April 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0528-1: moderate: Recommended update for cups
by maintenance＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Recommended Update: Recommended update for cups ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0528-1 Rating: moderate References: #1175960 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups fixes the following issues: - Fixed the web UI kerberos authentication (bsc#1175960) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-528=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cups-2.2.7-lp152.9.6.1 cups-client-2.2.7-lp152.9.6.1 cups-client-debuginfo-2.2.7-lp152.9.6.1 cups-config-2.2.7-lp152.9.6.1 cups-ddk-2.2.7-lp152.9.6.1 cups-ddk-debuginfo-2.2.7-lp152.9.6.1 cups-debuginfo-2.2.7-lp152.9.6.1 cups-debugsource-2.2.7-lp152.9.6.1 cups-devel-2.2.7-lp152.9.6.1 libcups2-2.2.7-lp152.9.6.1 libcups2-debuginfo-2.2.7-lp152.9.6.1 libcupscgi1-2.2.7-lp152.9.6.1 libcupscgi1-debuginfo-2.2.7-lp152.9.6.1 libcupsimage2-2.2.7-lp152.9.6.1 libcupsimage2-debuginfo-2.2.7-lp152.9.6.1 libcupsmime1-2.2.7-lp152.9.6.1 libcupsmime1-debuginfo-2.2.7-lp152.9.6.1 libcupsppdc1-2.2.7-lp152.9.6.1 libcupsppdc1-debuginfo-2.2.7-lp152.9.6.1 - openSUSE Leap 15.2 (x86_64): cups-devel-32bit-2.2.7-lp152.9.6.1 libcups2-32bit-2.2.7-lp152.9.6.1 libcups2-32bit-debuginfo-2.2.7-lp152.9.6.1 libcupscgi1-32bit-2.2.7-lp152.9.6.1 libcupscgi1-32bit-debuginfo-2.2.7-lp152.9.6.1 libcupsimage2-32bit-2.2.7-lp152.9.6.1 libcupsimage2-32bit-debuginfo-2.2.7-lp152.9.6.1 libcupsmime1-32bit-2.2.7-lp152.9.6.1 libcupsmime1-32bit-debuginfo-2.2.7-lp152.9.6.1 libcupsppdc1-32bit-2.2.7-lp152.9.6.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp152.9.6.1 References: https://bugzilla.suse.com/1175960

1 0

openSUSE-RU-2021:0523-1: moderate: Recommended update for pgloader
by maintenance＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Recommended Update: Recommended update for pgloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0523-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for pgloader fixes the following issues: - fix compilation errors with sbcl 2.{1,2} by upgrading ironclad included version (0.48 to 0.54) - fix compilation errors with sbcl 2.0.9 by using upstream patch for csv-cl component - Add patch for a broken dependency Update to version 3.6.2 + Permit compilation with sbcl 2+ (module cffi updated to 0.21.0 + Big improvement in DBF module Packaging + Remove merged related fixes (cffi) - Add module cffi to version 0.21.0 in the bundle to fix compilation error with newer sbcl 2+ This release contains three major themes: usual maintenance and bug fixing, support for new database systems as sources and + Remove man1 there's no more available - Binary is using gethostbyname(), and don't use -fpie due to sbcl Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-523=1 Package List: - openSUSE Leap 15.2 (x86_64): pgloader-3.6.2-lp152.3.3.1 References:

1 0

openSUSE-RU-2021:0525-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0525-1 Rating: moderate References: #1183639 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-network fixes the following issues: - It does now correctly provide the layer2 argument when activating a qeth device (bsc#1183639) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-525=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-network-4.2.97-lp152.2.33.1 References: https://bugzilla.suse.com/1183639

1 0

openSUSE-RU-2021:0524-1: moderate: Recommended update for lttng-modules
by maintenance＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Recommended Update: Recommended update for lttng-modules ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0524-1 Rating: moderate References: #1182570 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lttng-modules fixes the following issue: - package is rebuilt with the new secure boot key. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-524=1 Package List: - openSUSE Leap 15.2 (x86_64): lttng-modules-2.10.10-lp152.4.3.1 lttng-modules-debugsource-2.10.10-lp152.4.3.1 lttng-modules-kmp-default-2.10.10_k5.3.18_lp152.66-lp152.4.3.1 lttng-modules-kmp-default-debuginfo-2.10.10_k5.3.18_lp152.66-lp152.4.3.1 lttng-modules-kmp-preempt-2.10.10_k5.3.18_lp152.66-lp152.4.3.1 lttng-modules-kmp-preempt-debuginfo-2.10.10_k5.3.18_lp152.66-lp152.4.3.1 References: https://bugzilla.suse.com/1182570

