April 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0558-1: moderate: Recommended update for gnuhealth-thalamus
by maintenance＠opensuse.org 15 Apr '21

15 Apr '21

openSUSE Recommended Update: Recommended update for gnuhealth-thalamus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0558-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth-thalamus fixes the following issues: version 0.9.14 - no changelog provided version 0.9.13 - fixes https://savannah.gnu.org/bugs/?60164 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-558=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): gnuhealth-thalamus-0.9.14-bp152.2.4.1 References:

1 0

openSUSE-RU-2021:0556-1: important: Recommended update for irqbalance
by maintenance＠opensuse.org 15 Apr '21

15 Apr '21

openSUSE Recommended Update: Recommended update for irqbalance ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0556-1 Rating: important References: #1178477 #1183405 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for irqbalance fixes the following issues: - Fixed a bug where irqbalance did not correctly balance interrupts in Xen guests (bsc#1178477, bsc#1183405) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-556=1 Package List: - openSUSE Leap 15.2 (x86_64): irqbalance-1.4.0-lp152.4.6.1 irqbalance-debuginfo-1.4.0-lp152.4.6.1 irqbalance-debugsource-1.4.0-lp152.4.6.1 References: https://bugzilla.suse.com/1178477 https://bugzilla.suse.com/1183405

1 0

openSUSE-SU-2021:0555-1: important: Security update for clamav
by opensuse-security＠opensuse.org 15 Apr '21

15 Apr '21

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0555-1 Rating: important References: #1181256 #1184532 #1184533 #1184534 Cross-References: CVE-2021-1252 CVE-2021-1404 CVE-2021-1405 CVSS scores: CVE-2021-1252 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-1252 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-1404 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-1405 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: - CVE-2021-1252: Fix for Excel XLM parser infinite loop. (bsc#1184532) - CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. (bsc#1184533) - CVE-2021-1405: Fix for mail parser NULL-dereference crash. (bsc#1184534) - Fix errors when scanning files > 4G (bsc#1181256) - Update clamav.keyring - Update to 0.103.2 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-555=1 Package List: - openSUSE Leap 15.2 (x86_64): clamav-0.103.2-lp152.6.6.1 clamav-debuginfo-0.103.2-lp152.6.6.1 clamav-debugsource-0.103.2-lp152.6.6.1 clamav-devel-0.103.2-lp152.6.6.1 libclamav9-0.103.2-lp152.6.6.1 libclamav9-debuginfo-0.103.2-lp152.6.6.1 libfreshclam2-0.103.2-lp152.6.6.1 libfreshclam2-debuginfo-0.103.2-lp152.6.6.1 References: https://www.suse.com/security/cve/CVE-2021-1252.html https://www.suse.com/security/cve/CVE-2021-1404.html https://www.suse.com/security/cve/CVE-2021-1405.html https://bugzilla.suse.com/1181256 https://bugzilla.suse.com/1184532 https://bugzilla.suse.com/1184533 https://bugzilla.suse.com/1184534

1 0

openSUSE-SU-2021:0554-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 15 Apr '21

15 Apr '21

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0554-1 Rating: important References: #1180128 Cross-References: CVE-2021-3472 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xorg-x11-server fixes the following issues: - CVE-2021-3472: XChangeFeedbackControl Integer Underflow Privilege Escalation (bsc#1180128) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-554=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.21.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.21.1 xorg-x11-server-debugsource-1.20.3-lp152.8.21.1 xorg-x11-server-extra-1.20.3-lp152.8.21.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.21.1 xorg-x11-server-sdk-1.20.3-lp152.8.21.1 xorg-x11-server-source-1.20.3-lp152.8.21.1 xorg-x11-server-wayland-1.20.3-lp152.8.21.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.21.1 References: https://www.suse.com/security/cve/CVE-2021-3472.html https://bugzilla.suse.com/1180128

1 0

openSUSE-SU-2021:0553-1: important: Security update for fluidsynth
by opensuse-security＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Security Update: Security update for fluidsynth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0553-1 Rating: important References: #1184705 Cross-References: CVE-2021-28421 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fluidsynth fixes the following issues: - CVE-2021-28421: Fix use after free vulnerability in file loader (boo#1184705) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-553=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): fluidsynth-1.1.11-lp152.4.3.1 fluidsynth-debuginfo-1.1.11-lp152.4.3.1 fluidsynth-debugsource-1.1.11-lp152.4.3.1 fluidsynth-devel-1.1.11-lp152.4.3.1 libfluidsynth1-1.1.11-lp152.4.3.1 libfluidsynth1-debuginfo-1.1.11-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libfluidsynth1-32bit-1.1.11-lp152.4.3.1 libfluidsynth1-32bit-debuginfo-1.1.11-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-28421.html https://bugzilla.suse.com/1184705

