: * See https://nim-lang.org/blog.html for details This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-628=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): nim-1.2.12-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-21372.html https://www.suse.com/security/cve/CVE-2021-21373.html https://www.suse.com/security/cve/CVE-2021-21374.html https://bugzilla.suse.com/1185083 https://bugzilla.suse.com/1185084 https://bugzilla.suse.com/1185085

1 0

openSUSE-RU-2021:0627-1: moderate: Recommended update for gnuhealth
by maintenance＠opensuse.org 28 Apr '21

28 Apr '21

openSUSE Recommended Update: Recommended update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0627-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - update to path determination in specfile Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-627=1 Package List: - openSUSE Leap 15.2 (noarch): gnuhealth-3.6.5-lp152.4.12.1 gnuhealth-orthanc-3.6.5-lp152.4.12.1 References:

1 0

openSUSE-RU-2021:0626-1: moderate: Recommended update for gnuhealth
by maintenance＠opensuse.org 28 Apr '21

28 Apr '21

openSUSE Recommended Update: Recommended update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0626-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - update to gnuhealth-control - add upstream signing key and verify source signature Variable for EDITOR set This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-626=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): gnuhealth-3.6.5-bp152.3.12.1 gnuhealth-orthanc-3.6.5-bp152.3.12.1 References:

1 0

openSUSE-RU-2021:0625-1: moderate: Recommended update for libva
by maintenance＠opensuse.org 28 Apr '21

28 Apr '21

openSUSE Recommended Update: Recommended update for libva ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0625-1 Rating: moderate References: SLE-12712 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for libva fixes the following issues: libva was updated to 2.10.0: * add: Pass offset and size of pred_weight_table * add: add vaCopy interface to copy surface and buffer * add: add definition for different execution * add: New parameters for transport controlled BRC were added * add: add FreeBSD support * add: add a bufer type to adjust context priority dynamically * fix: correct the api version in meson.build * fix: remove deprecated variable from va_trace.c * fix: Use va_deprecated for the deprecate variable * fix: Mark chroma_sample_position as deprecated * doc: va_dec_av1: clarifies CDEF syntax element packing * doc: [AV1] Update documented ranges for loop filter and quantization params. * doc: Update va.h for multi-threaded usages * trace: va/va_trace: ignore system gettid() on Linux update to 2.9.0: * trace: Refine the va_TraceVAPictureParameterBufferAV1. * doc: Add comments for backward/forward reference to avoid confusion * doc: Modify comments in av1 decoder interfaces * doc: Update mailing list * Add SCC fields trace for HEVC SCC encoding. * Add FOURCC code for Y212 and Y412 format. * Add interpolation method for scaling. * add attributes for context priority setting * Add vaSyncBuffer for output buffers synchronization * Add vaSyncSurface2 with timeout version 2.8.0 needed for jira#SLE/SLE-12712 update to 2.8.0: * trace: enable return value trace for successful function call * trace: divide va_TraceEndPicture to two seperate function * trace: add support for VAProfileHEVCSccMain444_10 * fix:Fixes file descriptor leak * add fourcc code for P012 format * travis: Add a test that code files don't have the exec bit set * Remove the execute bit from all source code files * meson: Allow for libdir and includedir to be absolute paths * trace: Fix format string warnings * fix:Fix clang warning (reading garbage) * add definition to enforce both reflist not empty * trace: List correct field names in va_TraceVAPictureParameterBufferHEVC * change the return value to be UNIMPLEMENTED when the function pointer is NULL * remove check of vaPutSurface implementation * Add new slice structure flag for CAPS reporting * VA/X11: VAAPI driver mapping for iris DRI driver * VA/X11: enable driver candidate selection for DRI2 * Add SCC flags to enable/disable features * fix: Fix HDR10 MaxCLL and MaxFALL documentation * Add VAProfileHEVCSccMain444_10 for HEVC * change the compatible list to be dynamic one * trace:Convert VAProfileAV1Profile0 VAProfileAV1Profile1 to string Update to version 2.7.0 * trace: av1 decode buffers trace * trace: Add HEVC REXT and SCC trace for decoding. * Add av1 decode interfaces * Fix crashes on system without supported hardware by PR #369. * Add 2 FourCC for 10bit RGB(without Alpha) format: X2R10G10B10 and X2B10G10R10. * Fix android build issue #365 and remove some trailing whitespace * Adjust call sequence to ensure authenticate operation is executed to fix #355 Update to version 2.6.1 * adjust call sequence to ensure authenticate operation is executed this patch is not needed for media-driver, but needed for i965 driver which check authentication. Update to version 2.6.0: * enable the mutiple driver selection logic and enable it for DRM. * drm: Add iHD to driver_name_map * Add missed slice parameter 'slice_data_num_emu_prevn_bytes' * ensure that all meson files are part of the release tarball * configure: use correct comparison operator * trace: support VAConfigAttribMultipleFrame in trace * remove incorrect field of VAConfigAttribValDecJPEG * va/va_trace: Dump VP9 parameters for profile 1~3 * add multiple frame capability report * add variable to indicate layer infromation * trace: fix memory leak on closing the trace * add prediction direction caps report * Add comments for colour primaries and transfer characteristics in VAProcColorProperties Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-625=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libva-debugsource-2.10.0-lp152.3.3.1 libva-devel-2.10.0-lp152.3.3.1 libva-drm2-2.10.0-lp152.3.3.1 libva-drm2-debuginfo-2.10.0-lp152.3.3.1 libva-gl-debugsource-2.10.0-lp152.3.3.1 libva-gl-devel-2.10.0-lp152.3.3.1 libva-glx2-2.10.0-lp152.3.3.1 libva-glx2-debuginfo-2.10.0-lp152.3.3.1 libva-wayland2-2.10.0-lp152.3.3.1 libva-wayland2-debuginfo-2.10.0-lp152.3.3.1 libva-x11-2-2.10.0-lp152.3.3.1 libva-x11-2-debuginfo-2.10.0-lp152.3.3.1 libva2-2.10.0-lp152.3.3.1 libva2-debuginfo-2.10.0-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): libva-devel-32bit-2.10.0-lp152.3.3.1 libva-drm2-32bit-2.10.0-lp152.3.3.1 libva-drm2-32bit-debuginfo-2.10.0-lp152.3.3.1 libva-gl-devel-32bit-2.10.0-lp152.3.3.1 libva-glx2-32bit-2.10.0-lp152.3.3.1 libva-glx2-32bit-debuginfo-2.10.0-lp152.3.3.1 libva-utils-2.0.0-lp152.4.2.1 libva-utils-debuginfo-2.0.0-lp152.4.2.1 libva-utils-debugsource-2.0.0-lp152.4.2.1 libva-wayland2-32bit-2.10.0-lp152.3.3.1 libva-wayland2-32bit-debuginfo-2.10.0-lp152.3.3.1 libva-x11-2-32bit-2.10.0-lp152.3.3.1 libva-x11-2-32bit-debuginfo-2.10.0-lp152.3.3.1 libva2-32bit-2.10.0-lp152.3.3.1 libva2-32bit-debuginfo-2.10.0-lp152.3.3.1 References:

1 0

openSUSE-RU-2021:0624-1: moderate: Recommended update for ffmpeg-4
by maintenance＠opensuse.org 28 Apr '21

28 Apr '21

openSUSE Recommended Update: Recommended update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0624-1 Rating: moderate References: #1184830 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ffmpeg-4 fixes the following issues: - Enable dav1d decoder to support av1 (fixes boo#1184830) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-624=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): ffmpeg-4-libavcodec-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libavdevice-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libavfilter-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libavformat-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libavresample-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libavutil-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libpostproc-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libswresample-devel-4.2.1-bp152.2.6.1 ffmpeg-4-libswscale-devel-4.2.1-bp152.2.6.1 ffmpeg-4-private-devel-4.2.1-bp152.2.6.1 libavcodec58-4.2.1-bp152.2.6.1 libavdevice58-4.2.1-bp152.2.6.1 libavfilter7-4.2.1-bp152.2.6.1 libavformat58-4.2.1-bp152.2.6.1 libavresample4-4.2.1-bp152.2.6.1 libavutil56-4.2.1-bp152.2.6.1 libpostproc55-4.2.1-bp152.2.6.1 libswresample3-4.2.1-bp152.2.6.1 libswscale5-4.2.1-bp152.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): libavcodec58-64bit-4.2.1-bp152.2.6.1 libavdevice58-64bit-4.2.1-bp152.2.6.1 libavfilter7-64bit-4.2.1-bp152.2.6.1 libavformat58-64bit-4.2.1-bp152.2.6.1 libavresample4-64bit-4.2.1-bp152.2.6.1 libavutil56-64bit-4.2.1-bp152.2.6.1 libpostproc55-64bit-4.2.1-bp152.2.6.1 libswresample3-64bit-4.2.1-bp152.2.6.1 libswscale5-64bit-4.2.1-bp152.2.6.1 References: https://bugzilla.suse.com/1184830

1 0

openSUSE-RU-2021:0623-1: moderate: Recommended update for installation-images
by maintenance＠opensuse.org 27 Apr '21

27 Apr '21

openSUSE Recommended Update: Recommended update for installation-images ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0623-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This installation-images update refreshes the installation images will all current updates to allow rebuilding the openSUSE Leap 15.2 media. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-623=1 Package List: - openSUSE Leap 15.2 (noarch): tftpboot-installation-openSUSE-Leap-15.2-x86_64-14.477-lp152.2.11.1 - openSUSE Leap 15.2 (x86_64): install-initrd-openSUSE-14.477-lp152.2.11.1 installation-images-debuginfodeps-openSUSE-14.477-lp152.2.11.1 installation-images-openSUSE-14.477-lp152.2.11.1 skelcd-installer-net-openSUSE-14.477-lp152.2.11.1 skelcd-installer-openSUSE-14.477-lp152.2.11.1 References:

1 0

openSUSE-RU-2021:0622-1: important: Recommended update for NetworkManager
by maintenance＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0622-1 Rating: important References: #1183202 #1183967 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for NetworkManager fixes the following issues: - Better handle dhclient's timeout so that a recorded lease can be used when dhcp server is down. (bsc#1183202) - Use `dhclient` as the default dhcp client. (bsc#1183202) - bond: restore `MAC` on release only when there is a cloned `MAC address`. (bsc#1183967) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-622=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): NetworkManager-1.22.10-lp152.2.6.1 NetworkManager-debuginfo-1.22.10-lp152.2.6.1 NetworkManager-debugsource-1.22.10-lp152.2.6.1 NetworkManager-devel-1.22.10-lp152.2.6.1 libnm0-1.22.10-lp152.2.6.1 libnm0-debuginfo-1.22.10-lp152.2.6.1 typelib-1_0-NM-1_0-1.22.10-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): NetworkManager-branding-upstream-1.22.10-lp152.2.6.1 NetworkManager-lang-1.22.10-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): NetworkManager-devel-32bit-1.22.10-lp152.2.6.1 References: https://bugzilla.suse.com/1183202 https://bugzilla.suse.com/1183967

1 0

openSUSE-SU-2021:0621-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0621-1 Rating: important References: #1184960 Cross-References: CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVSS scores: CVE-2021-23961 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23961 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23994 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23995 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23998 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23999 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-24002 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29945 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29946 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox was updated to 78.10.0 ESR (bsc#1184960) * CVE-2021-23994: Out of bound write due to lazy initialization * CVE-2021-23995: Use-after-free in Responsive Design Mode * CVE-2021-23998: Secure Lock icon could have been spoofed * CVE-2021-23961: More internal network hosts could have been probed by a malicious webpage * CVE-2021-23999: Blob URLs may have been granted additional privileges * CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL * CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads * CVE-2021-29946: Port blocking could be bypassed This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-621=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaFirefox-78.10.0-lp152.2.55.1 MozillaFirefox-branding-upstream-78.10.0-lp152.2.55.1 MozillaFirefox-buildsymbols-78.10.0-lp152.2.55.1 MozillaFirefox-debuginfo-78.10.0-lp152.2.55.1 MozillaFirefox-debugsource-78.10.0-lp152.2.55.1 MozillaFirefox-devel-78.10.0-lp152.2.55.1 MozillaFirefox-translations-common-78.10.0-lp152.2.55.1 MozillaFirefox-translations-other-78.10.0-lp152.2.55.1 References: https://www.suse.com/security/cve/CVE-2021-23961.html https://www.suse.com/security/cve/CVE-2021-23994.html https://www.suse.com/security/cve/CVE-2021-23995.html https://www.suse.com/security/cve/CVE-2021-23998.html https://www.suse.com/security/cve/CVE-2021-23999.html https://www.suse.com/security/cve/CVE-2021-24002.html https://www.suse.com/security/cve/CVE-2021-29945.html https://www.suse.com/security/cve/CVE-2021-29946.html https://bugzilla.suse.com/1184960

1 0

openSUSE-SU-2021:0620-1: moderate: Security update for jhead
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for jhead ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0620-1 Rating: moderate References: #1184756 Cross-References: CVE-2021-3496 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jhead fixes the following issues: - CVE-2021-3496: Fixed heap-based buffer overflow in Get16u() in exif.c (bsc#1184756) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-620=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): jhead-3.00-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-3496.html https://bugzilla.suse.com/1184756

1 0

openSUSE-SU-2021:0619-1: Security update for libdwarf
by opensuse-security＠opensuse.org 26 Apr '21

26 Apr '21

openSUSE Security Update: Security update for libdwarf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0619-1 Rating: low References: #1185057 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libdwarf fixes the following issues: - Hardening: Link /usr/bin/dwarfdump as PIE (bsc#1185057). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-619=1 Package List: - openSUSE Leap 15.2 (x86_64): libdwarf-debuginfo-20161124-lp152.4.3.1 libdwarf-debugsource-20161124-lp152.4.3.1 libdwarf-devel-20161124-lp152.4.3.1 libdwarf-devel-debuginfo-20161124-lp152.4.3.1 libdwarf-devel-static-20161124-lp152.4.3.1 libdwarf-doc-20161124-lp152.4.3.1 libdwarf-tools-20161124-lp152.4.3.1 libdwarf-tools-debuginfo-20161124-lp152.4.3.1 libdwarf1-20161124-lp152.4.3.1 libdwarf1-debuginfo-20161124-lp152.4.3.1 References: https://bugzilla.suse.com/1185057

1 0