1 0

openSUSE-RU-2021:0526-1: Recommended update for xdm
by maintenance＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Recommended Update: Recommended update for xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0526-1 Rating: low References: #1183698 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xdm fixes the following issues: - Corrected the pid file path of display-manager.service (bsc#1183698) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-526=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xdm-1.1.11-lp152.15.3.1 xdm-debuginfo-1.1.11-lp152.15.3.1 xdm-debugsource-1.1.11-lp152.15.3.1 xdm-xsession-1.1.11-lp152.15.3.1 References: https://bugzilla.suse.com/1183698

1 0

openSUSE-SU-2021:0520-1: important: Security update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk
by opensuse-security＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Security Update: Security update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0520-1 Rating: important References: #1133120 #1133124 #1175899 #1180996 Cross-References: CVE-2021-21261 CVSS scores: CVE-2021-21261 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21261 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues: libostree: Update to version 2020.8 - Enable LTO. (bsc#1133120) - This update contains scalability improvements and bugfixes. - Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be re-downloaded if not changed in the meanwhile. - Summaries and delta have been reworked to allow more fine-grained fetching. - Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures. - Static deltas can now be signed to more easily support offline verification. - There's now support for multiple initramfs images; Is it possible to have a "main" initramfs image and a secondary one which represents local configuration. - The documentation is now moved to https://ostreedev.github.io/ostree/ - Fix for an assertion failure when upgrading from systems before ostree supported devicetree. - ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts. - ostree now supports `/` and `/boot` being on the same filesystem. - Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for the immutable bit on s390x, dropping a deprecated bit in the systemd unit file. - Fix a regression 2020.4 where the "readonly sysroot" changes incorrectly left the sysroot read-only on systems that started out with a read-only `/` (most of them, e.g. Fedora Silverblue/IoT at least). - The default dracut config now enables reproducibility. - There is a new ostree admin unlock `--transient`. This should to be a foundation for further support for "live" updates. - New `ed25519` signing support, powered by `libsodium`. - stree commit gained a new `--base` argument, which significantly simplifies constructing "derived" commits, particularly for systems using SELinux. - Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. Enabling the `readonly=true` flag in the repo config is recommended. - Several fixes in locking for the temporary "staging" directories OSTree creates, particularly on NFS. - A new `timestamp-check-from-rev` option was added for pulls, which makes downgrade protection more reliable and will be used by Fedora CoreOS. - Several fixes and enhancements made for "collection" pulls including a new `--mirror` option. - The ostree commit command learned a new `--mode-ro-executables` which enforces `W^R` semantics on all executables. - Added a new commit metadata key `OSTREE_COMMIT_META_KEY_ARCHITECTURE` to help standardize the architecture of the OSTree commit. This could be used on the client side for example to sanity-check that the commit matches the architecture of the machine before deploying. - Stop invalid usage of `%_libexecdir`: + Use `%{_prefix}/lib` where appropriate. + Use `_systemdgeneratordir` for the systemd-generators. + Define `_dracutmodulesdir` based on `dracut.pc`. Add BuildRequires(dracut) for this to work. xdg-desktop-portal: Update to version 1.8.0: - Ensure systemd rpm macros are called at install/uninstall times for systemd user services. - Add BuildRequires on systemd-rpm-macros. - openuri: - Allow skipping the chooser for more URL tyles - Robustness fixes - filechooser: - Return the current filter - Add a "directory" option - Document the "writable" option - camera: - Make the client node visible - Don't leak pipewire proxy - Fix file descriptor leaks - Testsuite improvements - Updated translations. - document: - Reduce the use of open fds - Add more tests and fix issues they found - Expose directories with their proper name - Support exporting directories - New fuse implementation - background: Avoid a segfault - screencast: Require pipewire 0.3 - Better support for snap and toolbox - Require `/usr/bin/fusermount`: `xdg-document-portal` calls out to the binary. (bsc#1175899) Without it, files or dirs can be selected, but whatever is done with or in them, will not have any effect - Fixes for `%_libexecdir` changing to `/usr/libexec` xdg-desktop-portal-gtk: Update to version 1.8.0: - filechooser: - Return the current filter - Handle the "directory" option to select directories - Only show preview when we have an image - screenshot: Fix cancellation - appchooser: Avoid a crash - wallpaper: - Properly preview placement settings - Drop the lockscreen option - printing: Improve the notification - Updated translations. - settings: Fall back to gsettings for enable-animations - screencast: Support