1 0

openSUSE-RU-2021:0550-1: important: Recommended update for sblim-sfcb
by maintenance＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Recommended Update: Recommended update for sblim-sfcb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0550-1 Rating: important References: #1180753 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sblim-sfcb fixes the following issue: - Avoid a double free during a failed localhost client connection. (bsc#1180753) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-550=1 Package List: - openSUSE Leap 15.2 (x86_64): sblim-sfcb-1.4.9-lp152.3.6.1 sblim-sfcb-debuginfo-1.4.9-lp152.3.6.1 sblim-sfcb-debugsource-1.4.9-lp152.3.6.1 References: https://bugzilla.suse.com/1180753

1 0

openSUSE-SU-2021:0551-1: important: Security update for spamassassin
by opensuse-security＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Security Update: Security update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0551-1 Rating: important References: #1159133 #1184221 Cross-References: CVE-2019-12420 CVE-2020-1946 CVSS scores: CVE-2019-12420 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12420 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-1946 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for spamassassin fixes the following issues: - CVE-2019-12420: memory leak via crafted messages (bsc#1159133) - CVE-2020-1946: security update (bsc#1184221) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-551=1 Package List: - openSUSE Leap 15.2 (x86_64): perl-Mail-SpamAssassin-3.4.5-lp152.10.3.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp152.10.3.1 spamassassin-3.4.5-lp152.10.3.1 spamassassin-debuginfo-3.4.5-lp152.10.3.1 spamassassin-debugsource-3.4.5-lp152.10.3.1 References: https://www.suse.com/security/cve/CVE-2019-12420.html https://www.suse.com/security/cve/CVE-2020-1946.html https://bugzilla.suse.com/1159133 https://bugzilla.suse.com/1184221

1 0

openSUSE-SU-2021:0552-1: important: Security update for python-bleach
by opensuse-security＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Security Update: Security update for python-bleach ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0552-1 Rating: important References: #1167379 #1168280 #1184547 Cross-References: CVE-2020-6816 CVE-2020-6817 CVE-2021-23980 CVSS scores: CVE-2020-6816 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23980 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python-bleach fixes the following issues: - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547) Update to 3.1.5: * replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson. Update to 3.1.4 (boo#1168280, CVE-2020-6817): * ``bleach.clean`` behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute were vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``. * Style attributes with dashes, or single or double quoted values are cleaned instead of passed through. update to 3.1.3 (boo#1167379, CVE-2020-6816): * Add relative link to code of conduct. (#442) * Drop deprecated 'setup.py test' support. (#507) * Fix typo: curren -> current in tests/test_clean.py (#504) * Test on PyPy 7 * Drop test support for end of life Python 3.4 * ``bleach.clean`` behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or ``svg`` tags and one or more of the RCDATA tags ``script``, ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or ``xmp`` in the allowed tags whitelist were vulnerable to a mutation XSS. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-552=1 Package List: - openSUSE Leap 15.2 (noarch): python2-bleach-3.1.5-lp152.2.3.1 python3-bleach-3.1.5-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-6816.html https://www.suse.com/security/cve/CVE-2020-6817.html https://www.suse.com/security/cve/CVE-2021-23980.html https://bugzilla.suse.com/1167379 https://bugzilla.suse.com/1168280 https://bugzilla.suse.com/1184547

1 0

openSUSE-RU-2021:0549-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 14 Apr '21

14 Apr '21

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0549-1 Rating: moderate References: #1134688 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Avoid breaking text codec inintialization (boo#1134688, kde#432406): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-549=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kio-5.71.0-lp152.2.12.1 kio-core-5.71.0-lp152.2.12.1 kio-core-debuginfo-5.71.0-lp152.2.12.1 kio-debuginfo-5.71.0-lp152.2.12.1 kio-debugsource-5.71.0-lp152.2.12.1 kio-devel-5.71.0-lp152.2.12.1 kio-devel-debuginfo-5.71.0-lp152.2.12.1 - openSUSE Leap 15.2 (x86_64): kio-32bit-5.71.0-lp152.2.12.1 kio-32bit-debuginfo-5.71.0-lp152.2.12.1 kio-core-32bit-5.71.0-lp152.2.12.1 kio-core-32bit-debuginfo-5.71.0-lp152.2.12.1 kio-devel-32bit-5.71.0-lp152.2.12.1 kio-devel-32bit-debuginfo-5.71.0-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): kio-lang-5.71.0-lp152.2.12.1 References: https://bugzilla.suse.com/1134688

1 0

openSUSE-SU-2021:0548-1: important: Security update for umoci
by opensuse-security＠opensuse.org 13 Apr '21

13 Apr '21

openSUSE Security Update: Security update for umoci ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0548-1 Rating: important References: #1184147 Cross-References: CVE-2021-29136 CVSS scores: CVE-2021-29136 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for umoci fixes the following issues: - Update to umoci v0.4.6. - CVE-2021-29136: malicious layer allows overwriting of host files (bsc#1184147) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-548=1 Package List: - openSUSE Leap 15.2 (x86_64): umoci-0.4.6-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-29136.html https://bugzilla.suse.com/1184147

1 0