Mutter version to 3 (New pipewire api ver 3). flatpak: - Update to version 1.10.2 (jsc#SLE-17238, ECO-3148) - This is a security update which fixes a potential attack where a flatpak application could use custom formated `.desktop` file to gain access to files on the host system. - Fix memory leaks - Documentation and translations updates - Spawn portal better handles non-utf8 filenames - Fix flatpak build on systems with setuid bwrap - Fix crash on updating apps with no deploy data - Remove deprecated texinfo packaging macros. - Support for the new repo format which should make updates faster and download less data. - The systemd generator snippets now call flatpak `--print-updated-env` in place of a bunch of shell for better login performance. - The `.profile` snippets now disable GVfs when calling flatpak to avoid spawning a gvfs daemon when logging in via ssh. - Flatpak now finds the pulseaudio sockets better in uncommon configurations. - Sandboxes with network access it now also has access to the `systemd-resolved` socket to do dns lookups. - Flatpak supports unsetting environment variables in the sandbox using `--unset-env`, and `--env=FOO=` now sets FOO to the empty string instead of unsetting it. - The spawn portal now has an option to share the pid namespace with the sub-sandbox. - This security update fixes a sandbox escape where a malicious application can execute code outside the sandbox by controlling the environment of the "flatpak run" command when spawning a sub-sandbox (bsc#1180996, CVE-2021-21261) - Fix support for ppc64. - Move flatpak-bisect and flatpak-coredumpctl to devel subpackage, allow to remove python3 dependency on main package. - Enable LTO as gobject-introspection works fine with LTO. (bsc#1133124) - Fixed progress reporting for OCI and extra-data. - The in-memory summary cache is more efficient. - Fixed authentication getting stuck in a loop in some cases. - Fixed authentication error reporting. - Extract OCI info for runtimes as well as apps. - Fixed crash if anonymous authentication fails and `-y` is specified. - flatpak info now only looks at the specified installation if one is specified. - Better error reporting for server HTTP errors during download. - Uninstall now removes applications before the runtime it depends on. - Avoid updating metadata from the remote when uninstalling. - FlatpakTransaction now verifies all passed in refs to avoid. - Added validation of collection id settings for remotes. - Fix seccomp filters on s390. - Robustness fixes to the spawn portal. - Fix support for masking update in the system installation. - Better support for distros with uncommon models of merged `/usr`. - Cache responses from localed/AccountService. - Fix hangs in cases where `xdg-dbus-proxy` fails to start. - Fix double-free in cups socket detection. - OCI authenticator now doesn't ask for auth in case of http errors. - Fix invalid usage of `%{_libexecdir}` to reference systemd directories. - Fixes for `%_libexecdir` changing to `/usr/libexec` - Avoid calling authenticator in update if ref didn't change - Don't fail transaction if ref is already installed (after transaction start) - Fix flatpak run handling of userns in the `--device=all` case - Fix handling of extensions from different remotes - Fix flatpak run `--no-session-bus` - `FlatpakTransaction` has a new signal `install-authenticator` which clients can handle to install authenticators needed for the transaction. This is done in the CLI commands. - Now the host timezone data is always exposed, fixing several apps that had timezone issues. - There's a new systemd unit (not installed by default) to automatically detect plugged in usb sticks with sideload repos. - By default the `gdm env.d` file is no longer installed because the systemd generators work better. - `create-usb` now exports partial commits by default - Fix handling of docker media types in oci remotes - Fix subjects in `remote-info --log` output - This release is also able to host flatpak images on e.g. docker hub. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-520=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libostree-1-1-2020.8-lp152.2.3.1 libostree-1-1-debuginfo-2020.8-lp152.2.3.1 libostree-2020.8-lp152.2.3.1 libostree-debuginfo-2020.8-lp152.2.3.1 libostree-debugsource-2020.8-lp152.2.3.1 libostree-devel-2020.8-lp152.2.3.1 libostree-grub2-2020.8-lp152.2.3.1 typelib-1_0-OSTree-1_0-2020.8-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): flatpak-1.10.2-lp152.3.6.1 flatpak-debuginfo-1.10.2-lp152.3.6.1 flatpak-debugsource-1.10.2-lp152.3.6.1 flatpak-devel-1.10.2-lp152.3.6.1 flatpak-zsh-completion-1.10.2-lp152.3.6.1 libflatpak0-1.10.2-lp152.3.6.1 libflatpak0-debuginfo-1.10.2-lp152.3.6.1 system-user-flatpak-1.10.2-lp152.3.6.1 typelib-1_0-Flatpak-1_0-1.10.2-lp152.3.6.1 xdg-desktop-portal-1.8.0-lp152.4.3.1 xdg-desktop-portal-debuginfo-1.8.0-lp152.4.3.1 xdg-desktop-portal-debugsource-1.8.0-lp152.4.3.1 xdg-desktop-portal-devel-1.8.0-lp152.4.3.1 xdg-desktop-portal-gtk-1.8.0-lp152.2.3.1 xdg-desktop-portal-gtk-debuginfo-1.8.0-lp152.2.3.1 xdg-desktop-portal-gtk-debugsource-1.8.0-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): xdg-desktop-portal-gtk-lang-1.8.0-lp152.2.3.1 xdg-desktop-portal-lang-1.8.0-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-21261.html https://bugzilla.suse.com/1133120 https://bugzilla.suse.com/1133124 https://bugzilla.suse.com/1175899 https://bugzilla.suse.com/1180996

1 0

openSUSE-SU-2021:0519-1: important: Security update for hostapd
by opensuse-security＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Security Update: Security update for hostapd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0519-1 Rating: important References: #1150934 #1172700 #1184348 Cross-References: CVE-2019-16275 CVE-2020-12695 CVE-2021-30004 CVSS scores: CVE-2019-16275 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-16275 (SUSE): 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-12695 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H CVE-2021-30004 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-30004 (SUSE): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for hostapd fixes the following issues: - CVE-2021-30004: forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (boo#1184348) - CVE-2020-12695: UPnP SUBSCRIBE misbehavior in hostapd WPS AP (boo#1172700) - CVE-2019-16275: AP mode PMF disconnection protection bypass (boo#1150934) - added AppArmor profile (source apparmor-usr.sbin.hostapd) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-519=1 Package List: - openSUSE Leap 15.2 (x86_64): hostapd-2.9-lp152.2.3.1 hostapd-debuginfo-2.9-lp152.2.3.1 hostapd-debugsource-2.9-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-16275.html https://www.suse.com/security/cve/CVE-2020-12695.html https://www.suse.com/security/cve/CVE-2021-30004.html https://bugzilla.suse.com/1150934 https://bugzilla.suse.com/1172700 https://bugzilla.suse.com/1184348

1 0

openSUSE-SU-2021:0522-1: important: Security update for fwupd
by opensuse-security＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Security Update: Security update for fwupd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0522-1 Rating: important References: #1172643 #1182057 Cross-References: CVE-2020-10759 CVSS scores: CVE-2020-10759 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVE-2020-10759 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for fwupd fixes the following issues: - Update to version 1.2.14: (bsc#1182057) - Add SBAT section to EFI images (bsc#1182057) - CVE-2020-10759: Validate that gpgme_op_verify_result() returned at least one signature (bsc#1172643) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-522=1 Package List: - openSUSE Leap 15.2 (x86_64): dfu-tool-1.2.14-lp152.3.9.1 dfu-tool-debuginfo-1.2.14-lp152.3.9.1 fwupd-1.2.14-lp152.3.9.1 fwupd-debuginfo-1.2.14-lp152.3.9.1 fwupd-debugsource-1.2.14-lp152.3.9.1 fwupd-devel-1.2.14-lp152.3.9.1 libfwupd2-1.2.14-lp152.3.9.1 libfwupd2-debuginfo-1.2.14-lp152.3.9.1 typelib-1_0-Fwupd-2_0-1.2.14-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): fwupd-lang-1.2.14-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2020-10759.html https://bugzilla.suse.com/1172643 https://bugzilla.suse.com/1182057

1 0

openSUSE-SU-2021:0521-1: important: Security update for fwupdate
by opensuse-security＠opensuse.org 09 Apr '21

09 Apr '21

openSUSE Security Update: Security update for fwupdate ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0521-1 Rating: important References: #1182057 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fwupdate fixes the following issues: - Add SBAT section to EFI images (bsc#1182057) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-521=1 Package List: - openSUSE Leap 15.2 (x86_64): fwupdate-12-lp152.6.6.1 fwupdate-debuginfo-12-lp152.6.6.1 fwupdate-debugsource-12-lp152.6.6.1 fwupdate-devel-12-lp152.6.6.1 fwupdate-efi-12-lp152.6.6.1 fwupdate-efi-debuginfo-12-lp152.6.6.1 libfwup1-12-lp152.6.6.1 libfwup1-debuginfo-12-lp152.6.6.1 References: https://bugzilla.suse.com/1182057

1 0

openSUSE-SU-2021:0516-1: important: Security update for isync
by opensuse-security＠opensuse.org 07 Apr '21

07 Apr '21

openSUSE Security Update: Security update for isync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0516-1 Rating: important References: #1182488 Cross-References: CVE-2021-20247 CVSS scores: CVE-2021-20247 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for isync fixes the following issues: - isync was updated to version 1.3.5 - CVE-2021-20247: reject funny mailbox names from IMAP LIST/LSUB (boo#1182488) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-516=1 Package List: - openSUSE Leap 15.2 (x86_64): isync-1.3.5-lp152.4.3.1 isync-debuginfo-1.3.5-lp152.4.3.1 isync-debugsource-1.3.5-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20247.html https://bugzilla.suse.com/1182488

1 0